Login control method, application client, device, medium and program product

Abstract

The present disclosure relates to the field of computer technology, and discloses a login control method, an application client, a device, a medium, and a program product. The method is applied to the application client, and the method includes: in response to receiving a password modification instruction, displaying a first password modification interface, and receiving password modification information through the first password modification interface, wherein the password modification information includes a system password of a terminal device where the application client is located, an application account and a first application password registered by a first object in an identity source for logging into a target application; authenticating the password modification information, and in the case of passing the authentication, modifying the system password to the first application password; associating the application account with the system account of the terminal device, and sending the association relationship between the application account and the system account to the application server. Login can be simplified.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a login control method, an application client, a device, a medium, and a program product. Background Art

[0002] At present, many enterprises and other organizations use AD domains (Active Directory Domain) to manage devices in the network in a unified manner. For example, the password complexity, password change cycle, installed application software, etc. of the device can be managed in a unified manner.

[0003] When users use devices that need to be managed through an AD domain, they usually need to log in to the local device first, and then log in to the AD domain, which brings a lot of inconvenience to user operations.

[0004] Therefore, a method that can simplify login is urgently needed. Summary of the invention

[0005] In view of this, embodiments of the present disclosure provide a login control method, an application client, an electronic device, a computer-readable storage medium, and a computer program product, which can simplify login.

[0006] On one hand, the present disclosure provides a login control method, which is applied to an application client and includes:

[0007] In response to receiving the password modification instruction, displaying a first password modification interface, and receiving password modification information through the first password modification interface, wherein the password modification information includes a system password of the terminal device where the application client is located, an application account registered by the first object in the identity source for logging into the target application, and a first application password;

[0008] authenticating the password modification information, and if the authentication passes, changing the system password to the first application password;

[0009] The application account is associated with the system account of the terminal device, and the association relationship between the application account and the system account is sent to the application server.

[0010] In one aspect, the present disclosure provides an application client, the application client comprising:

[0011] a login information acquisition module, configured to display a first password modification interface in response to receiving a password modification instruction, and receive password modification information through the first password modification interface, wherein the password modification information includes a system password of the terminal device where the application client is located, an application account registered by the first object in the identity source for logging into the target application, and a first application password;

[0012] A password modification module, used for authenticating the password modification information, and changing the system password to the first application password if the authentication is successful;

[0013] The account association module is used to associate the application account with the system account of the terminal device, and send the association relationship between the application account and the system account to the application server.

[0014] Another aspect of the present disclosure further provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0015] Another aspect of the present disclosure provides an electronic device, which includes a processor and a memory, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the method described above is implemented.

[0016] Another aspect of the present disclosure provides a computer program product, including a computer program, and when the computer program is executed by a processor, the method as described above is implemented.

[0017] In the technical solutions of some embodiments of the present disclosure, in response to receiving a password change instruction, based on the application account and the first application password used to log in to the target application, the system password of the terminal device is changed to the first application password, and after the application account and the system account of the terminal device are associated, the terminal device and the target application can be logged in based on the same password, without entering multiple different passwords, thereby achieving the purpose of simplifying login. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The features and advantages of the present disclosure will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the present disclosure in any way. In the accompanying drawings:

[0019] Figure 1 A schematic diagram of a network architecture of an AD domain is shown;

[0020] Figure 2 A schematic diagram of a new network architecture provided by an embodiment of the present disclosure is shown;

[0021] Figure 3 A flowchart of a login control method provided by an embodiment of the present disclosure is shown;

[0022] Figure 4 A schematic diagram of an application client login interface provided by an embodiment of the present disclosure is shown;

[0023] Figure 5A schematic diagram of a first password modification interface provided by an embodiment of the present disclosure is shown;

[0024] Figure 6 A schematic diagram of module interaction for modifying a system password based on a first application password provided by an embodiment of the present disclosure is shown;

[0025] Figure 7 A schematic diagram of module interaction for changing a system password from a first application password to a second application password provided by an embodiment of the present disclosure is shown;

[0026] Figure 8 A schematic diagram of module interaction for modifying a system password locally on a terminal device provided by an embodiment of the present disclosure is shown;

[0027] Fig. 9 A module schematic diagram of a login control system provided by an embodiment of the present disclosure is shown;

[0028] Fig.10 A schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0030] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0031] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0032] Herein, unless explicitly stated, executing a step “in response to A” does not mean executing the step immediately after “A” but may include one or more intermediate steps.

[0033] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0034] It is understandable that before using the technical solutions disclosed in the various embodiments of the present disclosure, the types, scopes of use, usage scenarios, etc. of the information involved in the present disclosure should be informed to relevant users and their authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations. The relevant users may include any type of right holders, such as individuals, enterprises, and groups.

[0035] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly prompt the relevant user that the operation requested to be performed will require obtaining and using the information of the relevant user, so that the relevant user can independently choose whether to provide information to software or hardware such as an electronic device, application, server or storage medium that executes the operation of the technical solution of the present disclosure based on the prompt message.

[0036] As an optional but non-limiting implementation, in response to receiving an active request from a relevant user, a prompt message is sent to the relevant user, for example, in the form of a pop-up window, in which the prompt message may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to select "agree" or "disagree" to provide information to the electronic device.

[0037] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0038] Office security usually involves the security management of networks, identities, and terminals. By implementing private network networking, access control, terminal management in private networks, and information security protection, digital office can be made safer, more efficient, and easier to use. Security management at the network level can ensure that private networks such as office networks can operate safely and efficiently, thereby ensuring that business data can be safely transmitted and stored. Security management at the identity level can improve the efficiency and security of identity authentication for users accessing private networks. Security management at the terminal level can achieve unified management of terminal devices within the private network, data leakage prevention, and terminal threat protection, thereby ensuring the security of corporate data.

[0039] In actual applications, the security management of networks, identities, and terminals can achieve technical linkage in multiple technical branches such as networking strategies, network access and control, remote access, unified terminal management, terminal detection and response, enterprise data leakage prevention, and identity authentication management, making digital office simpler, more efficient, and easier to implement.

[0040] Combined with reference Figure 1 , which is a schematic diagram of the network architecture of an AD domain. Figure 1 In the AD domain, the AD domain includes one or more devices 11, a domain controller 12, and AD domain resources 13. Among them, the AD domain resources 13 refer to resources that can be provided to the device 11, such as printers, databases, file servers, various business systems, etc. The domain controller 12 can perform unified management of the devices 11 added to the AD domain, such as performing authority management on the AD domain resources 13 allowed to be used by each device 11, and managing the application software installed in each device 11.

[0041] Specifically, an AD domain user name and an AD domain password can be created for each device 11 in the domain controller 12. On the one hand, based on the AD domain user name, the access rights of each device 11 to the AD domain resources 13 can be set. For example, the AD domain user name of device A is AA, and the AD domain user name of device B is BB. Associating the AD domain user name AA with printer A, business system A, and application software A can indicate that device A is allowed to use printer A and business system A, and only application software A is allowed to be installed on device A; associating the AD domain user name BB with printer B, business system B, and application software B can indicate that device A is allowed to use printer B and business system B, and only application software B is allowed to be installed on device B.

[0042] The device 11 can send an authentication request based on the AD domain user name and AD domain password to the domain controller 12. When the domain controller 12 authenticates the AD domain user and AD domain password of the device 11, the device 11 can join the AD domain and use the AD domain resources 13 within its authority.

[0043] On the other hand, the domain controller 12 can also manage the AD domain password of the device 11, such as managing the complexity of the AD domain password, the replacement cycle of the AD domain password, etc.

[0044] Figure 1 The network architecture shown has the following problems:

[0045] 1) The domain controller 12 is the authority control center of all AD domain resources 13. It is highly coupled with the AD domain resources 13 and the devices 11, making it vulnerable to network attacks and subject to risks such as data leakage, resulting in low network security.

[0046] 2) For the user using the device 11, since the operating system 111 of the device 11 has a system account and a system password, the user needs to first log in to the device 11 based on the system account and the system password of the device 11, and then enter the AD domain user name and the AD domain password in the AD login interface of the device 11 to add the device 11 to the AD domain. Usually, the system account and the AD domain user name are different, and the system password and the AD domain password are different, which brings a lot of inconvenience to the user's login operation.

[0047] 3) The domain controller 12 usually does not manage the system password of the device 11, resulting in problems such as insufficient complexity requirements for the system password of the device 11 and the password replacement cycle not meeting the requirements, resulting in low network security.

[0048] In view of this, some embodiments of the present disclosure first provide a new network architecture, which can solve the above problem 1). Figure 2 As shown, the network architecture of the present disclosure includes a terminal device 21, a management server 22 and a domain controller 23. Among them, the terminal device 21 can be a device with a macOS system. An operating system 213 can be installed in the terminal device 21, and a target application can be installed in the terminal device 21 and the management server 22. The target application can be used to manage the terminal device 21, such as managing the network resources allowed to be accessed by the terminal device 21, managing the network access time of the terminal device 21, etc., performing security protection on the terminal device 21, performing data leakage prevention management on the terminal device 21, etc.

[0049] Specifically, the target application may include an application client 211 and an application server 221. The application client 211 may be a client program of the target application running in the terminal device 21. The application server 221 may be a server program of the target application running in the management server 22. The application client 211 and the application server 221 cooperate with each other to complete the management of the terminal device 21. For example, the correspondence between the account and the network resources allowed to be accessed may be pre-set in the application server 221, such as corresponding account A to websites a and b, and corresponding account B to websites a and c. In the terminal device 21, in response to receiving an instruction to start running (such as the shortcut icon of the application client 211 being double-clicked), the application client 211 may start running and display the client interface 212. In response to the account and password being input into the client interface 212, the application client 211 may send the account and password in the client interface 212 to the application server 221 for authentication. If the authentication is successful, the application server 221 may determine the network resources that the terminal device 21 is allowed to access based on the correspondence between the pre-set account and the network resources that are allowed to be accessed. For example, when the account in the client interface 212 is the above-mentioned account A, it means that the terminal device 21 is allowed to access websites a and b; when the account in the client interface 212 is the above-mentioned account B, it means that the terminal device 21 is allowed to access websites a and c.

[0050] Furthermore, the above account and password may be pre-registered in the domain controller 23. In short, the domain controller 23 may be an account management platform for the target application. The account management includes but is not limited to account registration, account complexity management, account change cycle management, etc.

[0051] In some embodiments, the account and password in the domain controller 23 can be synchronized to the application server 221 to facilitate the application server 221 to authenticate the account and password sent by the application client 211.

[0052] In other embodiments, the application server 221 may send the account and password to the domain controller 23 for authentication by the domain controller 23. After the domain controller 23 passes the authentication, the application server 221 manages the terminal device 21, for example, based on the correspondence between the account and the network resources allowed to be accessed, manages the network resources accessed by the terminal device 21.

[0053] exist Figure 2In the network architecture shown, the domain controller 23 can only perform basic account management, and the application server 221 can manage the terminal device 21 based on the account. In other words, the account management logic can be placed in the domain controller 23, and the management logic of the terminal device 21 can be placed in the application server 221. The present disclosure of logging in to the target application from the terminal device 21 can be equivalent to Figure 1 The technology shown in the figure adds the terminal device 21 to the AD domain. In this way, the management logic of the domain controller 23 and the terminal device 21 are decoupled, thereby improving network security.

[0054] In addition, it should be noted that Figure 1 The network architecture shown may include multiple AD domains. The logic of each AD domain for unified management of the device 11 may be different. Figure 2 In the network architecture shown, there is no need to divide domains, and management logics can be set separately for different terminal devices 21 at the application server 221 .

[0055] based on Figure 2 The network architecture shown in the present disclosure provides a login control method based on a target application, which can solve the above Figure 1 Problem 2) and Problem 3) in the network architecture shown in FIG. Specifically, the login control method can be applied to Figure 2 The application client 211 in the embodiment, or the terminal device 21 running the application client 211. The terminal device 21 includes but is not limited to a tablet computer, a laptop computer, a mobile phone, a desktop computer, etc. Figure 3 , which is a flow chart of a login control method provided by an embodiment of the present disclosure. Figure 3 In the example, the login control method includes the following steps:

[0056] Step S31, in response to receiving a password change instruction, displays a first password change interface, and receives password change information through the first password change interface, wherein the password change information includes the system password of the terminal device 21 where the application client 211 is located, the application account registered by the first object in the identity source for logging in to the target application, and the first application password.

[0057] Specifically, the identity source refers to the module that manages the account of the target application, such as Figure 2The first object refers to a subject that can register an account in the identity source, such as a user. The application account and the first application password refer to the account and password for logging into the target application managed in the identity source. The system password refers to the login password of the operating system 213 of the terminal device 21 (also referred to as the local password of the terminal device 21). Usually, the above application account and the first application password can be pre-registered in the identity source. The system password can be set locally on the terminal device 21 by the user using the terminal device 21.

[0058] In this embodiment, the password modification instruction may be sent by the application server 221 to the application client 211 when the user logs in to the target application, and is used to instruct to modify the system password of the terminal device 21. Specifically, before displaying the first password modification interface, the application client 211 may respond to the user performing the operation of logging in to the target application in the terminal device 21 and display the following information: Figure 4 For example, when a user double-clicks the shortcut icon of the application client 211 in the terminal device 21, indicating that the target application needs to be logged in, the following login interface may be displayed: Figure 4 The login interface is shown.

[0059] In response to receiving the application account and the first application password through the login interface, the application client 211 may send the application account and the first application password to the application server 221. The application server 221 may include a configuration interface, in which the operation and maintenance personnel may configure the management policy of the terminal device 21 based on the application account. The management policy may include whether the system password of the terminal device 21 needs to be modified. After the application server 221 authenticates the received application account and the first application password, if it is determined that a password modification operation needs to be performed on the terminal device 21 based on the management policy corresponding to the application account, a password modification instruction may be issued to the application client 211.

[0060] Specifically, after the management policy of an application account is configured to require the system password of the terminal device 21 to be modified, if the user uses the application account to log in to the target application for the first time in the terminal device 21, the application server 221 can send a password modification instruction to the application client 211 in the terminal device 21, so that the application client 211 displays the following information: Figure 5 On the contrary, when the management policy of an application account is configured to not require the system password of the terminal device 21 to be modified, if the user uses the application account to log in to the target application in the terminal device 21, the application server 221 may not send a password modification instruction to the application client 211. In this case, the application client 211 may display an interface indicating a successful login.

[0061] For example, according to the order of time points, it is assumed that there are time points A, B, C, and D. Before time point B, the management policy corresponding to application account A is configured to not require the system password of terminal device 21 to be modified, and at time point B, the management policy corresponding to application account A is configured to require the system password of terminal device 21 to be modified. Then:

[0062] At time point A, when the user uses application account A to log in to the target application in terminal device A, the application server 221 does not need to send a password modification instruction to the application client 211 in terminal device A. In this case, the application client 211 can display a successful login interface;

[0063] At time point C, since the user uses application account A to log in to the target application in terminal device A for the first time after the management policy corresponding to application account A is configured to require the system password of terminal device 21 to be modified, the application server 221 needs to send a password modification instruction to the application client 211 in terminal device A. In this case, the application client 211 displays the first password modification interface;

[0064] At time point D, although the management policy corresponding to application account A is configured to require the system password of terminal device 21 to be modified, it is not the first time that the user uses application account A to log in to the target application in terminal device A. Therefore, application server 221 does not need to send a password modification instruction to application client 211 in terminal device A. In this case, application client 211 can display a successful login interface.

[0065] Step S32: authenticating the password modification information, and if the authentication is successful, modifying the system password to the first application password.

[0066] The authentication of the password modification information mainly includes the authentication of the system password, and the authentication of the application account and the first application password.

[0067] 1) Authenticate the system password

[0068] Specifically, the local storage of the terminal device 21 may store a system password preset by the user. The system password obtained in step S31 may be compared with the system password in the local storage. If the two match, it indicates that the system password authentication is passed; if the two do not match, it indicates that the system authentication is failed.

[0069] Specifically, in this embodiment, in order to ensure password security, the system password in the local storage can be saved in the form of a password summary. Therefore, the system password obtained in step S31 and the system password in the local storage can be compared in summary to determine whether the two match.

[0070] 2) Authenticate the application account and the first application password

[0071] Specifically, the application account and the first application password can be sent to the application server 221 of the target application, so that the application server 221 authenticates the application account and the first application password based on the account and password information obtained from the identity source, or the application account and the first application password can be sent to the identity source through the application server 221, and the identity source authenticates the application account and the first application password.

[0072] When the system password, the application account and the first application password are authenticated, the system password locally stored in the terminal device 21 may be modified to the first application password.

[0073] In this embodiment, after the system password of the terminal device 21 is changed to the first application password, the first application password can be saved in the terminal device 21 in the form of a password digest, so as to improve the password security and reduce the risk of password leakage.

[0074] It is understandable that, since the system password of the terminal device 21 is changed to the first application password when the target application is logged in for the first time in the terminal device 21, the terminal device 21 can be logged in based on a unified password when logging in to the terminal device 21 and the target application subsequently. In this way, the user does not need to enter multiple different passwords, thereby simplifying the login process.

[0075] Step S33 , associating the application account with the system account of the terminal device 21 , and sending the association relationship between the application account and the system account to the application server 221 .

[0076] Specifically, the system account is the login account of the operating system 213 of the terminal device 21 (also referred to as the local account of the terminal device 21). The application server 221 can save the association between the application account and the system account. When the user uses the application account to log in to the target application on the terminal device 21, the application client 211 can send the application account, the first application password and the system account of the terminal device 21 to the application server 221. After receiving the application account and the system account sent by the application client 211, the application server 221 can search for the system account associated with the application account. If the system account associated with the application account is the same as the system account sent by the application client 211, it can be determined that the authentication is successful; if the system account associated with the application account is different from the system account sent by the application client 211, it can be determined that the authentication has failed.

[0077] Based on the above description, after the application account is associated with the terminal device 21, when the user logs in to the target application again in the terminal device 21, he can only use the application account associated with the system account of the terminal device 21 to log in, which is equivalent to binding the application account with the terminal device 21. This can bring the following two beneficial effects:

[0078] On the one hand, it can greatly reduce the risk of application account borrowing and password leakage, and effectively improve network security. For example: Assume that user A owns terminal device A, and user A's application account is application account A. User A associates application account A with the system account of terminal device A. User B owns terminal device B. When user A lends application account A to user B for use on terminal device B, since the system account associated with application account A is not the system account of terminal device B, user B cannot use application account A to successfully log in to the target application on terminal device B. In this way, the purpose of reducing the risk of application account borrowing and password leakage is achieved.

[0079] On the other hand, if the first application password corresponding to the application account associated with the system account is not modified, it is ensured that the user can use a unified password to log in to the terminal device 21 and log in to the target application in the terminal device 21 at the same time, without having to enter multiple different passwords, thereby achieving the purpose of simplifying login. For example, assuming that the application account and the system account are not associated, and different application accounts are allowed to log in to the target application in the same terminal device A, then, since the first application passwords corresponding to the various application accounts are different, each time the target application is logged in in the terminal device A, the first application password may be different from the system password, so that the passwords entered for the two logins are different, which does not achieve the purpose of simplifying login.

[0080] In summary, in the technical solutions of some embodiments of the present disclosure, in response to receiving a password modification instruction, based on the application account and the first application password used to log in to the target application, the system password of the terminal device is modified to the first application password, and after the application account is associated with the system account of the terminal device 21, the terminal device 21 and the target application can be logged in based on the same password. In this way, when managing the terminal device through the target application, there is no need to enter multiple different passwords, thereby achieving the purpose of simplifying login.

[0081] In addition, in the scheme disclosed in the present invention, since the login is simplified by modifying the system password, the functions in the terminal device 21 that need to be verified by the system password can achieve the purpose of simplified login, and the adaptability is good. For example, in some technologies, the login of the terminal device is simplified by an authorization plug-in mechanism. In these technologies, although the login can be simplified when the user logs in to the terminal device and performs device management applications, after the terminal device turns on the specified functions (such as the file safe function), these specified functions require the user to enter the system password and can only run normally after the system password authentication is passed. Therefore, the user still needs to enter two different passwords, and simplified login cannot be achieved. However, in the scheme disclosed in the present invention, because the system password is modified to the application password of the target application, the purpose of simplified login can also be achieved when the functions that need to be verified by the system password are used in the terminal device 21.

[0082] The scheme of the present disclosure is further described below.

[0083] In some embodiments, when the first application password is changed to the second application password, the method of the present disclosure may further include:

[0084] Get the second application password;

[0085] Change the system password from the first application password to the second application password.

[0086] Among them, the identity source can manage the password change cycle of each application account. When the first application password of an application account has not been changed for more than a preset period of time (such as 3 months), the identity source can send an email or text message to the user to remind the user to modify the first application password of the application account; or, the user can update the first application password according to actual needs. Specifically, the identity source may include a password reset interface, and the user enters the password reset interface of the identity source to change the first application password of the application account to the second application password; or, the application client 211 may include a password reset interface, and the user enters the password reset interface of the application client 211 to change the first application password of the application account to the second application password. When the first application password is modified through the application client 211, the application client 211 responds to the first application password being changed to the second application password in the password reset interface, and can send a request to modify the first application password to the identity source through the application server 221 to notify the identity source to change the first application password to the second application password.

[0087] In response to the first application password being changed to the second application password, the identity source may send a first password update instruction to the application server 221, and send the target application account whose password is to be updated, the first application password (old password) and the second application password (new password) of the target application account to the application server 221. In response to receiving the password update instruction, the application server 221 may, on the one hand, locally change the first application password of the target application account to the second application password, and on the other hand, determine the target terminal device 21 whose system password is to be updated based on the association between the application account and the system account, and then send a second password update instruction to the application client 211 in the target terminal device 21, and send the received target application account, the first application password and the second application password of the target application account to the application client 211, so that the application client 211 changes the password digest of the locally stored first application password to the password digest of the second application password.

[0088] In the above embodiment, the passwords of the application account in the identity source, the application server 221 and the application client 211 can be kept unified, so that after the first application password is changed, the user can still log in with the same password.

[0089] Furthermore, in some scenarios (such as network attacks), there may be a situation where the owner of a non-application account changes the first application password of the application account to the second application password. For example, application account A belongs to user A, but in scenarios such as network attacks, user B may change the password of application account A. In this case, the password summary of application account A stored in terminal device 21 will also be modified accordingly, making it impossible for user A to log in to terminal device 21 and the target application based on the first application password. This is a very bad experience for user A.

[0090] In view of this, in response to the first application password being changed to the second application password, after obtaining the second application password, the application client 211 can save the second application password, but does not immediately change the locally saved password digest of the first application password to the password digest of the second application password, but can display the second password modification interface, and receive the second application password and system password through the second password modification interface. The second application password and system password received through the second password modification interface can be manually entered by the application account owner himself.

[0091] It is understandable that if the password modification operation of the identity source is initiated by the application account owner himself, then he must know the second application password and the current system password of the terminal device 21, so he can enter the correct second application password and the current system password in the second password modification interface. In this case, in response to the second application password received through the second password modification interface being the same as the saved second application password, and the system password received through the second password modification interface being the same as the first application password, the system password can be modified from the first application password to the second application password.

[0092] However, if the password modification operation of the identity source is not initiated by the application account owner himself, then he must not know the second application password. Therefore, the second application password entered in the second password modification interface must be different from the second application password temporarily saved locally. In this case, the user can be prompted through the client interface 212 that the first application password of the application account in the identity source has been modified, so that the user can handle it in time.

[0093] Furthermore, for the sake of password security, when saving the second application password, the password digest of the second application password can be saved. If the password digest of the second application password received through the second password modification interface is the same as the password digest of the saved second application password, then the second application password received through the second password modification interface can be considered to be the same as the saved second application password, and if the password digest of the system password received through the second password modification interface is the same as the password digest of the first application password, then the system password received through the second password modification interface can be considered to be the same as the first application password. Furthermore, changing the system password from the first application password to the second application password may refer to changing the password digest of the system password from the password digest of the first application password to the password digest of the second application password.

[0094] In the above embodiment, after the application client 211 receives the second application password, the local system password of the terminal device 21 is not immediately changed from the first application password to the second application password, but first checks whether the second application password entered by the user in the second password modification interface is the same as the saved second application password, and whether the system password entered by the user in the second password modification interface is the same as the first application password, and in response to the second application password received through the second password modification interface being the same as the saved second application password, and the system password received through the second password modification interface being the same as the first application password, the system password is changed from the first application password to the second application password. In this way, the first application password in the identity source can be prevented from being modified by someone other than the application account, and the network security is high.

[0095] In some embodiments, after the system password is changed from the first application password to the second application password, the method of the present disclosure may further include:

[0096] A password update prompt is displayed, wherein the password update prompt includes the application account, so as to prompt that the system password has been changed to the password currently corresponding to the application account.

[0097] For example, after the system password of the terminal device 21 is changed to the second application password of the application account A, the password update prompt displayed may be: Please use the current password of the application account A (ie, the second application password) to log in.

[0098] It is understandable that the owner of application account A knows the current password of application account A, and therefore can log in to terminal device 21. However, non-owners of application account A do not know the current password of application account A, and therefore cannot log in to terminal device 21. In this way, on the one hand, non-owners of application account A can be prevented from logging in to terminal device 21 associated with application account A, and on the other hand, the modified second application password is not directly displayed in the password update prompt, which can reduce the risk of password leakage. High network security.

[0099] Furthermore, in some embodiments, considering that the identity source has a password management function, but the terminal device 21 does not have a password management function, the system password can be managed through the identity source, such as managing the password complexity and password change cycle of the system password. In order to ensure that the system password is within the management scope of the identity source, the modification of the system password can be triggered only by modifying the first application password, that is, the system password is not allowed to be modified in the terminal device 21. Based on the above description, in the case where the first application password is not modified but the system password is modified, the system password can be modified again to the first application password. In this way, the password management function of the identity source can be used to manage the system password, and the password security is relatively high.

[0100] Specifically, in some embodiments, in step S31, after the password modification information is obtained, the first application password may be saved. The first application password may be saved in the form of a password summary. On this basis, the above-mentioned re-modification of the system password to the first application password may include:

[0101] Displaying a third password modification interface, and receiving the first application password and the system password through the third password modification interface;

[0102] In response to the first application password received through the third password modification interface being identical to the saved first application password, and the system password received through the third password modification interface being identical to the modified system password, the system password is modified to the first application password.

[0103] Specifically, when the system password is changed back to the first application password, the user is required to re-enter the first application password and the current system password of the operating system 213 through the third password modification interface, and the system password is changed back to the first application password only when the received first application password and system password are the same as the first application password and system password locally saved in the terminal device 21.

[0104] In this way, the user can be notified that the system password has been changed back to the first application password, preventing the user from continuing to log in to the terminal device 21 using the system password that he / she has modified.

[0105] Further, in some embodiments, the terminal device 21 includes a password management tool. Among them, in some terminal devices 21, the password management tool can also be called a keychain, which is used to store passwords of one or more applications in the terminal device 21. After the user logs in to the terminal device 21 using the system password, if he wants to continue to use the applications in the terminal device 21 whose passwords are saved in the password management tool, he needs to log in to the application with the password in the password management tool before he can use these applications. In order to achieve password unification and simplify login, in the method disclosed in the present invention, when the password modification information in step S31 is authenticated, the passwords of at least some applications in the password management tool can be modified to the first application password, and in response to the first application password being modified to the second application password, the passwords of at least some applications in the password management tool can be modified from the first application password to the second application password.

[0106] In this way, the same password can be used to log in to the terminal device 21, the target application, and other applications in the terminal device 21 except the target application.

[0107] Combined with reference Figure 6 , which is a schematic diagram of module interaction for modifying a system password based on a first application password provided by an embodiment of the present disclosure. Figure 6 The steps include:

[0108] Step S60: the application server sends a password modification instruction to the application client.

[0109] Specifically, as described in step S31, after the management policy corresponding to an application account is configured to require modification of the system password of the terminal device, if the application account is used to log in to the target application in the terminal device for the first time, the application server can send a password modification instruction to the application client in the terminal device.

[0110] Step S61: The application client displays a first password modification interface through a client interface.

[0111] As described in step S31, the first password modification interface can be as follows: Figure 5 As shown, it is used to receive the application account, the first application password and the system password input by the user.

[0112] Step S62: The application client sends an authentication request to the application server based on the application account and the first application password received from the first password modification interface.

[0113] Step S63: The application server sends an authentication request to the domain controller.

[0114] Specifically, the application server sends the received application account and first application password to the domain controller, and the domain controller authenticates the application account and the first application password.

[0115] Step S64: The domain controller returns the authentication result to the application server.

[0116] Step S65: The application server sends the authentication result returned by the domain controller to the application client.

[0117] Step S66: When the authentication result returned by the domain controller indicates that the authentication is successful, the application client saves the first application password and continues to authenticate the system password of the operating system.

[0118] Specifically, the password digest of the first application password can be determined and saved in the form of the password digest. In this way, the password can be prevented from being leaked. The first application password saved here can be Fig. 9 Used in the scenario shown in .

[0119] Further, as described in step S32, the received system password may be compared with the system password in the local storage of the terminal device. If the two match, it is considered that the authentication of the system password is successful.

[0120] Step S67: When the system password authentication is passed, the application client modifies the system password of the operating system to the first application password.

[0121] Step S68: The application client associates the application account with the system account of the operating system and displays the association relationship through the client interface.

[0122] Step S69: The application client reports the association relationship between the application account and the system account to the application server.

[0123] The principle of associating application accounts with system accounts can be found in Figure 3 The relevant description is not repeated here.

[0124] Combined with reference Figure 7 , which is a schematic diagram of module interaction for changing a system password from a first application password to a second application password provided by an embodiment of the present disclosure. Figure 7 The steps include:

[0125] Step S71: In response to a password modification operation performed by a user in a configuration interface, the domain controller modifies the first application password into a second application password.

[0126] Specifically, the configuration interface may be an interface of a domain controller or a client interface. When the configuration interface is a client interface, in response to a password modification operation performed by a user in the configuration interface, the application client may send the first application password and the second application password filled in by the user in the configuration interface to the domain controller through the application server, so that the domain controller modifies the first application password to the second application password.

[0127] Step S72: The domain controller sends a first password update instruction to the application server.

[0128] Specifically, when the domain controller issues the first password update instruction, it may also send the application account for which the password needs to be modified, the first application password corresponding to the application account, and the second application password to the application server.

[0129] Step S73: The application server sends a second password update instruction to the application client.

[0130] Specifically, when the application server issues the second password update instruction, it may also send the first application password and the second application password to the application server.

[0131] Step S74: the application client saves the second application password.

[0132] Specifically, the application client may save the second application password in the form of a password digest.

[0133] Step S75: the application client displays the second password modification interface through the client interface.

[0134] Specifically, the second password modification interface can be used to receive the second application password and system password input by the user. For the second password modification interface, please refer to the relevant description of the login control method, which will not be repeated here.

[0135] Step S76: The application client authenticates the system password and the second application password received through the second password modification interface.

[0136] Specifically, when authenticating the second application password received through the second password modification interface, the password digest of the received second application password can be compared with the second application password saved in step S74. If the two match, it means that the received second application password is authenticated.

[0137] When authenticating the system password received through the second password modification interface, the received system password may be compared with the system password locally stored in the terminal device for password digests. If the two match, it indicates that the received system password is authenticated.

[0138] Step S77: When the system password and the second application password received through the second password modification interface are authenticated successfully, the application client modifies the system password from the first application password to the second application password.

[0139] Step S78, the application client associates the application account with the system account of the operating system and displays the association relationship through the client interface.

[0140] Step S79: the application client reports the association relationship between the application account and the system account to the application server.

[0141] Combined with reference Figure 8 , which is a schematic diagram of module interaction for modifying a system password locally on a terminal device provided by an embodiment of the present disclosure. Figure 8 The steps include:

[0142] Step S81, the application client detects that a system password modification has occurred locally on the terminal device.

[0143] Simply put, the user modifies the system password locally on the terminal device.

[0144] Step S82: the application client displays a third password modification interface.

[0145] Specifically, the third password modification interface is used to receive the application account, the first application password and the modified system password input by the user. For the third password modification interface, please refer to the relevant description of the login control method, which will not be repeated here.

[0146] Step S83: The application client authenticates the system password and the first application password received from the third password modification interface.

[0147] Specifically, the first application password is authenticated by comparing the received first application password with the password digest of the first application password saved in the above step S66. If the two match, it is considered that the received first application password is authenticated.

[0148] For authenticating the received system password, please refer to the relevant description of step S76, which will not be repeated here.

[0149] Step S84: When the system password and the first application password received through the third password modification interface are authenticated successfully, the application client changes the system password to the first application password.

[0150] Step S85, the application client associates the application account of the target application with the system account of the operating system, and displays the association relationship through the client interface.

[0151] Step S86: The application client reports the association relationship between the application account and the system account to the application server.

[0152] This completes the description of the login control method disclosed herein.

[0153] Corresponding to the login control method, the present disclosure also provides an application client. Fig. 9 , which is a module diagram of an application client provided by an embodiment of the present disclosure. Fig. 9 In the application client, the following are included:

[0154] A login information acquisition module, configured to display a first password modification interface in response to receiving a password modification instruction, and receive password modification information through the first password modification interface, wherein the password modification information includes a system password of the terminal device where the application client is located, an application account registered by the first object in the identity source for logging into the target application, and a first application password;

[0155] The password modification module is used to authenticate the password modification information and, if the authentication is passed, modify the system password to the first application password;

[0156] The account association module is used to associate the application account with the system account of the terminal device, and send the association relationship between the application account and the system account to the application server.

[0157] In some embodiments, when the first application password is changed to the second application password, the password modification module is further configured to:

[0158] Get the second application password;

[0159] Change the system password from the first application password to the second application password.

[0160] In some embodiments, after obtaining the second application password, the password modification module is further used to:

[0161] Save the second app password;

[0162] Changing the system password from the first application password to the second application password includes:

[0163] Display the second password modification interface, and receive the second application password and the system password through the second password modification interface;

[0164] In response to the second application password received through the second password modification interface being identical to the saved second application password, and the system password received through the second password modification interface being identical to the first application password, the system password is modified from the first application password to the second application password.

[0165] In some embodiments, after the system password is changed from the first application password to the second application password, the password modification module is further configured to:

[0166] A password update prompt is displayed, wherein the password update prompt includes the application account, so as to prompt that the system password has been changed to the password currently corresponding to the application account.

[0167] In some embodiments, the terminal device includes a password management tool, and the password management tool is used to store login passwords for one or more applications in the terminal device;

[0168] When the password modification information is authenticated, the password modification module is also used to:

[0169] The passwords of at least some applications in the password management tool are modified to the first application password.

[0170] In response to the first application password being modified to a second application password, the method further includes:

[0171] Passwords of at least some applications in the password management tool are changed from first application passwords to second application passwords.

[0172] In some embodiments, when the first application password is not modified but the system password is modified, the password modification module is further configured to:

[0173] Change the system password back to the first application password.

[0174] In some embodiments, after receiving the password modification information, the login information acquisition module is further used to:

[0175] Save the first app password;

[0176] The password modification module is also used to:

[0177] Displaying a third password modification interface, and receiving the first application password and the system password through the third password modification interface;

[0178] In response to the first application password received through the third password modification interface being identical to the saved first application password, and the system password received through the third password modification interface being identical to the modified system password, the system password is modified to the first application password.

[0179] In some embodiments, the login information acquisition module is specifically used to:

[0180] For any application password of the first application password and the second application password, determine a password digest of the application password;

[0181] Save the password digest of this app password.

[0182] In some embodiments, the password modification module is specifically used to:

[0183] The application account and the first application password are sent to the application server of the target application so that the application server authenticates the application account and the first application password based on the account and password information obtained from the identity source, or the application account and the first application password are sent to the identity source through the application server, and the identity source authenticates the application account and the first application password.

[0184] In some embodiments, before displaying the first password modification interface, the password modification module is further configured to:

[0185] In response to the first object executing an operation of logging into the target application in the terminal device, displaying a login interface;

[0186] In response to receiving the application account and the first application password through the login interface, the application account and the first application password are sent to the application server, so that the application server, based on the management policy corresponding to the application account, determines that a password modification operation needs to be performed on the terminal device, and sends a password modification instruction to the application client.

[0187] Combined with reference Fig.10 , is a schematic diagram of an electronic device provided by an embodiment of the present disclosure. The electronic device includes a processor and a memory, the memory is used to store a computer program, and when the computer program is executed by the processor, the above method is implemented.

[0188] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0189] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, that is, implementing the method in the above method embodiment.

[0190] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0191] An embodiment of the present disclosure further provides a computer-readable storage medium, where the computer-readable storage medium is used to store a computer program. When the computer program is executed by a processor, the above method is implemented.

[0192] The present disclosure also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the above method is implemented.

[0193] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A login control method, characterized in that: The method is applied to an application client, and the method comprises: In response to receiving the password modification instruction, displaying a first password modification interface, and receiving password modification information through the first password modification interface, wherein the password modification information includes a system password of the terminal device where the application client is located, an application account registered by the first object in the identity source for logging into the target application, and a first application password; authenticating the password modification information, and if the authentication passes, changing the system password to the first application password; The application account is associated with the system account of the terminal device, and the association relationship between the application account and the system account is sent to the application server.

2. The method according to claim 1, characterized in that In a case where the first application password is changed to a second application password, the method includes: Obtaining the second application password; The system password is changed from the first application password to the second application password.

3. The method according to claim 2, characterized in that After obtaining the second application password, the method further includes: saving the second application password; The changing the system password from the first application password to the second application password includes: Displaying a second password modification interface, and receiving a second application password and a system password through the second password modification interface; In response to the second application password received through the second password modification interface being the same as the saved second application password, and the system password received through the second password modification interface being the same as the first application password, the system password is modified from the first application password to the second application password.

4. The method according to claim 2, characterized in that After changing the system password from the first application password to the second application password, the method further includes: A password update prompt is displayed, wherein the password update prompt includes the application account, so as to prompt that the system password has been changed to the password currently corresponding to the application account.

5. The method according to claim 2, characterized in that The terminal device includes a password management tool, and the password management tool is used to store login passwords of one or more applications in the terminal device; In the case where the password modification information is authenticated, the method further includes: Modify the passwords of at least some applications in the password management tool to the first application password; In response to the first application password being changed to a second application password, the method further includes: The passwords of at least some applications in the password management tool are changed from the first application password to the second application password.

6. The method according to claim 2, characterized in that In the case where the first application password is not modified but the system password is modified, the method further includes: The system password is changed back to the first application password.

7. The method according to claim 6, characterized in that After receiving the password modification information, the method further includes: saving the first application password; The step of re-changing the system password to the first application password includes: Displaying a third password modification interface, and receiving the first application password and the system password through the third password modification interface; In response to the first application password received through the third password modification interface being identical to the saved first application password, and the system password received through the third password modification interface being identical to the modified system password, the system password is modified to the first application password.

8. The method according to claim 7, characterized in that Saving the first application password or the second application password includes: For any application password of the first application password and the second application password, determine a password digest of the application password; Save the password digest of this app password.

9. The method according to claim 1, characterized in that The authenticating the password modification information includes: The application account and the first application password are sent to the application server of the target application so that the application server authenticates the application account and the first application password based on the account and password information obtained from the identity source, or the application account and the first application password are sent to the identity source through the application server, and the identity source authenticates the application account and the first application password.

10. The method according to claim 1, characterized in that Before displaying the first password modification interface, the method further includes: In response to the first object executing an operation of logging into the target application in the terminal device, displaying a login interface; In response to receiving the application account and the first application password through the login interface, the application account and the first application password are sent to the application server, so that the application server determines that a password modification operation needs to be performed on the terminal device based on the management policy corresponding to the application account, and issues the password modification instruction to the application client.

11. An application client, characterized in that: The application client comprises: a login information acquisition module, configured to display a first password modification interface in response to receiving a password modification instruction, and receive password modification information through the first password modification interface, wherein the password modification information includes a system password of the terminal device where the application client is located, an application account registered by the first object in the identity source for logging into the target application, and a first application password; A password modification module, used for authenticating the password modification information, and changing the system password to the first application password if the authentication is successful; The account association module is used to associate the application account with the system account of the terminal device, and send the association relationship between the application account and the system account to the application server.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

13. An electronic device, characterized in that: The electronic device comprises a processor and a memory, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the method according to any one of claims 1 to 10 is implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images