Identity authentication method and device, electronic equipment and computer program product

Abstract

The invention provides an identity authentication method and device, electronic equipment and a computer program product. Comprising the steps that when a browser receives an access request of a user for a target network application, if an IDAAS instance corresponding to the target network application determines that the login state of the user is a non-login state, the browser sends a first identity authentication request to a corresponding mobile gateway; the mobile gateway opens any target mobile application, and the target mobile application sends identity information to the target identity authentication service; the target identity authentication service performs identity authentication to obtain a corresponding identity authentication result; and the browser receives the identity authentication result and sends the identity authentication result to the IDAAS instance, and if the IDAAS instance determines that identity authentication result indication information in the identity authentication result indicates that the identity authentication of the user is passed, the IDAAS instance converts the login state of the user into the login state based on the identity information. According to the scheme, a user does not need to input identity information in a browser interface, the identity verification efficiency is improved, and the user experience is also improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to an identity authentication method, device, electronic device, and computer program product. Background Art

[0002] At present, enterprises are paying more and more attention to data security. Many enterprises will purchase and connect to IDAAS (Identity and Access Management as a Service) services and use IDAAS services to perform identity authentication management.

[0003] In the prior art, when employees access enterprise network applications (i.e., Web applications) on mobile devices, they need to perform identity authentication in IDAAs. The identity authentication here is usually the authentication method that comes with IDAAs, or the enterprise authentication method that can only be accessed in a browser and is connected to IDAAs.

[0004] However, the above-mentioned identity authentication method requires operations such as inputting identity information in a mobile browser, resulting in low efficiency and poor experience. Summary of the invention

[0005] The purpose of this application is to solve at least one of the above technical defects. The technical solutions provided by the embodiments of this application are as follows:

[0006] In a first aspect, an embodiment of the present application provides an identity authentication method, including:

[0007] When the browser receives an access request from the user for a target network application, if the identity and access management as a service IDAAS instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, and the mobile gateway acts as a proxy for at least one target mobile application, each of which contains the user's identity information;

[0008] In response to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends identity information to the target identity authentication service;

[0009] The target identity authentication service performs identity authentication based on the identity information and obtains a corresponding identity authentication result, which includes the identity information and identity authentication result indication information;

[0010] The browser receives the authentication result and sends the authentication result to the IDAS instance. If the IDAS instance determines that the authentication result indication information in the authentication result indicates that the user's authentication is successful, the IDAS instance converts the user's login state to the login state based on the identity information.

[0011] In an optional embodiment of the present application, the mobile gateway pre-accesses a first target identity authentication service login page, and the first target identity authentication service login page includes at least one trigger button of a target mobile application;

[0012] In response to the first identity authentication request, the mobile gateway opens any target mobile application, including:

[0013] In response to the first identity authentication request, the mobile gateway sends a first target identity authentication service login page to the browser;

[0014] The browser displays the first target identity authentication service login page, and when a trigger operation for any trigger button is received through the first target identity authentication service login page, the mobile gateway opens the target mobile application corresponding to any trigger button.

[0015] In an optional embodiment of the present application, the target mobile application sends identity information to the target identity authentication service, including:

[0016] When the mobile gateway opens the target mobile application corresponding to any trigger button, the target mobile application sends a second identity authentication request to the target identity authentication service;

[0017] In response to the second identity authentication request, the target identity authentication service sends a second target identity authentication login page to the target mobile application;

[0018] The target mobile application displays a second target identity authentication service login page, and the second target identity authentication login page includes a confirmation button for logging in using the identity information in the target mobile application;

[0019] Upon receiving a trigger operation for a confirmation button in the second target identity authentication service login page, the target mobile application sends identity information to the target identity authentication service.

[0020] In an optional embodiment of the present application, the browser receives the identity authentication result and sends the identity authentication result to the ID AAS instance, including:

[0021] The target identity authentication service converts the identity authentication result into a corresponding identifier and feeds the identifier back to the target mobile application;

[0022] The target mobile application sends the identifier to the browser, the browser obtains the authentication result based on the identifier, and sends the authentication result to the ID AAS instance.

[0023] In an optional embodiment of the present application, the method further includes:

[0024] When the target identity authentication service converts the identity authentication result into a corresponding identifier, the identifier and the identity authentication result are stored in the target identity authentication service in correspondence;

[0025] The browser obtains the authentication result based on the identifier, including:

[0026] The browser sends the identifier to the target authentication service;

[0027] The target authentication service obtains the corresponding authentication result based on the identifier and sends the authentication result to the browser.

[0028] In an optional embodiment of the present application, the access request includes identity information;

[0029] If the IDAAs instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, including:

[0030] If the IDAAAS instance determines that the user's login status is not logged in based on the identity information, it sends an authentication instruction to the browser, which includes the identification information of the target authentication service;

[0031] The browser sends a first identity authentication request to the corresponding mobile gateway based on the identification information of the target identity authentication service.

[0032] In an optional embodiment of the present application, the method further includes:

[0033] If the ID AAS instance does not contain identity information, the user's login status is determined to be a non-logged-in state.

[0034] In a second aspect, an embodiment of the present application provides an identity authentication device, including:

[0035] A first identity authentication request sending module is used for, when a browser receives an access request from a user for a target network application, if the identity and access management as a service IDAAS instance corresponding to the target network application determines that the user's login state is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, and the mobile gateway acts as a proxy for at least one target mobile application, each target mobile application containing the user's identity information;

[0036] An identity information sending module, configured to respond to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends identity information to a target identity authentication service;

[0037] An identity authentication result acquisition module is used for the target identity authentication service to perform identity authentication based on identity information and obtain a corresponding identity authentication result, which includes identity information and identity authentication result indication information;

[0038] The identity authentication result sending module is used for the browser to obtain the identity authentication result and send the identity authentication result to the IDAAS instance. If the IDAAS instance determines that the identity authentication result indication information in the identity authentication result indicates that the user's identity authentication is successful, the IDAAS instance converts the user into a logged-in state based on the identity information.

[0039] In an optional embodiment of the present application, the mobile gateway pre-accesses a first target identity authentication service login page, and the first target identity authentication service login page includes at least one trigger button of a target mobile application;

[0040] The identity information sending module is specifically used for:

[0041] In response to the first identity authentication request, the mobile gateway sends a first target identity authentication service login page to the browser;

[0042] The browser displays the first target identity authentication service login page, and when a trigger operation for any trigger button is received through the first target identity authentication service login page, the mobile gateway opens the target mobile application corresponding to any trigger button.

[0043] In an optional embodiment of the present application, the identity information sending module is further used to:

[0044] When the mobile gateway opens the target mobile application corresponding to any trigger button, the target mobile application sends a second identity authentication request to the target identity authentication service;

[0045] In response to the second identity authentication request, the target identity authentication service sends a second target identity authentication login page to the target mobile application;

[0046] The target mobile application displays a second target identity authentication service login page, and the second target identity authentication login page includes a confirmation button for logging in using the identity information in the target mobile application;

[0047] Upon receiving a trigger operation for a confirmation button in the second target identity authentication service login page, the target mobile application sends identity information to the target identity authentication service.

[0048] In an optional embodiment of the present application, the identity authentication result sending module is specifically used to:

[0049] The target identity authentication service converts the identity authentication result into a corresponding identifier and feeds the identifier back to the target mobile application;

[0050] The target mobile application sends the identifier to the browser, the browser obtains the authentication result based on the identifier, and sends the authentication result to the ID AAS instance.

[0051] In an optional embodiment of the present application, the identity authentication result acquisition module is further used to:

[0052] When the target identity authentication service converts the identity authentication result into a corresponding identifier, the identifier and the identity authentication result are stored in the target identity authentication service in correspondence;

[0053] The identity authentication result sending module is specifically used for:

[0054] The browser sends the identifier to the target authentication service;

[0055] The target authentication service obtains the corresponding authentication result based on the identifier and sends the authentication result to the browser.

[0056] In an optional embodiment of the present application, the access request includes identity information;

[0057] The first identity authentication request sending module is specifically used for:

[0058] If the IDAAAS instance determines that the user's login status is not logged in based on the identity information, it sends an authentication instruction to the browser, which includes the identification information of the target authentication service;

[0059] The browser sends a first identity authentication request to the corresponding mobile gateway based on the identification information of the target identity authentication service.

[0060] In an optional embodiment of the present application, the first identity authentication request sending module is further used to:

[0061] If the ID AAS instance does not contain identity information, the user's login status is determined to be a non-logged-in state.

[0062] In a third aspect, an embodiment of the present application provides an electronic device, including a memory and a processor;

[0063] A computer program is stored in the memory;

[0064] A processor is used to execute a computer program to implement the method provided in the embodiment of the first aspect or any optional embodiment of the first aspect.

[0065] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method provided in the embodiment of the first aspect or any optional embodiment of the first aspect is implemented.

[0066] In a fifth aspect, an embodiment of the present application provides a computer program product or a computer program, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that when the computer device executes, the method provided in the embodiment of the first aspect or any optional embodiment of the first aspect is implemented.

[0067] The beneficial effects of the technical solution provided by the embodiment of the present application are:

[0068] When the browser receives an access request from the user to the target network application, if the identity and access management as a service IDAS instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway that proxies at least one target mobile application; in response to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends the user's identity information to the target identity authentication service; the target identity authentication service performs identity authentication based on the identity information and obtains a corresponding identity authentication result; the browser receives the identity authentication result and sends the identity authentication result to the IDAS instance. If the IDAS instance determines that the identity authentication result indication information in the identity authentication result indicates that the user's identity authentication is passed, the IDAS instance converts the user's login status to a logged in state based on the identity information. In this solution, when the mobile gateway obtains the first authentication request from the browser, it will pull up any target mobile application that it is an agent of, and the target mobile application will send identity information to the target authentication service. The target authentication service will authenticate based on the received identity information and the obtained authentication structure will be passed to the IDAAS instance through the browser. In this authentication process, since the identity information in the target mobile application is utilized, the user does not need to enter the identity information in the browser interface, which improves the authentication efficiency and the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0070] Figure 1 A schematic diagram of the system architecture for implementing the identity authentication method provided in the embodiment of the present application;

[0071] Figure 2 A flowchart of an identity authentication method provided in an embodiment of the present application;

[0072] Figure 3This is a schematic diagram of the interaction between a browser and a corresponding ID AAS instance when a browser receives an access request in an example of an embodiment of the present application;

[0073] Figure 4 A schematic diagram of a mobile gateway connecting to a target identity authentication service login page and a target mobile application in an example of an embodiment of the present application;

[0074] Figure 5 A schematic diagram of a first target identity authentication service login page in an example of an embodiment of the present application;

[0075] Figure 6 A schematic diagram of a second target identity authentication service login page in an example of an embodiment of the present application;

[0076] Figure 7 A schematic diagram of the interactions between various entities when executing an identity authentication scheme in an example of an embodiment of the present application;

[0077] Figure 8 A flowchart of a product-side method of use in an example of an embodiment of the application;

[0078] Fig. 9 A structural block diagram of an identity authentication device is provided for an embodiment of the present application;

[0079] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0080] The embodiments of the present application are described below in conjunction with the drawings in the present application. It should be understood that the implementation methods described below in conjunction with the drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions of the embodiments of the present application.

[0081] It will be understood by those skilled in the art that, unless specifically stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the terms "including" and "comprising" used in the embodiments of the present application refer to that the corresponding features can be implemented as the presented features, information, data, steps, operations, elements and / or components, but do not exclude the implementation as other features, information, data, steps, operations, elements, components and / or combinations thereof supported by the technical field. It should be understood that when we say that an element is "connected" or "coupled" to another element, the one element may be directly connected or coupled to the other element, or it may refer to that the one element and the other element establish a connection relationship through an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein indicates at least one of the items defined by the term, for example, "A and / or B" may be implemented as "A", or as "B", or as "A and B".

[0082] It should be noted that the collection and processing of relevant data in this application should be strictly in accordance with the requirements of relevant national laws and regulations when applied in examples, and the informed consent or separate consent of the personal information subject should be obtained, and subsequent data use and processing should be carried out within the scope of authorization of laws and regulations and the personal information subject.

[0083] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0084] First, several terms involved in this application are introduced and explained:

[0085] SAML2.0: SAML2.0 is a protocol for authentication and authorization between different security domains. SAML stands for Security Assertion Markup Language, which allows authentication and authorization information to be shared between different applications and services without having to re-authenticate the user in each application. SAML2.0 is the latest version of the SAML protocol, which provides stronger security and more flexible configuration options to meet different authentication and authorization needs. SAML2.0 uses XML format to transmit authentication and authorization information, which makes it possible to integrate with a variety of different applications and services. SAML2.0 has become one of the widely used authentication and authorization protocols in enterprises and organizations, which can help organizations achieve functions such as single sign-on, cross-domain authentication and authorization.

[0086] Mobile authentication: Mobile authentication refers to the identity authentication process performed on mobile devices. With the popularity of mobile devices and the development of mobile applications, more and more users use mobile devices to access applications and services. Mobile authentication can help applications and services verify the identity of users to ensure that only authorized users can access application information and functions. Mobile authentication can use a variety of authentication methods, including username and password, fingerprint recognition, facial recognition, voiceprint recognition, etc. In order to ensure the security of mobile authentication, applications and services need to adopt secure authentication protocols and technologies, such as OAuth, OpenID Connect, SAML, etc.

[0087] IDAAS: IDAAS is the abbreviation of Identity and Access Management as a Service. It is a cloud computing service model that aims to provide enterprises and organizations with secure and reliable identity authentication and access control solutions. IDAAS can help enterprises and organizations implement identity authentication, authorization, single sign-on, multi-factor authentication, access auditing and other functions to improve security and user experience. Integration and scalability: IDAAS can be integrated with various applications and services, supports standard identity authentication and authorization protocols such as SAML, OAuth, OpenID Connect, etc., and has good scalability and flexibility. Common IDAAS products include OKTA, Microsoft Azure, etc.

[0088] Mobile Gateway: A mobile gateway is a network device or software that connects mobile devices to the Internet and provides secure and reliable data transmission and access control functions. Mobile gateways are usually located at the edge network of an enterprise or organization, and can help enterprises or organizations manage and protect the access and data transmission of mobile devices and mobile applications.

[0089] Enterprise applications: Enterprise applications refer to applications that provide services to enterprises or organizations, usually including applications in management, production, sales, customer service, etc. Enterprise applications can help enterprises or organizations achieve business goals such as improving management efficiency, reducing costs, and increasing customer satisfaction. Enterprise applications usually need to be accessed within the enterprise environment and can only be accessed after the enterprise's identity authentication.

[0090] The following describes several exemplary embodiments to illustrate the technical solutions of the embodiments of the present application and the technical effects produced by the technical solutions of the present application. It should be noted that the following embodiments can refer to, draw on or combine with each other, and the same terms, similar features and similar implementation steps in different embodiments will not be described repeatedly.

[0091] Figure 1 A schematic diagram of the system architecture for implementing the identity authentication method provided in the embodiment of the present application, the system may include a mobile terminal 101, a mobile gateway 102, a target identity authentication service 103, and an IDAS instance 104 used by a user (e.g., an enterprise employee). Among them, the target identity authentication service 103 and the IDAS instance 104 can be deployed in an internal network or a private cloud, and the mobile terminal 101 can access the target identity authentication service 103 and the IDAS instance 104 through the mobile gateway 102 in the external network. The mobile terminal 101 is installed with a browser and at least one target mobile application, and the user can access the enterprise application (i.e., the target network application) through the browser. At this time, the user identity needs to be authenticated, and the enterprise application docks with the corresponding IDAS instance 104 for user identity authentication. The target mobile application is installed in the user terminal and the user logs in to these target mobile applications, and the login information of these target mobile applications contains the identity information of the user. And the mobile gateway is pre-connected to the target identity authentication service, that is, the login page corresponding to the target identity authentication service can be pre-stored in the mobile gateway. At the same time, the mobile gateway is also docked with at least one of the above-mentioned target mobile applications.

[0092] In the prior art, if a user wants to access a web version of an enterprise application through a browser in a mobile terminal, the user's identity authentication is performed through the built-in authentication method provided by the IDAAAS instance 104, or the target identity authentication service that can only be accessed in the browser and connected to the IDAAAS instance 104 is used for identity authentication. In other words, the user needs to enter the corresponding identity information or account information through the browser to authenticate the identity. In the solution of the present application, the IDAAAS instance 104 can be connected to the target mobile application, and the user information already in the target mobile application can be used to complete the identity authentication of the user when the mobile terminal accesses the target network application through the browser. The implementation process of the solution of the present application will be described in detail below.

[0093] The solution of this application involves the following cloud technologies:

[0094] Cloud Security is a general term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior judgment. It uses a large number of clients in a network to monitor abnormal software behavior in the network, obtain the latest information on Trojans and malicious programs on the Internet, and send it to the server for automatic analysis and processing, and then distribute virus and Trojan solutions to each client.

[0095] The main research directions of cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, compliance auditing, etc.; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event, information collection and processing platform through cloud computing technology, realizing the collection and correlation analysis of massive information, and improving the control ability of security events and risk control capabilities of the entire network; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0096] A private cloud is a cloud infrastructure with software and hardware resources created within a firewall so that departments within an organization or enterprise can share resources within the data center. In addition to hardware resources, cloud equipment (IaaS, Infrastructure as a Service) software is generally required to create a private cloud.

[0097] Private cloud computing also includes three levels: cloud hardware, cloud platform, and cloud service. The difference is that cloud hardware is the user's own personal computer or server, not the cloud computing vendor's data center. The purpose of cloud computing vendors to build data centers is to provide public cloud services to millions of users, so they need to have tens of millions of servers. Private cloud computing only serves friends and relatives for individuals, and only serves employees, customers, and suppliers for enterprises. Therefore, an individual or enterprise's own personal computer or server is sufficient to provide cloud services.

[0098] Figure 2 A flowchart of an identity authentication method provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the method may include:

[0099] Step S201, when the browser receives an access request from a user for a target network application, if the identity and access management as a service ID AAS instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, and the mobile gateway proxies at least one target mobile application, each target mobile application containing the user's identity information.

[0100] Among them, network applications, i.e., Web applications, are applications that can be accessed through an Internet browser. They are usually located on a server and can be accessed by users using any Internet-connected device, such as a computer, tablet computer, or mobile phone. Web applications have many advantages, such as no need for installation, good cross-platform performance, easy development and maintenance, and simple operation. Common Web applications include email, social media, online shopping, online banking, etc. The target network application in the embodiment of the present application is the network application that the user wants to access, and the premise that the user is allowed to access the target network application is that the user's identity authentication is passed.

[0101] Mobile applications refer to applications that can be run on mobile devices. They can be installed through app stores, download links or other channels, and can provide users with various functions and services, such as social networking, entertainment, shopping, tools, etc. Mobile application development usually needs to consider factors such as different operating system platforms, screen sizes, processor performance and user experience. The popularity and popularity of mobile applications have changed people's lifestyles and business models, and have become an indispensable part of modern society. The target mobile application in the embodiment of the present application refers to the user's identity authentication when the user logs in to the target application. In other words, the login information of the target mobile application contains the user's identity information.

[0102] Further, the target network application docking has a preset IDAAAS instance, and the IDAAAS instance can provide a built-in identity authentication service, but it is necessary to receive the user's identity information through a browser. In the scheme of the embodiment of the present application, the IDAAAS instance docks the local target identity authentication service. In the embodiment of the present application, the IDAAAS instance can be deployed in an enterprise internal network or a private cloud. By deploying the IDAAAS instance locally in the enterprise, better network connection speed and security can be provided, and the enterprise can customize the configuration according to its own needs. In addition, compared with deploying the IDAAAS instance on the public Internet, deploying it in the enterprise intranet is more controllable for the protection and privacy of enterprise data. For example, the enterprise application of a certain enterprise is docked with a preset IDAAAS instance, and the IDAAAS instance docks the identity authentication service designed by the enterprise itself. Then when the user accesses the enterprise application, it is necessary to perform identity authentication according to the identity authentication method of the IDAAAS instance, but the process of authenticating the user's identity information is performed by the identity authentication service designed by the enterprise itself, and the IDAAAS instance only needs to obtain the final identity authentication result, and then determine whether to allow the user to access the enterprise application according to the identity authentication result. This method not only utilizes the IDAAS identity authentication framework, but also retains the identity authentication services that are more suitable for enterprises and employees, making the identity authentication process experience better.

[0103] Specifically, when the user wants to access the target network application, the target network application can be opened through the browser of the mobile terminal used, that is, an access request for the target network application is issued. It should be noted that in addition to opening the target network application through the browser, the target network application can also be opened through other corresponding applications such as e-mail, social media, online shopping, and online banking. The subsequent identity authentication process is similar to that of using a browser. The corresponding identity authentication scheme can be obtained by replacing the browser in the subsequent scheme with the above application. Then, the IDAAs instance docked by the target network application will confirm the login status of the user. If the login status of the user is a login state, it means that the user has logged in before, that is, the identity authentication has passed, and the user can be allowed to access the target network application at this time. If the login status of the user is a non-login state, it means that the user has not logged in before and needs to be authenticated. Then, when the browser is from the IDAAs instance or the user needs to perform identity authentication, the browser will try to send an identity authentication request to the corresponding target identity authentication service. Specifically, the browser will not send an identity authentication request directly to the target identity authentication service, but needs to pass through the mobile gateway to perform an identity authentication request. In other words, the browser will send a first identity authentication request to the corresponding mobile gateway.

[0104] Step S202: In response to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends identity information to a target identity authentication service.

[0105] Among them, the mobile gateway refers to an intermediate device located between the core of the mobile communication network and the external Internet, which plays an important role as a bridge between the mobile network and the Internet. The mobile gateway realizes the conversion of data sent and received by mobile users to the Internet, allowing the mobile communication network to communicate with the Internet transparently. In the embodiment of the present application, the mobile gateway, on the one hand, pre-accesses the login page of the target identity authentication service, and on the other hand, connects to multiple target mobile applications. In the scheme of the embodiment of the present application, these multiple target mobile applications all contain the user's identity information, and the identity information of any of these target mobile applications will be needed for subsequent identity authentication.

[0106] Specifically, since the mobile gateway proxies (or connects to) multiple target mobile applications, when it receives an authentication request sent by the browser, that is, when it receives the first authentication request, it will pull up (that is, open) any target mobile application, and initiate identity authentication to the target identity authentication service through any target mobile application, that is, any target mobile application sends identity information to the target identity authentication service, thereby utilizing the identity information that has been authenticated in any target mobile application.

[0107] It should be noted that in the embodiment of the present application, the mobile gateway can proxy one or more target mobile applications, and then use the identity information of any target mobile application to interact with the target identity authentication service by pulling up any of the target mobile applications to complete the subsequent identity authentication. Obviously, this process uses the identity information of the user whose login information is already in the target mobile application, and the user does not need to enter the identity information again. The following text will explain in detail which target mobile application the mobile gateway pulls and how to obtain the identity information in the target mobile application.

[0108] Step S203: The target identity authentication service performs identity authentication based on the identity information to obtain a corresponding identity authentication result, which includes the identity information and identity authentication result indication information.

[0109] Among them, the target identity authentication service can refer to the authentication of users through specific standards and protocols to ensure their legitimacy and security. These services can be divided into multiple types according to the verification method adopted, for example: Username and password authentication: The method of identity authentication by the user entering the username and password is common in applications such as portals, emails and social media. Two-factor identity authentication: In addition to the first step of username and password verification, it is also necessary to receive a verification code from a mobile phone or other device or use biometrics (such as fingerprints) for a second identity authentication to improve security. Multi-factor identity authentication: In addition to user passwords and two-factor authentication, other identifiable features are also used to authenticate users. For example, hardware devices such as security parts bound to the user are used for verification. In the embodiment of the present application, no matter which authentication method is adopted by the target identity authentication service, it needs to use the identity information in the corresponding target mobile application, for example, the identity information can be information such as username and password. Therefore, the second authentication request sent by the target mobile application needs to include the above-mentioned user identity authentication information, that is, identity information. It can be understood that the specific content of the above-mentioned identity information can be determined according to the specific authentication method of the target identity authentication service adopted in the embodiment of the present application.

[0110] Specifically, after any of the above-mentioned target mobile applications sends a second identity authentication request to the target identity authentication service, the target identity authentication service will parse the required identity information from the second identity authentication request, and then perform identity authentication in a preset manner based on the identity information to obtain an identity authentication result. Among them, the identity authentication result may include identity information and corresponding identity authentication result indication information, and the identity authentication result indication information may indicate whether the identity authentication passed or failed. It is understandable that since the user has previously performed identity authentication based on the identity information through the target identity authentication service when logging into the target mobile application, then when the target identity authentication service is used for identity authentication again, the corresponding identity authentication result indication information generally also indicates that the identity authentication passed.

[0111] Step S204, the browser receives the identity authentication result and sends the identity authentication result to the IDAAS instance. If the IDAAS instance determines that the identity authentication result indication information in the identity authentication result indicates that the user's identity authentication is passed, the IDAAS instance converts the user's login state to the login state based on the identity information.

[0112] Specifically, after the target authentication service performs authentication and obtains the authentication result, the authentication result will be forwarded to the corresponding target mobile application, and then forwarded to the browser by the target mobile application. However, since the character string corresponding to the identity information in the authentication result is long, it will be truncated during the above-mentioned authentication result transmission process, which will lead to the failure of identity information transmission. Therefore, before transmitting the authentication result, the authentication result needs to be processed to ensure that the authentication result is completely transmitted to the browser. After receiving the complete authentication result, the browser sends the complete authentication result to the ID AAS instance corresponding to the target network application, and the ID AAS instance determines whether the user is allowed to access the target network application based on the received authentication result. Specifically, after receiving the authentication result, the ID AAS instance determines whether the user's authentication is passed according to the authentication result indication information in the authentication result. If passed, the user is allowed to access the target network application, that is, the user's login state is converted to the login state. If not passed, the user is not allowed to access the target network application, and the user is prompted that the authentication is not passed.

[0113] It can be understood that in the above-mentioned identity authentication process, the IDAAS instance does not interact directly with the target identity authentication service, and the center of the identity authentication is in the target identity authentication service, as described above. This not only complies with the IDAAS identity authentication framework, but also retains the local target identity authentication service, making the identity authentication scheme of the embodiment of the present application more applicable and providing a better experience.

[0114] The solution provided by the present application is that when a browser receives an access request from a user to a target network application, if the identity and access management as a service IDAS instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway that proxies at least one target mobile application; in response to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends the user's identity information to the target identity authentication service; the target identity authentication service performs identity authentication based on the identity information and obtains a corresponding identity authentication result; the browser receives the identity authentication result and sends the identity authentication result to the IDAS instance, and if the IDAS instance determines that the identity authentication result indication information in the identity authentication result indicates that the user's identity authentication is passed, the IDAS instance converts the user's login status to a logged in state based on the identity information. In this solution, when the mobile gateway obtains the first authentication request from the browser, it will pull up any target mobile application that it is an agent of, and the target mobile application will send identity information to the target authentication service. The target authentication service will authenticate based on the received identity information and the obtained authentication structure will be passed to the IDAAS instance through the browser. In this authentication process, since the identity information in the target mobile application is utilized, the user does not need to enter the identity information in the browser interface, which improves the authentication efficiency and the user experience.

[0115] In an optional embodiment of the present application, the access request includes identity information;

[0116] If the IDAAs instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, including:

[0117] If the IDAAAS instance determines that the user's login status is not logged in based on the identity information, it sends an authentication instruction to the browser, which includes the identification information of the target authentication service;

[0118] The browser sends a first identity authentication request to the corresponding mobile gateway based on the identification information of the target identity authentication service.

[0119] Specifically, Figure 3As shown, when the browser receives a user's request to access the target network application, that is, receives a user's access request for the target network application, the identity information in the access request will be sent to the IDAAAS instance, and the IDAAAS instance will determine the user's login status based on the identity information in the access request. If it is determined that the user's login status is not logged in, an identity authentication instruction is sent to the browser, and the identity authentication instruction contains the identification information of the target identity authentication service. After the browser receives the instruction information, it is informed that it needs to initiate an identity authentication to the target identity authentication service corresponding to the identification information, that is, send a first identity authentication request to the corresponding mobile gateway.

[0120] It should be noted that the IDAAS instance can store the identification information of the identity authentication services corresponding to multiple network applications. When the user requests to access a network application, the IDAAS instance will feedback the identification information of the identity authentication service corresponding to the network application to the browser when the user needs to be authenticated. In the embodiment of the present application, the identification information of the target identity authentication service corresponding to the target network application is fed back. Among them, the identification information can be the network address of the target identity authentication service.

[0121] Furthermore, the method may also include:

[0122] If the ID AAS instance does not contain identity information, the user's login status is determined to be a non-logged-in state.

[0123] Specifically, after receiving the identity information sent by the browser, the IDAAAS instance determines whether the identity information is contained therein. If not, the user's login status is determined to be a non-logged-in state. If contained, the user's login status is determined to be a logged-in state. The identity information includes information used by the IDAAAS instance to identify the user.

[0124] In an optional embodiment of the present application, the mobile gateway pre-accesses a first target identity authentication service login page, and the first target identity authentication service login page includes at least one trigger button of a target mobile application;

[0125] In response to the first identity authentication request, the mobile gateway opens any target mobile application, including:

[0126] In response to the first identity authentication request, the mobile gateway sends a first target identity authentication service login page to the browser;

[0127] The browser displays the first target identity authentication service login page, and upon receiving a trigger operation for any trigger button through the first target identity authentication service login page, opens a target mobile application corresponding to any trigger button.

[0128] Among them, in the embodiments of the present application, Figure 4 As shown, in addition to being connected to one or more target mobile applications, the mobile gateway is also pre-connected to a first target identity authentication service login page, and a trigger button corresponding to a target mobile application may also be provided in the first target identity authentication service login page.

[0129] Specifically, when the mobile gateway receives the first identity authentication request from the browser, it determines that the first identity authentication request is for the target identity authentication service, then the mobile gateway will send the pre-connected first target identity authentication service login page to the browser, and the browser receives and displays the first target identity authentication service login page to the user. The first target identity authentication service login page seen by the user contains various trigger buttons, so the user can select a trigger button to trigger, that is, select the identity information of the mobile application corresponding to a trigger button for subsequent identity authentication. Specifically, when the user triggers any trigger button, the target mobile application corresponding to any trigger button will be pulled up, that is, the pulling up of the target mobile is completed.

[0130] For example, if Figure 5 As shown, the first target identity authentication service login page displayed by the browser contains trigger buttons corresponding to three target mobile applications, corresponding to application 1, application 2 and application 3 respectively. The page will instruct to select any one of the three applications for login, that is, select a target mobile application for subsequent identity authentication. If the user wants to select application 1 to complete identity authentication later, the user can open application 1 by clicking the trigger button corresponding to application 1.

[0131] It should be noted that after the user triggers a trigger button corresponding to any target mobile application, a query window may pop up to ask the user whether to confirm opening the target mobile application.

[0132] It is understandable that the triggering method of the trigger button may include touch triggering, voice control triggering, gesture triggering, etc., which is not limited in the embodiments of the present application.

[0133] In an optional embodiment of the present application, the target mobile application sends identity information to the target identity authentication service, including:

[0134] When the mobile gateway opens the target mobile application corresponding to any trigger button, the target mobile application sends a second identity authentication request to the target identity authentication service;

[0135] In response to the second identity authentication request, the target identity authentication service sends a second target identity authentication login page to the target mobile application;

[0136] The target mobile application displays a second target identity authentication service login page, and the second target identity authentication login page includes a confirmation button for logging in using the identity information in the target mobile application;

[0137] Upon receiving a trigger operation for a confirmation button in the second target identity authentication service login page, the target mobile application sends identity information to the target identity authentication service

[0138] Specifically, after opening the target mobile application selected by the user, a second target identity authentication service login page is displayed through the interface of the target mobile application, and the second target identity authentication service login page includes a confirmation button, which, when triggered, instructs the user to confirm the use of the identity information contained in the target mobile application for subsequent identity authentication. Specifically, when the above confirmation button in the second target identity authentication service login page is triggered, the target mobile application will send the identity information to the target identity authentication service.

[0139] For example, if Figure 6 As shown, the second target identity authentication service login page is displayed for the target mobile application. The second target identity authentication service login page includes the above-mentioned confirmation button. When the user clicks the confirmation button, the target mobile application will send identity information to the target identity authentication service.

[0140] Similarly, the triggering method of the confirmation button may include touch triggering, voice control triggering, gesture triggering, etc., which is not limited to the embodiments of the present application.

[0141] In an optional embodiment of the present application, the browser receives the identity authentication result and sends the identity authentication result to the ID AAS instance, including:

[0142] The target identity authentication service converts the identity authentication result into a corresponding identifier and feeds the identifier back to the target mobile application;

[0143] The target mobile application sends the identifier to the browser, the browser obtains the authentication result based on the identifier, and sends the authentication result to the ID AAS instance.

[0144] Specifically, as can be seen from the previous description, since the identity authentication structure may be truncated during the transmission process and cannot be fully transmitted, before transmitting the identity authentication result, the target identity authentication service can convert the obtained identity authentication result into a corresponding identifier and determine the mapping relationship between the identifier and the identity authentication result. The identifier and the mapping relationship are shorter than the string corresponding to the identity authentication result and will not be truncated. The target identity authentication service transmits the identifier and the corresponding mapping relationship to the target mobile application, and the target mobile application then transmits the identifier and the corresponding mapping relationship to the browser. Finally, the browser transmits the identifier and the corresponding mapping relationship to the IDAAS instance, and the IDAAS instance obtains the corresponding complete identity authentication result based on the identifier and the corresponding mapping relationship.

[0145] In an optional embodiment of the present application, the method may further include:

[0146] When the target identity authentication service converts the identity authentication result into a corresponding identifier, the identifier and the identity authentication result are stored in the target identity authentication service in correspondence;

[0147] The browser obtains the authentication result based on the identifier, including:

[0148] The browser sends the identifier to the target authentication service;

[0149] The target authentication service obtains the corresponding authentication result based on the identifier and sends the authentication result to the browser.

[0150] Specifically, when the target authentication service converts the authentication result into a corresponding identifier, the identifier and the authentication result are stored in the target authentication service in correspondence. Then, after the browser receives the identifier transmitted from the target mobile application, it can obtain the corresponding complete authentication result from the target authentication service based on the identifier. Specifically, in addition to the identifier, the information transmitted to the browser by the target mobile application can also include a jump address of the target authentication service storing the corresponding authentication result. The browser can access and obtain the authentication result corresponding to the identifier according to the jump address.

[0151] In summary, Figure 7 A schematic diagram of the interaction between the various entities in the process of executing this application solution is shown in FIG. Figure 7 As shown, the scheme may include the following steps:

[0152] (1) When the browser receives the user's access request, it sends an authentication request to the IDAAS instance;

[0153] (2) If the IDAAAS instance determines that the user's login status is not logged in, it sends an identity authentication instruction to the browser, and the identity authentication instruction carries the network address of the target identity authentication service;

[0154] (3) The browser sends a first identity authentication request to the mobile gateway, where the request carries the network address of the target identity authentication service;

[0155] (4) The mobile gateway sends a first target identity authentication service login page to the browser according to the first identity request;

[0156] (5) The browser displays the first target identity authentication service login page to the user, and after receiving a trigger operation of a trigger button for the target mobile application, launches the target mobile application;

[0157] (6) The target mobile application sends a second identity authentication request to the target identity authentication service, and in response to the second identity authentication request, the target identity authentication service sends a second identity authentication service login page to the target mobile application;

[0158] (7) The target mobile application displays the second identity authentication service login page and sends identity information to the target identity authentication service after receiving a trigger operation for a confirmation button;

[0159] (8) The target identity authentication service performs identity authentication based on the identity information, obtains a corresponding identity authentication result, converts the identity authentication result into a corresponding identifier, and stores the identifier and the identity authentication result in a preset location in correspondence;

[0160] (9) The target identity authentication service sends the identifier and the jump address of the preset location to the target mobile application;

[0161] (10) The target mobile application sends the identifier and the jump address of the preset location to the browser;

[0162] (11) The browser sends the identifier to a preset location of the target identity authentication service based on the jump address;

[0163] (12) the preset location of the target identity authentication service obtains the corresponding identity authentication result based on the identifier;

[0164] (13) The preset location of the target authentication service feeds back the authentication result to the browser;

[0165] (14) The browser forwards the identity authentication result to the IDAAS instance;

[0166] (15) The IDAAS instance verifies the identity authentication and feeds back the verification result to the browser;

[0167] (16) If the verification result indicates that the identity authentication is passed, the browser allows the user to access the target network application. If the verification result indicates that the identity authentication is not passed, the browser does not allow the user to access the target network application.

[0168] It should be noted that the information exchange process from step (3) to step (16) in the above steps follows the identity authentication framework of the SAML2.0 protocol, but the details will be improved as described above.

[0169] Figure 8 This is a schematic diagram of the product side in this application solution, such as Figure 8 As shown, a certain enterprise adopts the solution involving identity authentication products. The use process of the identity authentication product may include the following steps:

[0170] (1) The user accesses the enterprise application (i.e., the target web application) via mobile email or mobile phone browser;

[0171] (2) The enterprise application is connected to the IDAAAS instance Yufu, so the user will jump to Yufu for identity authentication;

[0172] (3) As an IDAAS instance, Yufu is connected to the enterprise's local identity authentication service (i.e., the target identity authentication service) and will send an identity authentication instruction to the browser;

[0173] (4) The local identity authentication service recognizes that the user is accessing the service from a mobile terminal, and the browser displays the login page of the first target identity authentication service;

[0174] (5) After the user triggers the trigger button in the first target identity authentication service login page, the target mobile application that has been authenticated by the enterprise is launched;

[0175] (6) The target mobile application displays the second target identity authentication service login page. After the user triggers the confirmation button in the second target identity authentication service login page, the above-mentioned identity authentication process begins. This process is carried out under the SAML2.0 protocol framework, and the transmission process of the identity authentication result is improved;

[0176] (7) After the browser obtains the complete identity authentication result, it sends it to Yufu;

[0177] (8) After Yufu confirms that the identity authentication is successful, the user is redirected to the browser to log in to the target web application.

[0178] Fig. 9 A structural block diagram of an identity authentication device is provided for an embodiment of the present application, such as Fig. 9As shown, the device may include: a first identity authentication request sending module 901, an identity information sending module 902, an identity authentication result obtaining module 903 and an identity authentication result sending module 904, wherein:

[0179] The first identity authentication request sending module 901 is used for, when the browser receives a user's access request for a target network application, if the identity and access management as a service IDAAS instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, and the mobile gateway acts as a proxy for at least one target mobile application, each target mobile application containing the user's identity information;

[0180] The identity information sending module 902 is used to respond to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends identity information to the target identity authentication service;

[0181] The identity authentication result acquisition module 903 is used for the target identity authentication service to perform identity authentication based on the identity information and obtain the corresponding identity authentication result, which includes the identity information and the identity authentication result indication information;

[0182] The authentication result sending module 904 is used by the browser to obtain the authentication result and send the authentication result to the IDAAS instance. If the IDAAS instance determines that the authentication result indication information in the authentication result indicates that the user's authentication is successful, the IDAAS instance converts the user to a logged-in state based on the identity information.

[0183] The solution provided by the present application is that when a browser receives an access request from a user to a target network application, if the identity and access management as a service IDAS instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway that proxies at least one target mobile application; in response to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends the user's identity information to the target identity authentication service; the target identity authentication service performs identity authentication based on the identity information and obtains a corresponding identity authentication result; the browser receives the identity authentication result and sends the identity authentication result to the IDAS instance, and if the IDAS instance determines that the identity authentication result indication information in the identity authentication result indicates that the user's identity authentication is passed, the IDAS instance converts the user's login status to a logged in state based on the identity information. In this solution, when the mobile gateway obtains the first authentication request from the browser, it will pull up any target mobile application that it is an agent of, and the target mobile application will send identity information to the target authentication service. The target authentication service will authenticate based on the received identity information and the obtained authentication structure will be passed to the IDAAS instance through the browser. In this authentication process, since the identity information in the target mobile application is utilized, the user does not need to enter the identity information in the browser interface, which improves the authentication efficiency and the user experience.

[0184] In an optional embodiment of the present application, the mobile gateway pre-accesses a first target identity authentication service login page, and the first target identity authentication service login page includes at least one trigger button of a target mobile application;

[0185] The identity information sending module is specifically used for:

[0186] In response to the first identity authentication request, the mobile gateway sends a first target identity authentication service login page to the browser;

[0187] The browser displays the first target identity authentication service login page, and when a trigger operation for any trigger button is received through the first target identity authentication service login page, the mobile gateway opens the target mobile application corresponding to any trigger button.

[0188] In an optional embodiment of the present application, the identity information sending module is further used to:

[0189] When the mobile gateway opens the target mobile application corresponding to any trigger button, the target mobile application sends a second identity authentication request to the target identity authentication service;

[0190] In response to the second identity authentication request, the target identity authentication service sends a second target identity authentication login page to the target mobile application;

[0191] The target mobile application displays a second target identity authentication service login page, and the second target identity authentication login page includes a confirmation button for logging in using the identity information in the target mobile application;

[0192] Upon receiving a trigger operation for a confirmation button in the second target identity authentication service login page, the target mobile application sends identity information to the target identity authentication service.

[0193] In an optional embodiment of the present application, the identity authentication result sending module is specifically used to:

[0194] The target identity authentication service converts the identity authentication result into a corresponding identifier and feeds the identifier back to the target mobile application;

[0195] The target mobile application sends the identifier to the browser, the browser obtains the authentication result based on the identifier, and sends the authentication result to the ID AAS instance.

[0196] In an optional embodiment of the present application, the identity authentication result acquisition module is further used to:

[0197] When the target identity authentication service converts the identity authentication result into a corresponding identifier, the identifier and the identity authentication result are stored in the target identity authentication service in correspondence;

[0198] The identity authentication result sending module is specifically used for:

[0199] The browser sends the identifier to the target authentication service;

[0200] The target authentication service obtains the corresponding authentication result based on the identifier and sends the authentication result to the browser.

[0201] In an optional embodiment of the present application, the access request includes identity information;

[0202] The first identity authentication request sending module is specifically used for:

[0203] If the IDAAAS instance determines that the user's login status is not logged in based on the identity information, it sends an authentication instruction to the browser, which includes the identification information of the target authentication service;

[0204] The browser sends a first identity authentication request to the corresponding mobile gateway based on the identification information of the target identity authentication service.

[0205] In an optional embodiment of the present application, the first identity authentication request sending module is further used to:

[0206] If the ID AAS instance does not contain identity information, the user's login status is determined to be a non-logged-in state.

[0207] The device of the embodiments of the present application can execute the method provided by the embodiments of the present application, and the implementation principles are similar. The actions performed by each module in the device of each embodiment of the present application correspond to the steps in the method of each embodiment of the present application. For the detailed functional description of each module of the device, please refer to the description in the corresponding method shown in the previous text, which will not be repeated here.

[0208] Reference below Fig.10 , which shows an electronic device suitable for implementing the embodiments of the present application (for example, executing Figure 2 The electronic device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), wearable devices, etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.10 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0209] The electronic device includes: a memory and a processor, the memory is used to store a program for executing the method described in each of the above method embodiments; the processor is configured to execute the program stored in the memory. The processor here can be referred to as the processing device 1001 described below, and the memory can include at least one of the read-only memory (ROM) 1002, the random access memory (RAM) 1003, and the storage device 1008 described below, as shown below:

[0210] like Fig.10 As shown, the electronic device 1000 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the electronic device 1000 are also stored. The processing device 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0211] Typically, the following devices may be connected to the I / O interface 1005: an input device 1006 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 1007 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1008 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 may allow the electronic device 1000 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.10 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0212] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 1009, or installed from the storage device 1008, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0213] It should be noted that the computer-readable storage medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0214] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0215] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0216] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0217] When the browser receives an access request from the user for a target network application, if the identity and access management as a service IDAS instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, and the mobile gateway acts as a proxy for at least one target mobile application, each target mobile application containing the user's identity information; in response to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends the identity information to the target identity authentication service; the target identity authentication service performs identity authentication based on the identity information and obtains a corresponding identity authentication result, which contains the identity information and the identity authentication result indication information; the browser receives the identity authentication result and sends the identity authentication result to the IDAS instance, and if the IDAS instance determines that the identity authentication result indication information in the identity authentication result indicates that the user's identity authentication is passed, the IDAS instance converts the user's login status to the logged in state based on the identity information.

[0218] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0219] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0220] The modules or units involved in the embodiments of the present application may be implemented by software or hardware. The name of a module or unit does not limit the unit itself in some cases. For example, the first constraint acquisition module may also be described as a "module for acquiring the first constraint".

[0221] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0222] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0223] The embodiment of the present application provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that when the computer device executes the computer instructions, the following conditions are achieved:

[0224] When the browser receives an access request from the user for a target network application, if the identity and access management as a service IDAS instance corresponding to the target network application determines that the user's login status is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, and the mobile gateway acts as a proxy for at least one target mobile application, each target mobile application containing the user's identity information; in response to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends the identity information to the target identity authentication service; the target identity authentication service performs identity authentication based on the identity information and obtains a corresponding identity authentication result, which contains the identity information and the identity authentication result indication information; the browser receives the identity authentication result and sends the identity authentication result to the IDAS instance, and if the IDAS instance determines that the identity authentication result indication information in the identity authentication result indicates that the user's identity authentication is passed, the IDAS instance converts the user's login status to the logged in state based on the identity information.

[0225] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0226] The above descriptions are only some embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An identity authentication method, characterized in that: include: When the browser receives an access request from a user for a target network application, if the identity and access management as a service IDAAS instance corresponding to the target network application determines that the login status of the user is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, and the mobile gateway acts as a proxy for at least one target mobile application, each of which contains the identity information of the user; In response to the first identity authentication request, the mobile gateway opens any target mobile application, and the target mobile application sends the identity information to a target identity authentication service; The target identity authentication service performs identity authentication based on the identity information to obtain a corresponding identity authentication result, wherein the identity authentication result includes the identity information and identity authentication result indication information; The browser receives the identity authentication result and sends the identity authentication result to the IDAS instance. If the IDAS instance determines that the identity authentication result indication information in the identity authentication result indicates that the user's identity authentication is passed, the IDAS instance converts the user's login state to a logged-in state based on the identity information.

2. The method according to claim 1, characterized in that The mobile gateway pre-accesses a first target identity authentication service login page, wherein the first target identity authentication service login page includes a trigger button for the at least one target mobile application; In response to the first identity authentication request, the mobile gateway opens any target mobile application, including: In response to the first identity authentication request, the mobile gateway sends the first target identity authentication service login page to the browser; The browser displays the first target identity authentication service login page, and upon receiving a trigger operation for any trigger button through the first target identity authentication service login page, opens a target mobile application corresponding to any trigger button.

3. The method according to claim 2, characterized in that The target mobile application sends identity information to the target identity authentication service, including: When the mobile gateway opens the target mobile application corresponding to any one of the trigger buttons, the target mobile application sends a second identity authentication request to the target identity authentication service; In response to the second identity authentication request, the target identity authentication service sends a second target identity authentication login page to the target mobile application; The target mobile application displays a second target identity authentication service login page, wherein the second target identity authentication login page includes a confirmation button for logging in using the identity information in the target mobile application; Upon receiving a trigger operation for the confirmation button in the second target identity authentication service login page, the target mobile application sends identity information to the target identity authentication service.

4. The method according to claim 1, characterized in that: The browser receives the identity authentication result and sends the identity authentication result to the ID AAS instance, including: The target identity authentication service converts the identity authentication result into a corresponding identifier and feeds the identifier back to the target mobile application; The target mobile application sends the identifier to the browser, and the browser obtains the identity authentication result based on the identifier and sends the identity authentication result to the ID AAS instance.

5. The method according to claim 4, characterized in that The method further comprises: When the target identity authentication service converts the identity authentication result into a corresponding identifier, the identifier and the identity authentication result are stored in the target identity authentication service in correspondence with each other; The browser obtains the identity authentication result based on the identifier, including: The browser sends the identifier to the target identity authentication service; The target identity authentication service obtains a corresponding identity authentication result based on the identifier, and sends the identity authentication result to the browser.

6. The method according to claim 1, characterized in that The access request includes the identity information; If the ID AAS instance corresponding to the target network application determines that the user's login state is not logged in, the browser sends a first identity authentication request to the corresponding mobile gateway, including: If the IDAAAS instance determines that the user's login status is not logged in based on the identity information, an identity authentication instruction is sent to the browser, where the identity authentication instruction includes identification information of the target identity authentication service; The browser sends a first identity authentication request to the corresponding mobile gateway based on the identification information of the target identity authentication service.

7. The method according to claim 6, characterized in that The method further comprises: If the ID AAS instance does not include the identity information, it is determined that the login status of the user is not logged in.

8. An identity authentication device, characterized in that: include: A first identity authentication request sending module, configured to, when a browser receives an access request from a user for a target network application, if the identity and access management as a service (IDAAS) instance corresponding to the target network application determines that the login status of the user is not logged in, then the browser sends a first identity authentication request to the corresponding mobile gateway, and the mobile gateway acts as a proxy for at least one target mobile application, each of which contains the identity information of the user; an identity information sending module, configured to, in response to the first identity authentication request, cause the mobile gateway to open any target mobile application, and for the target mobile application to send the identity information to a target identity authentication service; An identity authentication result acquisition module, used for the target identity authentication service to perform identity authentication based on the identity information and obtain a corresponding identity authentication result, wherein the identity authentication result includes the identity information and identity authentication result indication information; The identity authentication result sending module is used for the browser to obtain the identity authentication result and send the identity authentication result to the IDAS instance. If the IDAS instance determines that the identity authentication result indication information in the identity authentication result indicates that the identity authentication of the user is passed, the IDAS instance converts the user into a logged-in state based on the identity information.

9. An electronic device, characterized in that: including memory and processor; The memory stores a computer program; The processor is configured to execute the computer program to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that The method comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.

Images