Application authentication method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses an application program authentication method and device, electronic equipment and a storage medium. The application program authentication method comprises the following steps: receiving a first application program authentication request sent by a terminal application program; based on the first application program authentication request, reading an application program permission level through a user identity module of the terminal; sending a second application program authentication request to an authentication management platform according to the application program permission level; obtaining an authentication response made by the authentication management platform to the second application authentication request, wherein the authentication response comprises an authentication code corresponding to the application; acquiring a registration code corresponding to the application program; and matching the authentication code with the registration code to obtain a matched application authentication result. According to the embodiment of the invention, the authentication efficiency of the application program is improved while the data security of the application program is quickly and efficiently ensured.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the technical field of application authentication, and specifically to an application authentication method, device, electronic device, and storage medium. Background Art

[0002] With the development of smart terminals, the number of applications with different functional application scenarios has gradually increased. In routine use, application authentication is usually required to protect user privacy information. The current application authentication technology mainly uses mobile phone SMS authentication, that is, by filling in the mobile phone number to receive dynamic SMS for application authentication. However, this application authentication method requires the calculation and verification of dynamic passwords between the foreground and background of the application for each login or transaction of the terminal application, which is time-consuming and puts a high concurrency pressure on the system. All applications on the terminal need to be authenticated and authorized, which consumes a lot of mobile data traffic. When a large number of users use it, a large number of services will bring high SMS fees to the application manufacturers. Since SMS is sent based on the global system mobile communication network, attackers may use special equipment and technology to monitor wireless signals to intercept SMS content or other communication data; or attackers may set up fake base stations to capture SMS content, which poses risks of stealing funds and leaking information through verification codes. Summary of the invention

[0003] The embodiments of this specification provide an application authentication method, device, electronic device, and storage medium, and the technical solutions thereof are as follows:

[0004] In a first aspect, an embodiment of the present specification provides an application authentication method, including: receiving a first application authentication request sent by a terminal application; based on the first application authentication request, reading the application permission level through a user identity module of the terminal; sending a second application authentication request to an authentication management platform according to the application permission level; obtaining an authentication response made by the authentication management platform to the second application authentication request, the authentication response including an authentication code corresponding to the application; obtaining a registration code corresponding to the application; matching the authentication code with the registration code to obtain a matched application authentication result.

[0005] In the second aspect, an embodiment of the present specification provides an application authentication system, including: a request receiving unit, used to receive a first application authentication request sent by a terminal application; a level reading unit, used to read the application permission level through the user identity module of the terminal based on the first application authentication request; a request sending unit, used to send a second application authentication request to an authentication management platform according to the application permission level; an authentication response unit, used to obtain an authentication response made by the authentication management platform to the second application authentication request, the authentication response including an authentication code corresponding to the application; a registration code acquisition unit, used to obtain a registration code corresponding to the application; a matching unit, used to match the authentication code with the registration code to obtain a matched application authentication result.

[0006] In a third aspect, an embodiment of the present specification provides an electronic device, comprising a processor and a memory; the processor is connected to the memory; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the steps of the application authentication method of the first aspect of the above embodiment.

[0007] In a fourth aspect, an embodiment of the present specification provides a computer storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the steps of the application authentication method of the first aspect of the above embodiment.

[0008] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least:

[0009] Provided is an application authentication method based on user identity module authorization, the user identity module supports different application permission level management, the embodiment of this specification distinguishes the permission level of the application, sends a second application authentication request to the authentication management platform according to the application permission level, improves the authentication efficiency of the application, matches the authentication code with the registration code, ensures the high security of the application data, does not require the application manufacturer to pay the high SMS fees caused by a large amount of data verification, etc., solves the problems of poor system performance, low data security and high cost when authenticating applications with a large business volume. When there are a large number of authentication requirements for applications, the embodiment of this specification can more quickly and efficiently ensure the security of application data, while improving the authentication efficiency of the application, making application authentication convenient and low-cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of this specification, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0011] Figure 1a This is a schematic diagram of an application scenario of an application authentication system provided in this manual.

[0012] Figure 1b This is a schematic diagram of the framework structure of an application authentication system provided in this manual.

[0013] Figure 2 This is a flowchart of an application authentication method provided in this manual.

[0014] Figure 3 This is a schematic diagram of the structure of an application authentication device provided in this specification.

[0015] Figure 4 This is a schematic diagram of the structure of an electronic device provided in this manual. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of this specification will be described clearly and completely below in conjunction with the drawings in the embodiments of this specification.

[0017] The terms "first", "second", etc. in the description and claims of this specification and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any variation thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices.

[0018] The application authentication method provided in multiple embodiments of this specification may be executed by the application authentication system provided in the embodiments of the present invention, or a server integrated with the application authentication system, wherein the application authentication system may be implemented in hardware or software.

[0019] Before describing the technical solution of the present invention, the relevant technical terms are briefly explained:

[0020] Software Development Kit (SDK): A collection of software development tools, libraries, and documentation designed to help developers create applications for a specific platform or software. SDKs usually consist of major components such as compilers and debuggers, libraries and APIs, sample code and templates, documentation and tutorials. SDKs can be used in a variety of different software development areas, such as mobile application development, game development, web development, IoT development, etc. Different platforms and software usually have their own SDKs, such as Android SDK for Android application development, iOSSDK for iOS application development, JavaSDK for Java application development, etc. By using SDKs, developers can develop applications more efficiently, take advantage of the tools and resources provided, reduce development time and complexity, and ensure the compatibility and performance of applications on specific platforms or software.

[0021] Application: An application includes a computer program that performs one or more specific functions. It runs in an interactive mode, can interact with the user objects of the application, and has a visual display interface. For example, an application may include application software on various terminals. For example, an application may include various mobile phone software (Application, APP), tablet computer application software, laptop application software, personal computer (PC, Personal Computer) application software, etc.

[0022] Application Protocol Data Unit (APDU) instruction set: It is an instruction format used for communication between smart cards and card readers, and defines the data transmission format and communication rules between smart cards and external devices. The APDU instruction set is usually used to perform specific operations or obtain card information, including two types of instructions: command APDU and response APDU. The command APDU is sent by an external device (such as a terminal device) to the smart card to request a specific operation, such as reading data, writing data, and verifying identity. After receiving the command APDU, the smart card will perform the corresponding operation according to the requirements of the instruction and generate a response APDU to return to the external device. The response APDU includes the following parts: Response Status Word (SW): used to indicate the execution result of the operation, including success, failure, error, etc. Response Data: Data returned according to specific instructions and operation results. Through the interaction of command APDU and response APDU, external devices can communicate with smart cards and implement various functions, such as reading and writing data on the card, and performing identity authentication.

[0023] The terminal application programming interface (API) is a set of interfaces that define functions and methods that can be used by applications on mobile devices. Through the terminal API, applications can interact with the device's hardware and operating system, access device functions and data, and implement various functions and services.

[0024] The standard communication protocol channel may be an OMA channel. The Open Mobile Alliance (OMA) is an international organization dedicated to developing standards and specifications related to the mobile Internet. The OMA channel is a communication protocol defined under the OMA standard for secure data transmission and command interaction between mobile devices and servers.

[0025] Before describing the application authentication method in detail in conjunction with one or more embodiments, this specification first introduces the application authentication method application scenario.

[0026] The embodiments of this specification provide an application authentication method, device, electronic device and storage medium. Specifically, the embodiments of the present application provide an application authentication device, which can be integrated in a computer device, and the computer device can include at least one of a terminal and a server. Among them, the terminal can be a smart phone, a tablet computer, a laptop or a personal computer (Personal Computer, PC), a smart wearable device, etc. The server can be an intercommunication server between multiple heterogeneous systems or a background server of a content interaction system. It can also be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and basic cloud computing services such as big data and artificial intelligence platforms, etc.

[0027] See also Figure 1a , Figure 1a This is a scenario diagram of an application authentication system 100 provided in an embodiment of the present invention. The application authentication system 100 may include a terminal 110 having an application, an application authentication device 120, an authentication management platform 130, a database cluster 140, a cache cluster 150, and the like.

[0028] Among them, the terminal 110 with the application can be a terminal based on the Android system or the IOS system, and can also be a PC based on the Windows system or the MAC system. The terminal 110 with the application can have different types of applications, such as banking applications, e-commerce applications, and social applications. The terminal 110 with the application is provided with a user identity module 160, which can be a module provided on the terminal for securely storing application information, and the application information can include user information, application registration information, and application permission level information. In the embodiment of this specification, the user identity module 160 can be a SIM card, and the SIM card can be a super SIM card. The super SIM card is a SIM card in the form of software. The identity information and operator configuration of the super SIM card are remotely downloaded and updated through the network. The super SIM card can switch operators and subscription plans without replacing the physical SIM card. Users can select and activate different operators and service plans through the device's setting interface or application without plugging and unplugging the physical SIM card.

[0029] The authentication management platform 130 of the embodiment of this specification is a background server. The authentication management platform 130 can be an authentication management server using a cluster mode. The authentication management platform 130 is used to manage system functional modules, including user management, authority management, registration management, authentication management, key management and log management; the authentication management platform 130 is used to assist and manage the registration and authentication of any application in the user identity module.

[0030] In the embodiment of this specification, the database cluster 140 may be a database server in cluster mode, used to store authentication management platform data. The cache cluster 150 may be a cache server in cluster mode, used to store authentication management platform intermediate data.

[0031] The application authentication device 120 provided in the embodiment of this specification is an authentication SDK end, which is used to perform authentication and authorization for each application. Each application can perform application authorization by calling the authentication SDK, including application registration and application authentication.

[0032] In the embodiment of the present specification, the application authentication device 120 and the terminal 110 having the application can be configured as the same terminal, or they can be different computer devices, which is not limited in the embodiment of the present specification.

[0033] The application authentication device 120 provided in the embodiment of this specification can be integrated on a computer device such as a terminal or a server, and the computer device can receive a first application authentication request sent by a terminal application; based on the first application authentication request, read the application permission level through the user identity module of the terminal; send a second application authentication request to the authentication management platform according to the application permission level; obtain an authentication response made by the authentication management platform to the second application authentication request, the authentication response includes an authentication code corresponding to the application; obtain a registration code corresponding to the application; match the authentication code with the registration code to obtain a matched application authentication result.

[0034] See also Figure 1b , Figure 1b The schematic diagram of the application framework structure of the application authentication system 100 provided in the embodiment of the present invention includes a gateway layer, a business layer, a basic platform layer, a middleware layer, and a data layer. The gateway layer is used to provide load balancing services, fuse limiting strategies, intelligent routing services, registration centers, and security authentication mechanisms. The business layer includes an authentication operation management system and an authentication service management system. The authentication operation management system corresponds to the authentication management platform 130, and the authentication operation management system is used to perform user management, authority management, registration management, authentication management, key management, and log management. The authentication service management system corresponds to the application authentication device 120, and the authentication service management system is used to perform application registration and application authentication. The basic platform layer is used for object storage, task notification, log analysis, statistical reports, system monitoring, and configuration center. The middleware layer is used for message queues, MyCat table and library sub-library, and Tomcat automatic deployment. The data layer is used to use MYSQL for database storage, Redis for cache storage, MFS for file storage, and ES for distributed search and analysis.

[0035] The application authentication system disclosed in the embodiments of this specification satisfies the requirements of layering and business scalability. Layering ensures the robustness and maintainability of the system, and also greatly facilitates installation, deployment and implementation. Business scalability gives operators greater autonomy, and they can dynamically add business modules according to market demand, providing a guarantee for operators to gradually promote the development of data services.

[0036] It should be noted that Figure 1a The application authentication system scenario diagram shown in the figure and Figure 1bThe schematic diagram of the application framework structure of the application authentication system shown is only an example. The application authentication system and scenario described in the embodiment of the present invention are intended to more clearly illustrate the technical solution of the embodiment of the present invention, and do not constitute a limitation on the technical solution provided by the embodiment of the present invention. Those skilled in the art can know that with the evolution of the application authentication system and the emergence of new scenarios, the technical solution provided by the embodiment of the present invention is also applicable to similar technical problems.

[0037] The following are detailed descriptions respectively. It should be noted that the description order of the following embodiments is not intended to limit the preferred order of the embodiments.

[0038] The embodiments of this specification will be described from the perspective of the application authentication device 120. The application authentication device 120 may be integrated in a computer device, which may be a server or a terminal.

[0039] like Figure 2 The embodiment of this specification provides an application authentication method, which is applied to the authentication SDK end. The specific process includes:

[0040] Step 200: Receive a first application authentication request sent by a terminal application.

[0041] In the embodiments of this specification, the first application authentication request is an authentication request initiated by calling the authentication SDK when the user logs in to the terminal application or when the terminal application conducts a transaction. For example, the first application authentication request may be a user login authentication request or a user transaction authentication request. The first application authentication request may include, but is not limited to, an application identifier, a user identifier, an authentication token, a digital signature, a timestamp, terminal device information, etc.

[0042] Step 210: Based on the first application authentication request, read the application permission level through the user identity module of the terminal.

[0043] In the embodiments of this specification, the user identity module of the terminal is a module set on the terminal for securely storing application information, and the application information may include user information, application registration information, and application permission level information. The user identity module in the embodiments of this specification may be a super SIM card, etc. Application permission levels can be divided into high-level permission applications, low-level permission applications, zero-level permission applications, etc. Different permission levels can be distinguished by different identifiers, including but not limited to numbers, letters, special characters, etc. For example, a zero-level permission application can be represented as 00, a low-level permission application can be represented as 01, and a high-level permission application can be represented as 02.

[0044] For example, for high-level permission applications, users only need background authorization and authentication to access the application. For low-level permission applications, users do not need additional background authorization and authentication, and can access the application by entering a user name. For zero-level permission applications, users are not allowed to access. By distinguishing the permission levels of applications, the embodiments of this specification improve the authentication efficiency of applications.

[0045] In some embodiments of the present specification, based on the first application authentication request, the application permission level is read through the user identity module of the terminal, including: when the first application authentication request is verified to be legal, based on the terminal application interface or standard communication protocol channel, the user identity module of the terminal is called using the application protocol data unit instruction set; and the application permission level is read through the user identity module of the terminal.

[0046] In the embodiment of this specification, before reading the application permission level through the user identity module of the terminal, the authentication SDK end needs to perform a legitimacy check based on the first application authentication request, and the legitimacy check may include parameter empty judgment, whether the application is in the whitelist, etc. When the first application authentication request is verified to be legal, the user identity module of the terminal is called based on the terminal application interface or the standard communication protocol channel using the application protocol data unit instruction set; the application permission level is read through the user identity module of the terminal, for example, the authentication SDK end uses the APDU instruction set to call the super SIM card through the terminal API or OMA channel to read the APP permission level, etc.

[0047] In the embodiment of this specification, when the authentication SDK verifies that the authentication request of the first application is illegal, it can send a prompt message to the terminal that the authentication request is illegal. For terminal applications that are judged to be illegal and do not perform background authentication, users can directly log in to the application or trade on the application using their account name and password.

[0048] Step 220: Send a second application authentication request to the authentication management platform according to the application permission level.

[0049] In the embodiment of this specification, the second application authentication request can be an authentication request initiated by the authentication SDK end to the authentication management platform according to the application permission level. The second application authentication request can not only include the information carried by the first application authentication request, but also include information such as the application permission level.

[0050] In some embodiments of the present specification, sending a second application authentication request to the authentication management platform according to the application permission level includes: when it is determined according to the application permission level that background authentication of the application is required, sending the second application authentication request to the authentication management platform.

[0051] In the embodiment of the present specification, the authentication SDK determines whether background authentication of the application is required based on the application permission level. When it is determined that background authentication of the application is required based on the application permission level, the authentication SDK sends a second application authentication request to the authentication management platform. The authentication management platform processes the second application authentication request and gives an authentication response.

[0052] In the embodiments of this specification, when it is determined that background authentication of an application is not required based on the application permission level, a prompt message indicating that background authentication is not required can be sent to the terminal, and the user can log in to the application or conduct transactions on the application using the account name and password.

[0053] Step 230: Obtain an authentication response made by the authentication management platform to the second application authentication request.

[0054] In the embodiment of this specification, the authentication management platform provides an authentication response after processing the authentication request of the second application, and the authentication response includes an authentication code corresponding to the application.

[0055] Step 240: Obtain the registration code corresponding to the application.

[0056] In the embodiment of this specification, the registration code of the application in the embodiment of this specification is: when the application is used for the first time on the terminal, the authentication SDK end applies to the authentication management platform for background registration of the application, and the authentication management platform processes and responds to the background registration, and returns to the authentication SDK end a unique identifier or serial number for authorizing and activating the application. The authentication SDK end saves the registration code in the user identity module, and when the application needs to be authenticated, the embodiment of this specification can directly obtain the registration code from the user identity module.

[0057] In some embodiments of the present specification, before obtaining the registration code corresponding to the application, it also includes: when it is determined that there is no registration code corresponding to the application in the user identity module, receiving a first application registration request sent by the application; based on the first application registration request, sending a second application registration request to the authentication management platform according to the application permission level; obtaining a registration response made by the authentication management platform to the second application registration request, the registration response including the registration code corresponding to the application.

[0058] In the embodiments of this specification, the first application registration request is a registration request initiated by calling the authentication SDK when the user uses the terminal application for the first time. The second application registration request can be a registration request initiated by the authentication SDK to the authentication management platform according to the application permission level. The second application registration request can include not only the information carried by the first application registration request, but also information such as the application permission level.

[0059] In some embodiments of the present specification, based on the first application registration request, a second application registration request is sent to the authentication management platform according to the application permission level, including: when the first application registration request is verified to be legal and it is determined according to the application permission level that the application needs to be registered in the background, the second application registration request is sent to the authentication management platform, and the authentication management platform is used to make a registration response to the second application registration request.

[0060] In the embodiments of this specification, before obtaining the registration code corresponding to the application, if it is determined that there is no registration code corresponding to the application in the user identity module, it means that the application of the terminal has not yet been registered in the background. When the user logs in to the application or conducts a transaction in the application, the first application registration request is first sent to the authentication SDK end. The authentication SDK end needs to perform a legitimacy check on the first application registration request. The methods for performing the legitimacy check include judging whether the parameters are empty and whether the application is in the whitelist. When it is verified that the first application registration request is legal, it is determined whether the application needs to be registered in the background based on the application permission level. For example, for high-level permission applications, users need background authorization registration to access the application. For low-level permission applications, users do not need additional background authorization registration. They can access the application by entering the user name; for zero-level permission applications, users are not allowed to access. By distinguishing the permission levels of applications, the embodiments of this specification improve the authentication efficiency of applications.

[0061] In some embodiments of the present specification, based on the first application registration request, a second application registration request is sent to the authentication management platform according to the application permission level, and also includes: when the first application registration request is verified to be legal and it is determined according to the application permission level that background registration of the application is not required, verifying the user's operating authority to the user identity module through the user identity module; when the user's operating authority to the user identity module is verified to be legal, based on the terminal application interface or the standard communication protocol channel, the application registration information and the application permission level information are saved to the user identity module using the application protocol data unit instruction set; the application registration information includes but is not limited to the registration code, and the application permission level information includes but is not limited to the application permissions.

[0062] In the embodiments of this specification, when it is verified that the first application registration request is legal, but it is determined that the application does not need to be registered in the background according to the application permission level, the user's operating authority to the user identity module can be verified through the user identity module, and the user's legal operating authority to the user identity module can be verified through the user identity module to ensure that only authorized users can operate the application. Then, when it is verified that the user's operating authority to the user identity module is legal, the application registration information and the application permission level information are saved to the user identity module based on the terminal application interface or the standard communication protocol channel using the application protocol data unit instruction set. For example, the authentication SDK end stores the APP permission level in the super SIM card through the terminal API or OMA channel, and the super SIM card determines the user's operating authority to the SIM, processes the APDU instruction set, and saves the APP registration information and permission level information.

[0063] In some embodiments of the present specification, an authentication response made by the authentication management platform to a second application registration request is obtained. After the authentication response includes the registration code corresponding to the application, it also includes: based on the terminal application interface or the standard communication protocol channel, using the application protocol data unit instruction set to save the registration code and the application permission level to the user identity module, the user identity module is used to return the registration execution result to the authentication SDK end; after receiving the registration execution result returned from the user identity module, the registration execution result is sent to the terminal application, the terminal application is used to parse the registration execution result, and display a prompt message of registration success or failure on the interface of the terminal application.

[0064] For example, after receiving the registration code, the authentication SDK end of the embodiment of the present specification will store the registration information, permission level information, etc. containing the registration code to the super SIM card through the terminal API or OMA channel using the APDU instruction set. The super SIM card then returns the background registration execution result to the authentication SDK end. After receiving the background registration execution result returned by the super SIM card, the authentication SDK end sends it to the terminal APP. The terminal APP parses the background registration information execution result and prompts a prompt message of "Registration successful" or "Registration failed" on the interface.

[0065] Step 250: Match the authentication code with the registration code to obtain a matched application authentication result.

[0066] In the embodiments of this specification, if the authentication code and the registration code do not match successfully, it means that the application authentication has failed, and if the authentication code and the registration code match successfully, it means that the application authentication has succeeded. For example, when the authentication code and the registration code are consistent, the application authentication is determined to be successful, and when the authentication code and the registration code are inconsistent, the application authentication is determined to be failed.

[0067] The embodiment of this specification discloses an application authentication method based on user identity module authorization, which supports multiple permission level management. After receiving a background registration request or a background authentication request, it can determine whether background registration or background authentication is required according to the permission level of the application. For high-level permission applications, authorization for background registration or background authentication is required, while for low-level permission applications, no additional background authorization for background registration or background authentication is required. Access is available by entering a user name; for zero-level permission applications, access is not allowed. By distinguishing the permission levels of applications, the authentication efficiency of applications is improved, and the high security of application data is guaranteed by using security commands and storing permission information, without the need for application manufacturers to pay high SMS fees caused by large amounts of data verification. The problems of poor system performance, low data security and high cost when authenticating applications with large business volumes are solved.

[0068] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0069] See also Figure 3 , Figure 3 A schematic diagram of the structure of an application authentication device provided in an embodiment of this specification.

[0070] like Figure 3 As shown, the application authentication device may at least include: a request receiving unit 300, a level reading unit 310, a request sending unit 320, an authentication response unit 330, a registration code acquisition unit 340 and a matching unit 350, wherein:

[0071] The request receiving unit 300 is used to receive a first application authentication request sent by a terminal application;

[0072] The level reading unit 310 is used to read the application permission level through the user identity module of the terminal based on the first application authentication request;

[0073] The request sending unit 320 is used to send a second application authentication request to the authentication management platform according to the application permission level;

[0074] The authentication response unit 330 is used to obtain an authentication response made by the authentication management platform to the authentication request of the second application, where the authentication response includes an authentication code corresponding to the application;

[0075] A registration code acquisition unit 340 is used to acquire a registration code corresponding to the application program;

[0076] The matching unit 350 is used to match the authentication code with the registration code to obtain a matched application authentication result.

[0077] In some embodiments of the present specification, the level reading unit 310 includes a level reading sub-unit, which is used to: when it is verified that the first application authentication request is legitimate, call the user identity module of the terminal based on the terminal application interface or the standard communication protocol channel using the application protocol data unit instruction set; and read the application permission level through the user identity module of the terminal.

[0078] In some embodiments of the present specification, the request sending unit 320 includes a request sending subunit, which is used to send a second application authentication request to the authentication management platform when it is determined that background authentication of the application is required according to the application permission level.

[0079] In some embodiments of the present specification, the application authentication device further includes a registration unit, the registration unit includes a first registration request sending unit, a second registration request sending unit and a registration response unit, wherein:

[0080] A first registration request sending unit, configured to receive a first application registration request sent by an application when it is determined that there is no registration code corresponding to the application in the user identity module;

[0081] A second registration request sending unit, based on the first application registration request, sends a second application registration request to the authentication management platform according to the application permission level;

[0082] The registration response unit is used to obtain a registration response made by the authentication management platform to the second application registration request, where the registration response includes a registration code corresponding to the application.

[0083] In some embodiments of the present specification, the second registration request sending unit includes a first determination unit, which is used to: when the first application registration request is verified to be legal and it is determined based on the application permission level that the application needs to be registered in the background, send the second application registration request to the authentication management platform, and the authentication management platform is used to make a registration response to the second application registration request.

[0084] In some embodiments of the present specification, the second registration request sending unit includes a second determination unit, which is used to: when it is verified that the first application registration request is legal and it is determined based on the application permission level that background registration of the application is not required, verify the user's operating authority to the user identity module through the user identity module; when it is verified that the user's operating authority to the user identity module is legal, based on the terminal application interface or the standard communication protocol channel, save the application registration information and the application permission level information to the user identity module using the application protocol data unit instruction set; the application registration information includes but is not limited to the registration code, and the application permission level information includes but is not limited to the application permissions.

[0085] In some embodiments of the present specification, the registration unit further includes an information storage unit and a parsing unit, wherein:

[0086] An information storage unit is used to save the registration code and the application permission level to the user identity module based on the terminal application program interface or the standard communication protocol channel using the application protocol data unit instruction set. The user identity module is used to return the registration execution result to the authentication SDK end;

[0087] The parsing unit is used to send the registration execution result to the terminal application after receiving the registration execution result returned from the user identity module. The terminal application is used to parse the registration execution result and display a prompt message of registration success or failure on the interface of the terminal application.

[0088] Based on the content of the application authentication system in multiple embodiments of this specification, it can be known that an application authentication method based on user identity module authorization disclosed in the embodiments of this specification supports multiple permission level management. After receiving a background registration request or a background authentication request, it can be determined whether background registration or background authentication is required according to the permission level of the application. For high-level permission applications, authorization of background registration or background authentication is required. For low-level permission applications, no additional background authorization of background registration or background authentication is required. Access can be obtained by entering the user name; for zero-level permission applications, access is not allowed. By distinguishing the permission levels of applications, the authentication efficiency of applications is improved, and the high security of application data is guaranteed by using security commands and storing permission information, without the need for application manufacturers to pay high SMS fees caused by large amounts of data verification. The problems of poor system performance, low data security and high cost when authenticating applications with large business volumes are solved.

[0089] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the application authentication system embodiment, since it is basically similar to the application authentication method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0090] See also Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification is shown.

[0091] like Figure 4 As shown, the electronic device 400 may include: at least one processor 401 , at least one network interface 404 , a user interface 403 , a memory 405 , and at least one communication bus 402 .

[0092] The communication bus 402 may be used to realize the connection and communication among the above-mentioned components.

[0093] The user interface 403 may include buttons, and the optional user interface may also include a standard wired interface or a wireless interface.

[0094] The network interface 404 may include, but is not limited to, a Bluetooth module, an NFC module, a Wi-Fi module, etc.

[0095] Among them, the processor 401 may include one or more processing cores. The processor 401 uses various interfaces and lines to connect the various parts of the entire electronic device 400, and executes various functions and processes data of the electronic device 400 by running or executing instructions, programs, code sets or instruction sets stored in the memory 405, and calling data stored in the memory 405. Optionally, the processor 401 can be implemented in at least one hardware form of DSP, FPGA, and PLA. The processor 401 can integrate one or a combination of CPU, GPU, modem, etc. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 401, and it can be implemented separately through a chip.

[0096] Among them, the memory 405 may include RAM or ROM. Optionally, the memory 405 includes a non-transient computer-readable medium. The memory 405 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 405 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above various method embodiments, etc. The memory 405 may also be at least one storage device located away from the aforementioned processor 401. The memory 405 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an authentication application. The processor 401 can be used to call the authentication application stored in the memory 405 and perform the steps of application authentication mentioned in the aforementioned embodiments.

[0097] The embodiment of the present specification also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer or a processor, the computer or the processor executes the above Figure 2 One or more steps in the illustrated embodiment. If the components of the electronic device described above are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.

[0098] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of this specification is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted by a computer-readable storage medium. The computer instructions can be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, a data center, etc. that contains one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0099] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0100] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Without departing from the design spirit of this specification, various modifications and improvements made to the technical solutions of this specification by ordinary technicians in this field should fall within the scope of protection determined by the claims of this specification.

Claims

1. An application authentication method, comprising: Receiving a first application authentication request sent by a terminal application; Based on the first application authentication request, reading the application permission level through the user identity module of the terminal; Sending a second application authentication request to the authentication management platform according to the application permission level; Obtaining an authentication response made by the authentication management platform to the authentication request of the second application, wherein the authentication response includes an authentication code corresponding to the application; Obtaining a registration code corresponding to the application; The authentication code is matched with the registration code to obtain a matched application authentication result.

2. The method according to claim 1, wherein the step of reading the application permission level through the user identity module of the terminal based on the first application authentication request comprises: When it is verified that the first application authentication request is legitimate, calling the user identity module of the terminal by using an application protocol data unit instruction set based on a terminal application program interface or a standard communication protocol channel; The application program permission level is read through the user identity module of the terminal.

3. The method according to claim 2, wherein sending a second application authentication request to an authentication management platform according to the application permission level comprises: When it is determined according to the application permission level that background authentication of the application is required, a second application authentication request is sent to the authentication management platform.

4. The method according to claim 1, before obtaining the registration code corresponding to the application, further comprising: When it is determined that there is no registration code corresponding to the application in the user identity module, receiving a first application registration request sent by the application; Based on the first application registration request, sending a second application registration request to the authentication management platform according to the application permission level; A registration response made by the authentication management platform to the second application registration request is obtained, where the registration response includes a registration code corresponding to the application.

5. The method according to claim 4, wherein the step of sending a second application registration request to the authentication management platform based on the first application registration request and according to the application permission level comprises: When the first application registration request is verified to be legal and the application needs to be registered in the background according to the application permission level, the second application registration request is sent to the authentication management platform, and the authentication management platform is used to make a registration response to the second application registration request.

6. The method according to claim 5, wherein the sending of the second application registration request to the authentication management platform based on the first application registration request and according to the application permission level, further comprises: When it is verified that the first application registration request is legitimate and it is determined that the application does not need to be registered in the background according to the application permission level, verifying the user's operation permission of the user identity module through the user identity module; When it is verified that the user's operation authority to the user identity module is legal, the application registration information and the application authority level information are saved to the user identity module using an application protocol data unit instruction set based on a terminal application program interface or a standard communication protocol channel; The application registration information includes but is not limited to a registration code, and the application permission level information includes but is not limited to application permissions.

7. The method according to claim 5, wherein obtaining the authentication response made by the authentication management platform to the second application registration request, wherein the authentication response includes the registration code corresponding to the application, further comprises: Based on the terminal application program interface or the standard communication protocol channel, the registration code and the application program permission level are saved to the user identity module using the application protocol data unit instruction set, and the user identity module is used to return the registration execution result to the authentication SDK end; After receiving the registration execution result returned from the user identity module, the registration execution result is sent to the terminal application, and the terminal application is used to parse the registration execution result and display a prompt message of registration success or failure on the interface of the terminal application.

8. An application authentication device, comprising: A request receiving unit, configured to receive a first application authentication request sent by a terminal application; a level reading unit, configured to read the application permission level through the user identity module of the terminal based on the first application authentication request; a request sending unit, configured to send a second application authentication request to the authentication management platform according to the application permission level; an authentication response unit, configured to obtain an authentication response made by the authentication management platform to the authentication request of the second application, wherein the authentication response includes an authentication code corresponding to the application; A registration code acquisition unit, used to acquire a registration code corresponding to the application; The matching unit is used to match the authentication code with the registration code to obtain a matched application authentication result.

9. An electronic device comprising a processor and a memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images