Authorization verification method and computing device

Abstract

The invention provides an authorization verification method and computing equipment. The authorization verification method is applied to the computing device, and the computing device comprises an authorization system, a first-level service system and a second-level service system. The authorization system and the first-level service system are in mutual trust, the first-level service system and the second-level service system are in mutual trust, and the method comprises the steps that the first-level service system receives an authorization code sent by a client and information of a target second-level service system; the first-level service system forwards the authorization code to the target second-level service system according to a mutual trust mechanism between the first-level service system and the target second-level service system and the information of the target second-level service system; and the target secondary service system receives the authorization code and performs authorization verification on the client based on the authorization code. In the embodiment of the invention, mutual trust is established between the second-level service system and the first-level service system, mutual trust is established between the first-level service system and the authorization system, and unified authorization among the authorization system, the first-level service system and the second-level service system is realized.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an authorization verification method and a computing device. Background Art

[0002] Unified authorization is a secure authentication method that allows users to authorize third-party applications to access their resources stored on service providers without providing sensitive information such as usernames and passwords.

[0003] In the related art, mutual trust between the authorization system and the business system requires mutual trust between each business system and the authorization system. However, not all business systems can establish mutual trust with the authorization system, for example, the business subsystem generated by the business system. Therefore, unified authorization cannot be achieved between the authorization system, the business system and the business subsystem, thereby increasing the risk of information leakage. Summary of the invention

[0004] The embodiments of the present application provide an authorization method and a computing device to achieve unified authorization among an authorization system, a primary business system, and a secondary business system, thereby reducing the risk of information leakage.

[0005] In the first aspect, an embodiment of the present application provides an authorization verification method, which is applied to a computing device, wherein the computing device includes an authorization system, a primary business system and a secondary business system; wherein the authorization system and the primary business system trust each other, and the primary business system and the secondary business system trust each other; the primary business system receives the authorization code sent by the client and the information of the target secondary business system; wherein the authorization code is sent by the authorization system to the client in response to the client successfully logging into the authorization system; no mutual trust is established between the target secondary business system and the authorization system; the primary business system forwards the authorization code to the target secondary business system based on the mutual trust mechanism between the primary business system and the target secondary business system, and the information of the target secondary business system; the target secondary business system receives the authorization code and performs authorization verification on the client based on the authorization code.

[0006] For some secondary business systems that cannot establish mutual trust with the authorization system, unified authorization cannot be achieved between the authorization system, the primary business system and the secondary business system. In order to achieve unified authorization between the authorization system, the primary business system and the secondary business system, in an embodiment of the present application, the secondary business system establishes mutual trust with the primary business system, and the primary business system establishes mutual trust with the authorization system, to achieve unified authorization between the authorization system, the primary business system and the secondary business system. In an embodiment of the present application, the primary business system receives the authorization code sent by the client and the information of the target secondary business system, and forwards the authorization code to the target secondary business system based on the mutual trust mechanism between itself and the target secondary business system, so that the target secondary business system performs authorization verification on the client, to achieve unified authorization between the authorization system, the primary business system and the secondary business system, and thus reduce the risk of information leakage.

[0007] Optionally, the primary business system authenticates the target secondary business system based on the entry information of the target secondary business system; if the primary business system successfully authenticates the target secondary business system, the primary business system forwards the authorization code to the target secondary business system based on the mutual trust mechanism between the primary business system and the target secondary business system, as well as the identification information of the target secondary business system.

[0008] Optionally, the secondary business system includes multiple ones. When the access target of the client changes from the first target secondary business system to the second target secondary business system and the authorization code is valid, the primary business system receives the authorization code and information of the second target secondary business system sent by the client; the primary business system forwards the authorization code to the second target secondary business system based on the mutual trust mechanism between the primary business system and the second target secondary business system, and the information of the second target secondary business system; the second target secondary business system receives the authorization code and performs authorization verification on the client based on the authorization code.

[0009] When the client's access object changes from the first target secondary business system to the second target secondary business system, and the authorization code is valid, the previous authorization code is used to implement unified authorization among the authorization system, the primary business system, and the second target secondary business system.

[0010] Optionally, when the access target of the client changes from the first target secondary business system to the second target secondary business system and the authorization code becomes invalid, the authorization system sends a new authorization code to the client in response to the client successfully logging into the authorization system.

[0011] Optionally, the mutual trust mechanism includes any one of a whitelist, a mutual trust configuration, and a key.

[0012] In this embodiment, the flexibility and applicability of the authorization verification method are improved through a diversified mutual trust mechanism.

[0013] Optionally, the target secondary business system sends the authorization code to the authorization system; the authorization system verifies the authorization code and sends user information to the target secondary business system if the verification is successful; the target secondary business system receives the user information and approves the authorization request of the client based on the user information.

[0014] In the second aspect, an embodiment of the present application provides a computing device, including: an authorization system, a primary business system and a secondary business system; wherein, the authorization system and the primary business system have mutual trust, and the primary business system and the secondary business system have mutual trust; the primary business system is used to receive the authorization code sent by the client and the information of the target secondary business system; according to the mutual trust mechanism between the target secondary business system and the information of the target secondary business system, the authorization code is forwarded to the target secondary business system; wherein the authorization code is sent by the authorization system to the client in response to the client successfully logging into the authorization system; no mutual trust is established between the target secondary business system and the authorization system; the target secondary business system is used to receive the authorization code and perform authorization verification on the client based on the authorization code.

[0015] For some secondary business systems that cannot establish mutual trust with the authorization system, unified authorization cannot be achieved between the authorization system, the primary business system and the secondary business system. In order to achieve unified authorization between the authorization system, the primary business system and the secondary business system, in an embodiment of the present application, the secondary business system establishes mutual trust with the primary business system, and the primary business system establishes mutual trust with the authorization system, to achieve unified authorization between the authorization system, the primary business system and the secondary business system. In an embodiment of the present application, the primary business system receives the authorization code sent by the client and the information of the target secondary business system, and forwards the authorization code to the target secondary business system based on the mutual trust mechanism between itself and the target secondary business system, so that the target secondary business system performs authorization verification on the client, to achieve unified authorization between the authorization system, the primary business system and the secondary business system, and thus reduce the risk of information leakage.

[0016] Optionally, the primary business system is specifically used to authenticate the target secondary business system based on the entry information of the target secondary business system; when the authentication of the target secondary business system is successful, the authorization code is forwarded to the target secondary business system based on the mutual trust mechanism between the target secondary business system and the identification information of the target secondary business system.

[0017] Optionally, the secondary business system includes multiple; the primary business system is also used to receive the authorization code and information of the second target secondary business system sent by the client when the client's access target changes from the first target secondary business system to the second target secondary business system and the authorization code is valid; the primary business system forwards the authorization code to the second target secondary business system based on the mutual trust mechanism between the primary business system and the second target secondary business system, and the information of the second target secondary business system; the second target secondary business system is also used to receive the authorization code and perform authorization verification on the client based on the authorization code.

[0018] Optionally, the authorization system is used to send a new authorization code to the client in response to the client successfully logging into the authorization system when the client's access target changes from the first target secondary business system to the second target secondary business system and the authorization code becomes invalid.

[0019] Optionally, the mutual trust mechanism includes any one of a whitelist, a mutual trust configuration, and a key.

[0020] In this embodiment, the flexibility and applicability of the authorization verification method are improved through a diversified mutual trust mechanism.

[0021] Optionally, the target secondary business system sends the authorization code to the authorization system; the authorization system verifies the authorization code and sends user information to the target secondary business system if the verification is successful; the target secondary business system receives the user information and approves the authorization request of the client based on the user information. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0024] Figure 2 A schematic diagram of the structure of a server provided in an embodiment of the present application;

[0025] Figure 3 A signaling diagram of an authorization verification method provided in an embodiment of the present application;

[0026] Figure 4 A signaling diagram of another authorization verification method provided in an embodiment of the present application;

[0027] Figure 5A signaling diagram of another authorization verification method provided in an embodiment of the present application;

[0028] Figure 6 A signaling diagram of another authorization verification method provided in an embodiment of the present application;

[0029] Figure 7 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] It should be noted that the embodiments described in this application are only part of the embodiments of this application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0031] The terms "first" and "second" in the specification and claims of this application are used to distinguish different objects rather than to describe a specific order of objects. For example, first data and second data are used to distinguish different data rather than to describe a specific order of data.

[0032] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0033] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

[0034] In order to make the following embodiments clear, the technical terms involved in this application are first introduced.

[0035] OAuth2 is an authorization proxy protocol that allows users to authorize their resources (such as personal information and social relationships, etc.) on one service provider to another service provider.

[0036] The authorization system is responsible for verifying the identity of the client and issuing the authorization code.

[0037] A business system is a system used to process and manage specific business functions, such as tenant management business or user management business.

[0038] Client devices, such as computers, mobile phones, smart watches, tablets and other terminal devices.

[0039] The client is an application or service installed on the client device for requesting access to user resources. The client can be a public website or mobile application, or a private backend service.

[0040] Unified authorization, that is, unified authorization between the authorization system and the business system, requires that all business systems have mutual trust with the authorization system. However, not all business systems can establish mutual trust with the authorization system. In some scenarios, the business system includes a primary business system and a secondary business system. The secondary business system is temporarily generated by the primary business system, and the secondary business system cannot apply to the authorization system to establish mutual trust with it; or, the secondary system is generated by other secondary business systems (by copying other secondary business systems or by fissioning other secondary business systems), and the secondary business system cannot apply to the authorization system to establish mutual trust. Therefore, unified authorization cannot be achieved between the authorization system, the primary business system, and the secondary business system.

[0041] The primary management system is used to manage the secondary management system. For example, the primary business system may be a general management system, and the secondary business system may be a user management system. The general management system is used to manage the user management system.

[0042] To this end, an embodiment of the present application provides an authorization verification method, wherein a primary business system receives an authorization code sent by a client and information of a target secondary business system; wherein the authorization code is sent by the authorization system to the client in response to the client successfully logging into the authorization system; no mutual trust is established between the target secondary business system and the authorization system; the primary business system forwards the authorization code to the target secondary business system based on the mutual trust mechanism between the primary business system and the target secondary business system, as well as the information of the target secondary business system; the target secondary business system receives the authorization code, and performs authorization verification on the client based on the authorization code, thereby realizing unified authorization between the authorization system, the primary business system, and the secondary business system.

[0043] To facilitate understanding of the technical solution of the present application, an introduction is provided below in conjunction with the application scenarios of the embodiments of the present application.

[0044] The embodiment of the present application does not specifically limit the number of primary business systems and the number of secondary business systems. For ease of understanding, the authorization verification will be introduced below using one primary business system and three secondary business systems as an example.

[0045] For example, Figure 1 A schematic diagram of an application scenario of an embodiment of the present application is shown in the figure.

[0046] The primary business system may be the general management system 300 , and the secondary business system may be the user management system 310 .

[0047] It should be noted that in Figure 1 The light-colored bidirectional arrows indicate mutual trust between systems, for example, mutual trust between the authorization system 200 and the overall management system 300, mutual trust between the overall management system 300 and the first user management system 310, mutual trust between the overall management system 300 and the second user management system 320, and mutual trust between the overall management system 300 and the third user management system 330; dark-colored arrows indicate data flows or signal flows.

[0048] The client 100 initiates an authorization request to the authorization system 200; the authorization system 200 authenticates the client 100 and sends an authorization code to the client 100 after successful authentication. Since the authorization system 200 and the general management system 300 trust each other, the client 100 is able to send the identifier of the second user management system 320 and the authorization code to the general management system 300; since the second user management system 320 and the general management system 300 trust each other, the general management system 300 forwards the authorization code from the client 100 to the second user management system 320 according to the identifier of the second user management system 320; the second user management system 320 performs authorization verification on the client 100 according to the obtained authorization code.

[0049] It can be understood that the authorization system 200, the overall management system 300, the first user management system 310, the second user management system 320 and the third user management system 330 can all be physical servers, cloud servers, or virtual devices (such as virtual machines), etc., but are not limited to these.

[0050] It should be noted that the embodiments of the present application do not specifically limit the servers where the authorization system and the business system are located. For example, the authorization system is arranged in the authorization server, the primary business system is arranged in the first server, the secondary business system is arranged in the second server, or both the primary business system and the secondary business system are arranged in the first server.

[0051] In addition, the embodiments of the present application do not specifically limit the server where the secondary business system is deployed. For example, multiple secondary business systems can be deployed in the same server or in different servers.

[0052] See also Figure 2 , which is a schematic diagram of the structure of a server provided in an embodiment of the present application.

[0053] like Figure 2 As shown, the server includes a processor 410, a memory 420 and a communication interface 430; wherein the memory 420 is used to store computer instructions; the processor 410 is used to execute the computer instructions so that the server executes the authorization verification method.

[0054] In some embodiments, the processor 410 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, etc. A general-purpose processor may also be a microprocessor or any conventional processor.

[0055] In some embodiments, the memory 420 may be a volatile memory or a non-volatile memory, such as a register. Specifically, a volatile memory refers to a memory in which the data stored inside will be lost when the power supply is interrupted. Among them, the volatile memory is mainly a random access memory (RAM), including a static random access memory (SRAM) and a dynamic random access memory (DRAM). A non-volatile memory refers to a memory in which the data stored inside will not be lost even if the power supply is interrupted. Common non-volatile memories include read-only memory (ROM), optical disks, magnetic disks, solid-state hard disks, and various memory cards based on flash memory technology.

[0056] In some embodiments, the memory 420 stores executable code, and the processor 410 executes the code to implement the authorization verification method.

[0057] The communication interface 430 is used to implement server communication, and the server obtains the authorization verification method through the communication interface 430 .

[0058] The bus can be a peripheral component interconnect (PCI) bus, an extended industry standard architecture (EISA) bus, or a high-speed serial computer expansion bus standard (PCIE). The bus can be divided into an address bus, a data bus, and a control bus. For ease of understanding, Figure 2 It is represented by only one thick line, but it does not mean that there is only one bus or one type of bus.

[0059] In the embodiment of the present application, a mutual trust mechanism is established between the authorization system and the primary business system, and a mutual trust mechanism is established between the primary business system and the secondary business system, so as to realize unified authorization between the authorization system, the primary business system and the secondary business system. The authorization verification method will be introduced in conjunction with a specific embodiment.

[0060] See also Figure 3 , which is a signaling diagram of the authorization verification method provided in an embodiment of the present application.

[0061] like Figure 3 As shown, the method is applied to a computing device, which includes an authorization system, a primary business system and a secondary business system; wherein the authorization system and the primary business system trust each other, and the primary business system and the secondary business system trust each other.

[0062] The embodiments of the present application do not specifically limit the mutual trust mechanism between the authorization system and the primary business system, and the form of the mutual trust mechanism between the primary business system and the secondary business system, for example, a whitelist, a key, or a mutual trust configuration.

[0063] Exemplarily, the mutual trust mechanism between the authorization system and the primary business system is in the form of a whitelist, and the authorization system can save and maintain the corresponding whitelist. For example, the authorization system can add or delete the mutual trust mechanism with any primary business system, that is, add the primary business system to the whitelist or delete it from the whitelist. When the primary business system A is added to the whitelist, the client can send an authorization code to the primary business system A; correspondingly, when the primary business system B is deleted from the whitelist, the client can no longer send an authorization code to the primary business system B.

[0064] Methods include:

[0065] S301: The primary business system receives the authorization code and information of the target secondary business system sent by the client.

[0066] Among them, the authorization code is sent to the client by the authorization system in response to the client successfully logging into the authorization system; no mutual trust is established between the target secondary business system and the authorization system.

[0067] It should be noted that, in the embodiment of the present application, the authorization system only allows the client to send the authorization code to a primary business system that has mutual trust with the authorization system.

[0068] It should be noted that in the embodiment of the present application, the secondary business system may be a business system that cannot establish mutual trust with the authorization system. For example, the business system includes a primary business system and a secondary business system. The secondary business system is temporarily generated by the primary business system, and the secondary business system cannot apply to the authorization system to establish mutual trust with it; or, the secondary system is generated by other secondary business systems (by copying other secondary business systems or by fissioning other secondary business systems), and the secondary business system cannot apply to the authorization system to establish mutual trust. In addition, the secondary business system can also be a business system that can establish mutual trust with the authorization system, but has not yet established mutual trust.

[0069] In the embodiment of the present application, the information of the target secondary business system includes interface information of the target secondary business system and identification information of the target secondary business system.

[0070] Exemplarily, the interface information of the target secondary business system may be a network link (uniform resource location, URL), and the identification information of the target secondary business system may be a server name where the target secondary business system is located or a server address where the target secondary business system is located.

[0071] The form of the authorization code is not specifically limited in the embodiments of the present application. For example, the authorization code may be a string of numbers, a string of letters, or a string of numbers, letters, and characters.

[0072] The embodiments of the present application do not specifically limit the type of client, for example, a browser or mobile application software.

[0073] Exemplarily, when the client is a mobile phone application software, the mobile phone application software logs into the authorization system with an account number and password, and requests the authorization system to issue an authorization code.

[0074] After the client obtains the authorization code sent by the authorization system, if the client needs to access the primary business system, the client can send the authorization code to the primary business system based on the mutual trust mechanism between the authorization system and the primary business system, thereby enabling the client to access the primary business system; if the client needs to access the secondary business system, the client needs to send the information of the target secondary business system and the authorization code to the primary business system so that the primary business system can make further judgments.

[0075] It should be understood that there is a corresponding relationship between the name of the secondary business system and the information of the secondary business system. By entering the name of the target secondary business system in the client, the client can obtain the information of the target secondary business system based on the corresponding relationship and send the information and authorization code of the target secondary business system to the primary business system.

[0076] After the primary business system obtains the information of the target secondary business system that the client wants to access and the authorization code sent by the client, it needs to perform authorization verification on the client through the following step S302.

[0077] S302: The primary business system forwards the authorization code to the target secondary business system based on the mutual trust mechanism between the target secondary business system and the primary business system and the identification information of the target secondary business system, so that the target secondary business system authenticates the client through the authorization code.

[0078] The embodiment of the present application does not specifically limit the form of the mutual trust mechanism between the target secondary business system and the primary business system, for example, a whitelist, a key, or a mutual trust configuration.

[0079] Exemplarily, the mutual trust mechanism between the target secondary business system and the primary business system is in the form of a whitelist, and the primary business system can save and maintain the corresponding whitelist. For example, the primary business system adds or deletes the mutual trust mechanism with any secondary business system.

[0080] In one possible implementation, the primary business system authenticates the target secondary business system based on the entry information of the target secondary business system; if the primary business system successfully authenticates the target secondary business system, the primary business system forwards the authorization code to the target secondary business system based on the mutual trust mechanism between the primary business system and the target secondary business system, as well as the identification information of the target secondary business system.

[0081] It should be noted that the primary business system can forward the authorization code to the target secondary business system only under the premise of mutual trust between the primary business system and the target secondary business system.

[0082] In one possible implementation, the primary business system receives entry information of the target secondary business system and authenticates the target secondary business system; when the primary business system successfully authenticates the target secondary business system, the primary business system directs the client to the target secondary business system based on the mutual trust mechanism between the primary business system and the target secondary business system; the client sends the authorization code to the target secondary business system so that the target secondary business system authenticates the client through the authorization code.

[0083] The embodiment of the present application does not specifically limit the way to achieve the orientation, for example, it is achieved through 302 redirection. The client sends the authorization code to the corresponding target secondary business system based on the 302 redirection, so that the target secondary business system authenticates the client through the authorization code.

[0084] It should be noted that the primary business system can be directed to the target secondary business system only under the premise of mutual trust between the primary business system and the target secondary business system.

[0085] In the embodiment of the present application, the secondary business system and the primary business system trust each other, and the primary business system and the authorization system trust each other, so as to realize unified authorization among the authorization system, the primary business system and the secondary business system. Based on the mutual trust mechanism between the authorization system and the primary business system, the client sends the authorization code and the information of the target secondary business system to be accessed by the client to the primary business system, and the primary business system forwards the authorization code to the target secondary business system based on the mutual trust mechanism between itself and the secondary business system, so that the target secondary business system can perform authorization verification on the client through the authorization code, thereby reducing the risk of information leakage.

[0086] See also Figure 4 , this figure is a signaling diagram of another authorization verification method provided in an embodiment of the present application.

[0087] like Figure 4 As shown, the method includes:

[0088] S401: The client logs in to the authorization system.

[0089] Exemplarily, the client responds to the user's click operation and jumps to the login page so that the user can enter the account information and password on the login page, so that the authorization system can verify the account and password.

[0090] S402: The authorization system verifies the client, and sends a first authorization code to the client if the verification passes.

[0091] S403: Based on the mutual trust mechanism between the client and the primary business system, the client sends the information of the target secondary business system to be accessed (interface information and identification information) and the first authorization code to the primary business system.

[0092] S404: The primary business system authenticates the target secondary business system according to the interface information of the target secondary business system; after the authentication is passed, the primary business system forwards the first authorization code to the target secondary business system according to the mutual trust mechanism between the target secondary business system and the primary business system, as well as the identification information of the target secondary business system.

[0093] S405: The target secondary business system sends the first authorization code to the authorization system.

[0094] S406: The authorization system verifies the first authorization code. If the verification is successful, the authorization system returns the user information to the target secondary business system.

[0095] It should be understood that the authorization system stores the first authorization code, and after receiving the first authorization code sent by the target secondary business system, it compares it with the stored first authorization code. If they are consistent, the verification passes; if they are inconsistent, the verification fails.

[0096] In a possible implementation, after the first authorization code is verified, the authorization system returns the user information to the target secondary business system. The embodiment of the present application does not specifically limit the content of the user information, for example, the user information may be a user account and password.

[0097] S407: The target secondary business system returns an instruction to the client based on the user information, indicating that the access request of the client is approved.

[0098] Exemplarily, the target secondary business system sends an HTTP cookie to the client through the setcookie() function, wherein the cookie is a variable sent by the server to the browser, indicating the access request through the client.

[0099] S408: The client accesses the target secondary business system.

[0100] In an embodiment of the present application, the first authorization code is forwarded to the target second-level business system by the first-level business system, so that the target second-level business system performs authorization verification on the client through the first authorization code, avoiding authenticating the client through user information, thereby reducing the risk of information leakage.

[0101] The above-mentioned embodiment introduces a secondary business system, such as an authorization verification method in the case of secondary business system A. The following embodiment of the present application will introduce the authorization verification method in the case of at least two secondary business systems, such as secondary business system A and secondary business system B.

[0102] It should be noted that the secondary business system A and the secondary business system B in the embodiment of the present application are two independent business systems and do not interfere with each other. For example, the secondary business system A manages user A, and the secondary business system manages user B.

[0103] In a possible implementation, if the client implements access to the secondary business system A and the first authorization code is valid, the object accessed by the client is switched from the secondary business system A to the secondary business system B. The validity of the first authorization code can be judged by the validity period of the first authorization code. If the first authorization code is within the validity period, the first authorization code is valid; if the first authorization code is not within the validity period, the first authorization code is invalid.

[0104] It should be noted that the validity period of the first authorization code can be set in the authorization system.

[0105] The signaling diagram of the authorization verification method is as follows Figure 5 As shown, the following steps are also included:

[0106] S501: The client sends the first authorization code and information of the target secondary business system B (interface information and identification information) to the primary business system.

[0107] S502: The primary business system forwards the first authorization code to the target secondary business system B according to the identification information of the target secondary business system B.

[0108] S503: The target secondary business system B sends the first authorization code to the authorization system.

[0109] S504: The authorization system verifies the first authorization code. If the verification is successful, the authorization system returns the user information to the target secondary business system B.

[0110] S505: The target secondary business system B returns an instruction to the client based on the user information, indicating that the access request of the client is approved.

[0111] S506: The client accesses the target secondary business system B.

[0112] In a possible implementation, if the client accesses the secondary business system A and the first authorization code is invalid, the client is switched to the secondary business system B.

[0113] The signaling diagram of the authorization verification method is as follows Figure 6 As shown, the following steps are also included:

[0114] S601: The client logs in to the authorization system.

[0115] S602: The authorization system verifies the client and sends a second authorization code to the client if the verification passes.

[0116] It should be understood that the second authorization code sent by the authorization system to the client in step S602 has the same format as the first authorization code distributed by the authorization system to the client in step S402, but has different content values.

[0117] S603: Based on the mutual trust mechanism between the authorization system and the primary business system, the client sends the information (interface information and identification information) of the target secondary business system B to be accessed and the second authorization code to the primary business system.

[0118] S604: The primary business system authenticates the secondary business system B according to the interface information of the secondary business system B. After the authentication is passed, the primary business system forwards the second authorization code to the target secondary business system B according to the mutual trust mechanism between the target secondary business system B and the primary business system, as well as the identification information of the target secondary business system B.

[0119] S605: The target secondary business system B sends the second authorization code to the authorization system.

[0120] S606: The authorization system verifies the second authorization code. If the verification is successful, the authorization system returns the user information to the target secondary business system B.

[0121] S607: The target secondary business system B returns an instruction to the client based on the user information, indicating that the access request of the client is approved.

[0122] S608: The client accesses the target secondary business system B.

[0123] It should be understood that the authorization verification method for more than two secondary business systems will not be described in detail.

[0124] In the embodiment of the present application, by reusing the first authorization code or reapplying for the second authorization code, the client can switch between multiple secondary business systems, and realize unified authorization between the authorization system, the primary business system and the secondary business system (secondary business system A and secondary business system B). In addition, the client can flexibly access each secondary business system on the basis of unified authorization.

[0125] In addition, the present application embodiment provides a computing device, the structural diagram of which is as follows Figure 7 shown.

[0126] like Figure 7 As shown, the computing device includes: an authorization system 710, a primary business system 720 and a secondary business system 730; wherein the authorization system 710 and the primary business system 720 trust each other, and the primary business system 720 and the secondary business system 730 trust each other.

[0127] exist Figure 7 The secondary business system 730 includes a secondary business system A, a secondary business system B... and a secondary business system N; the secondary business system 730 includes a secondary business system A, a secondary business system B... and a secondary business system N, all of which have mutual trust with the primary business system 720.

[0128] The primary business system 720 is used to receive the authorization code sent by the client and the information of the target secondary business system; according to the mutual trust mechanism between the target secondary business system and the information of the target secondary business system, the authorization code is forwarded to the target secondary business system; wherein the authorization code is sent to the client by the authorization system 710 in response to the client successfully logging into the authorization system 710; no mutual trust is established between the target secondary business system and the authorization system 710;

[0129] The target secondary business system is used to receive the authorization code and perform authorization verification on the client based on the authorization code.

[0130] For some secondary business systems that cannot establish mutual trust with the authorization system, unified authorization cannot be achieved between the authorization system, the primary business system and the secondary business system. In order to achieve unified authorization between the authorization system, the primary business system and the secondary business system, in an embodiment of the present application, the secondary business system establishes mutual trust with the primary business system, and the primary business system establishes mutual trust with the authorization system, to achieve unified authorization between the authorization system, the primary business system and the secondary business system. In an embodiment of the present application, the primary business system receives the authorization code sent by the client and the information of the target secondary business system, and forwards the authorization code to the target secondary business system based on the mutual trust mechanism between itself and the target secondary business system, so that the target secondary business system performs authorization verification on the client, to achieve unified authorization between the authorization system, the primary business system and the secondary business system, and thus reduce the risk of information leakage.

[0131] Optionally, the primary business system 720 is specifically used to authenticate the target secondary business system based on the entry information of the target secondary business system; when the authentication of the target secondary business system is successful, the authorization code is forwarded to the target secondary business system based on the mutual trust mechanism between the target secondary business system and the identification information of the target secondary business system.

[0132] Optionally, the secondary business system 730 includes multiple; the primary business system 720 is also used to receive the authorization code and information of the second target secondary business system sent by the client when the client's access target changes from the first target secondary business system to the second target secondary business system and the authorization code is valid; the primary business system 720 forwards the authorization code to the second target secondary business system based on the mutual trust mechanism between the primary business system and the second target secondary business system, and the information of the second target secondary business system; the second target secondary business system is also used to receive the authorization code and perform authorization verification on the client based on the authorization code.

[0133] Optionally, the authorization system 710 is used to send a new authorization code to the client in response to the client successfully logging into the authorization system when the client's access target changes from the first target secondary business system to the second target secondary business system and the authorization code becomes invalid.

[0134] Optionally, the mutual trust mechanism includes any one of a whitelist, a mutual trust configuration, and a key.

[0135] In this embodiment, the flexibility and applicability of the authorization verification method are improved through a diversified mutual trust mechanism.

[0136] Optionally, the target secondary business system sends the authorization code to the authorization system; the authorization system verifies the authorization code and sends user information to the target secondary business system if the verification is successful; the target secondary business system receives the user information and approves the authorization request of the client based on the user information.

[0137] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0138] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0139] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An authorization verification method, characterized in that: Applied to a computing device, the computing device includes an authorization system, a primary business system, and a secondary business system; wherein the authorization system and the primary business system trust each other, and the primary business system and the secondary business system trust each other, the method includes: The primary business system receives the authorization code sent by the client and the information of the target secondary business system; wherein the authorization code is sent by the authorization system to the client in response to the client successfully logging into the authorization system; no mutual trust is established between the target secondary business system and the authorization system; The primary business system forwards the authorization code to the target secondary business system according to the mutual trust mechanism between the primary business system and the target secondary business system and the information of the target secondary business system; The target secondary business system receives the authorization code and performs authorization verification on the client based on the authorization code.

2. The method according to claim 1, characterized in that The information of the target secondary business system includes identification information and entry information. The primary business system forwards the authorization code to the target secondary business system according to the mutual trust mechanism between the primary business system and the target secondary business system and the information of the target secondary business system, including: The primary business system authenticates the target secondary business system according to the entry information of the target secondary business system; When the target secondary business system is successfully authenticated, the primary business system forwards the authorization code to the target secondary business system according to the mutual trust mechanism between the primary business system and the target secondary business system and the identification information of the target secondary business system.

3. The method according to claim 1 or 2, characterized in that: The secondary business system includes multiple ones, and when the access target of the client changes from the first target secondary business system to the second target secondary business system, and the authorization code is valid, the method further includes: The primary business system receives the authorization code and information of the second target secondary business system sent by the client; The primary business system forwards the authorization code to the second target secondary business system according to the mutual trust mechanism between the primary business system and the second target secondary business system and the information of the second target secondary business system; The second target secondary business system receives the authorization code, and performs authorization verification on the client based on the authorization code.

4. The method according to claim 3, characterized in that When the access target of the client changes from the first target secondary business system to the second target secondary business system, and the authorization code becomes invalid, the method further includes: In response to the client successfully logging into the authorization system, the authorization system sends a new authorization code to the client.

5. The method according to claim 4, characterized in that The mutual trust mechanism includes any one of a white list, a mutual trust configuration and a key.

6. The method according to claim 3, characterized in that The target secondary business system receives the authorization code and performs authorization verification on the client based on the authorization code, specifically including: The target secondary business system sends the authorization code to the authorization system; The authorization system verifies the authorization code and sends the user information to the target secondary business system if the verification is successful; The target secondary business system receives the user information and approves the authorization request of the client based on the user information.

7. A computing device, characterized in that include: An authorization system, a primary business system and a secondary business system; wherein the authorization system and the primary business system trust each other, and the primary business system and the secondary business system trust each other; The primary business system is used to receive the authorization code sent by the client and the information of the target secondary business system; forward the authorization code to the target secondary business system according to the mutual trust mechanism between the primary business system and the information of the target secondary business system; wherein the authorization code is sent by the authorization system to the client in response to the client successfully logging into the authorization system; no mutual trust is established between the target secondary business system and the authorization system; The target secondary business system is used to receive the authorization code and perform authorization verification on the client based on the authorization code.

8. The computing device according to claim 7, characterized in that The information of the target secondary business system includes identification information and entry information; The primary business system is specifically used to authenticate the target secondary business system based on the entry information of the target secondary business system; when the authentication of the target secondary business system is successful, the authorization code is forwarded to the target secondary business system based on the mutual trust mechanism between the target secondary business system and the identification information of the target secondary business system.

9. The computing device according to claim 7 or 8, characterized in that The secondary business system includes multiple; The primary business system is further configured to receive the authorization code and information of the second target secondary business system sent by the client when the access target of the client changes from the first target secondary business system to the second target secondary business system and the authorization code is valid; the primary business system forwards the authorization code to the second target secondary business system based on the mutual trust mechanism between the primary business system and the second target secondary business system and the information of the second target secondary business system; The second target secondary business system is further used to receive the authorization code and perform authorization verification on the client based on the authorization code.

10. The computing device according to claim 9, characterized in that The authorization system is used to send a new authorization code to the client in response to the client successfully logging into the authorization system when the access target of the client changes from the first target secondary business system to the second target secondary business system and the authorization code becomes invalid.

Images