Multi-terminal non-inductive login access method based on token and device fingerprint and electronic device

Abstract

The invention discloses a multi-terminal non-inductive login access method and electronic equipment based on a token and an equipment fingerprint, and the method comprises the steps: enabling a first user to access a plurality of servers through a first terminal under the condition that the first terminal does not log in a first server when the first user accesses the plurality of servers through the first terminal; obtaining a first token for accessing the first server according to the device fingerprint of the first terminal and the login information for the first server, and storing the device fingerprint of the first terminal in a user device fingerprint set of the first user; under the condition that the first terminal does not log in the second server, the first terminal confirms that the first token exists in the user equipment fingerprint set of the first user according to the equipment fingerprint of the first terminal, and a second token for accessing the second server is generated according to the first token; the user equipment fingerprint set comprises equipment fingerprints of partial or all terminal equipment corresponding to partial or all login information of the user, and the equipment fingerprints are unique identifiers of the terminal equipment. By utilizing the method and the device, non-inductive login and access of the user in a multi-terminal and multi-server system can be realized.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, specifically to the field of Internet identity authentication, access control and security authentication, and in particular to a multi-terminal seamless login access method, electronic device and storage medium based on tokens and device fingerprints. Background Art

[0002] With the rapid development of Internet technology, people often access various resources through the Internet. For information security requirements, people need to enter their login information registered on the website through the browser when accessing resources. Only after verification can they successfully access network resources. When there are many websites to be visited, multiple login verifications are required, which affects the user experience. In order to solve this problem, the existing mainstream solution is to use OAuth2.0 technology for seamless login. Under this technical framework, when cross-domain access is performed on multiple different sites under the same root domain through the front-end browser, after completing the login authentication for any of the sites, seamless login and access can be performed between all sites. Therefore, this technical framework is also called Single Sign-On (SSO) technology.

[0003] However, it should be noted that single sign-on (SSO) technology is only applicable to login through a browser, but not to login and access through a mobile terminal APP. This is because the technical framework uses Cookie technology to store the browser's unified authentication credentials, and Cookie technology only supports browsers, not mobile terminals. Therefore, when people hope to expand the scope of application of single sign-on to support seamless authentication of mobile terminal APPs, it cannot be achieved smoothly under the current technical framework. Summary of the invention

[0004] In view of this, an embodiment of the present application provides a multi-terminal seamless login access method, an electronic device and a computer-readable storage medium based on a token and a device fingerprint, which are used to solve at least one technical problem.

[0005] The embodiment of the present application provides a multi-terminal senseless login access method based on a token and a device fingerprint, which is applied to a terminal device, and the method includes:

[0006] When a first user accesses multiple servers through a first terminal, the first terminal sends a device fingerprint of the first terminal and login information for the first server to an authentication server without logging into the first server, so that the authentication server returns a first token and stores the device fingerprint of the first terminal in a user device fingerprint set of the first user, wherein the first token is used for the first terminal to access the first server;

[0007] When the first terminal is not logged in to the second server, the first terminal sends the device fingerprint of the first terminal to the authentication server, so that the authentication server confirms the existence of the first token through the user device fingerprint set of the first user, and generates a second token according to the first token, and sends it to the first terminal, wherein the second token is used by the first terminal to access the second server;

[0008] The user device fingerprint set includes device fingerprints of some or all terminal devices corresponding to part or all of the user's login information, wherein the device fingerprint is a unique identifier of the terminal device.

[0009] Optionally, according to the method provided by the embodiment of the present application, when the first user accesses multiple servers through multiple terminals, it also includes: when the second terminal is not logged in to the first server, sending the device fingerprint of the second terminal and the login information for the first server to the authentication server, so that the authentication server returns a third token, and stores the device fingerprint of the second terminal in the user device fingerprint set of the first user, and the third token is used for the second terminal to access the first server; when the third terminal is not logged in to the second server, sending the device fingerprint of the third terminal and the login information for the second server to the authentication server, so that the authentication server returns a fourth token, and stores the device fingerprint of the third terminal in the user device fingerprint set of the first user, and the fourth token is used for the third terminal to access the second server; when the second terminal is not logged in to the second server, sending the device fingerprint of the second terminal to the authentication server, so that the authentication server confirms that the third terminal is in a logged-in state on the second server through the user device fingerprint set of the first user, and then returns a fifth token to the second terminal, and the fifth token is used for the second terminal to access the second server.

[0010] Optionally, according to the method provided in an embodiment of the present application, the device fingerprint is a hash value, and the hash value is calculated based on at least one of the following: an International Mobile Equipment Identity (IMEI) code, a browser user agent UA, and a character set.

[0011] The embodiment of the present application provides a multi-terminal senseless login access method based on tokens and device fingerprints, which is applied to an authentication server, including: the authentication server receives the device fingerprint of a first terminal and login information for a first server, wherein the first terminal is not logged in on the first server; the authentication server sends a first token to the first terminal according to the device fingerprint and login information of the first terminal, and stores the device fingerprint of the first terminal in a user device fingerprint set of a first user, wherein the first token is used for the first terminal to access the first server; the authentication server receives the device fingerprint of the first terminal; the authentication server confirms the existence of the first token through the user device fingerprint set of the first user; the authentication server generates a second token according to the first token and sends it to the first terminal, wherein the second token is used for the first terminal to access the second server; wherein the user device fingerprint set includes the device fingerprints of some or all terminal devices corresponding to some or all of the user's login information, wherein the device fingerprint is a unique identifier of the terminal device.

[0012] Optionally, according to the method provided in the embodiment of the present application, when the first user accesses multiple servers through multiple terminals, it also includes: the authentication server receives the device fingerprint of the second terminal and the login information for the first server, wherein the second terminal is not logged in on the first server; the authentication server sends a third token to the second terminal based on the device fingerprint and login information of the second terminal, and stores the device fingerprint of the second terminal in the user device fingerprint set of the first user, wherein the third token is used for the second terminal to access the first server; the authentication server receives the device fingerprint of the third terminal and the login information for the second server, wherein the third terminal is not logged in on the second server; the authentication server sends a fourth token to the third terminal based on the device fingerprint and login information of the third terminal, and stores the device fingerprint of the third terminal in the user device fingerprint set of the first user, wherein the third token is used for the third terminal to access the second server; the authentication server receives the device fingerprint of the second terminal, wherein the second terminal is not logged in on the second server; the authentication server confirms that the third terminal is in a logged-in state on the second server through the user device fingerprint set of the first user; the authentication server returns a fifth token to the second terminal, and the fifth token is used for the second terminal to access the second server.

[0013] Optionally, the method provided by the embodiment of the present application also includes: the authentication server records the number of times the first user's login information is sent by the terminal, and stores the device fingerprint whose number is greater than a predetermined threshold within a predetermined time period in a user device fingerprint set of the first user.

[0014] Optionally, the method provided according to the embodiment of the present application also includes: the authentication server records the number of occurrences of each device fingerprint of the first user received, and removes the device fingerprint whose number of occurrences within a predetermined time period is less than a predetermined threshold from the user device fingerprint set of the first user.

[0015] Optionally, according to the method provided in an embodiment of the present application, the device fingerprint is a hash value, and the hash value is calculated based on at least one of the following: an International Mobile Equipment Identity (IMEI) code, a browser user agent UA, and a character set.

[0016] An embodiment of the present application provides an electronic device, which includes a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the steps of the method described above are implemented.

[0017] An embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the steps of the method described above are implemented.

[0018] Compared with previous processing methods, since the present application sets a user device fingerprint set, an authorization code is no longer sent and the step of verifying the authorization code is omitted before issuing a token. Instead, the user identity is confirmed based on the user device fingerprint set, and then a new token of the target server can be directly issued based on the tokens of other servers that the user already has, thereby realizing the user's seamless login and access to the target server. Since it no longer relies on cookies to store the user's login account information, but instead completes the authentication by setting a user device fingerprint set, the solution of the present application is no longer limited to browser login scenarios, but is suitable for seamless login of various types of terminal devices. The embodiments of the present application can extend the seamless login that was originally limited to browsers to seamless login of any type of terminal device, and can provide great convenience for mobile device users in particular. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following briefly introduces the drawings in the embodiments of the present application.

[0020] Figure 1 It is a schematic diagram of the system architecture of an embodiment of the present application.

[0021] Figure 2 It is a schematic diagram of a multi-terminal seamless login access method in the prior art.

[0022] Figure 3 It is a flowchart of the multi-terminal seamless login access method based on tokens and device fingerprints in an embodiment of the present application.

[0023] Figure 4It is a flowchart of the multi-terminal seamless login access method based on tokens and device fingerprints in an embodiment of the present application applied to an authentication server.

[0024] Figure 5 It is a flowchart of another multi-terminal seamless login access method based on tokens and device fingerprints in an embodiment of the present application.

[0025] Figure 6 This is a flowchart of another multi-terminal seamless login access method based on tokens and device fingerprints in an embodiment of the present application applied to an authentication server.

[0026] Figure 7 It is a schematic diagram of a multi-terminal seamless login access method in one embodiment of the present application.

[0027] Figure 8 It is a schematic diagram of a multi-terminal seamless login access method in another embodiment of the present application.

[0028] Fig. 9 It is a schematic diagram of an electronic device used to implement the multi-terminal seamless login access method of an embodiment of the present application. DETAILED DESCRIPTION

[0029] The principles and spirit of the present application will be described below with reference to several exemplary embodiments. It should be understood that the purpose of providing these embodiments is to make the principles and spirit of the present application clearer and more thorough, so that those skilled in the art can better understand and implement the principles and spirit of the present application. The exemplary embodiments provided herein are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments herein, all other embodiments obtained by ordinary technicians of the art without creative work are within the scope of protection of this application.

[0030] The embodiments of the present application relate to terminal devices and / or servers. It is known to those skilled in the art that the embodiments of the present application can be implemented as a system, apparatus, device, method, computer-readable storage medium or computer program product. Therefore, the present disclosure can be specifically implemented in at least one of the following forms: complete hardware, complete software, or a combination of hardware and software. According to the embodiments of the present application, the present application requests protection for a method, apparatus, electronic device and computer-readable storage medium for obtaining portal website announcements. Figure 1 A schematic diagram of a system architecture of an embodiment of the present application is shown. Figure 1As shown, the system includes a terminal device 102 and a server 104. Among them, the terminal device 102 may include at least one of the following: a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart TV, various wearable devices, an augmented reality AR device, a virtual reality VR device, etc. A client may be installed on the terminal device 102. For example, the client may be a client that specifically performs a specific function (such as an application app), or a client with multiple application applets (different functions) embedded in it, or a client authenticated by a browser. The user may operate on the terminal device 102. For example, the user may open the client installed on the terminal device 102 and input instructions through the client operation, or the user may open the browser installed on the terminal device 102 and input instructions through the browser operation. After the terminal device 102 receives the instruction input by the user, the request information containing the instruction is sent to the server 104. After receiving the request information, the server 104 performs corresponding processing and then returns the processing result information to the terminal device 102. The user instruction is completed through a series of data processing and information interaction.

[0031] In this document, terms such as first, second, third, etc. are only used to distinguish one entity (or operation) from another entity (or operation), but not to require or imply any order or relationship between these entities (or operations).

[0032] Figure 2 It is a schematic diagram of a multi-terminal non-sensing login access method in the prior art, such as Figure 2 As shown, the general process of the first SSO login is that the user requests resources on the terminal, and the resource server 1 finds that the user is not logged in, so it redirects to the CAS server for verification. CAS verifies that the user is not logged in, so it requires the user to provide login information for identity authentication. The user enters the login information and submits it to CAS for login. If the login is successful, CAS will return the authorization code and the user's personal information, and write the terminal fingerprint information in the cookie. Then, CAS will redirect back to the resource server 1. After receiving the authorization code, the resource server 1 will send an authorization request to CAS to obtain the token and the user's detailed information. After CAS verifies the authorization code and passes it, it will issue a token and return the user's detailed information. Finally, the resource server 1 obtains the necessary permissions and user information to provide services to the user. This embodiment is significantly different from the general process of the prior art, which is described in detail below.

[0033] Figure 3 A flowchart of a multi-terminal senseless login access method based on a token and device fingerprint according to an embodiment of the present application is shown. The method is applied to a terminal device and includes the following steps:

[0034] S101: When a first user accesses multiple servers through a first terminal, the first terminal sends a device fingerprint of the first terminal and login information for the first server to an authentication server without logging into the first server, so that the authentication server returns a first token and stores the device fingerprint of the first terminal in a user device fingerprint set of the first user, wherein the first token is used for the first terminal to access the first server;

[0035] S102: The first terminal sends the device fingerprint of the first terminal to the authentication server without logging into the second server, so that the authentication server confirms the existence of the first token through the user device fingerprint set of the first user, and generates a second token based on the first token, and sends it to the first terminal, wherein the second token is used by the first terminal to access the second server; wherein the user device fingerprint set includes the device fingerprints of some or all terminal devices corresponding to some or all login information of the user, wherein the device fingerprint is a unique identifier of the terminal device.

[0036] According to an embodiment of the present application, when a terminal device (such as a PC or a mobile phone) requests to access the first server, not only does it send the user's login information (such as an account password) to the authentication server so that the authentication server issues a token, but the terminal device also sends its own device fingerprint information (such as the IMEI code of the mobile phone or the hash value of the IMEI code) to the authentication server so that the authentication server records the device fingerprint. Among them, the authentication server is a server used for user verification and token issuance, such as CAS (Central Authentication Service), which is an open source identity authentication protocol and service used to simplify the cross-domain single sign-on (SSO) process; a token is a resource credential required to access a resource interface, which can include user identity information, timestamps, security signatures and other information; the device fingerprint referred to in the embodiment of the present application refers to the terminal's unique identity representation for the authentication server, which can be in the form of a string of IDs or hash values.

[0037] Specifically, the device fingerprint is stored in the device fingerprint set of the current user (the same user may have multiple terminal devices, such as a smart phone or tablet, etc., and the device fingerprints of these terminal devices can constitute the device fingerprint set of the user, that is, the user device fingerprint set represents the set of device fingerprints corresponding to multiple terminals, and the corresponding device fingerprints point to the same user identity). Based on this, the current user can not only use the token to successfully access the first server, but also, when the current user wants to access the second server, without the need for user login information, the authentication server can confirm through the user's device fingerprint set that the current user already has a token (that is, the token previously issued for logging in to the first server). At this time, the authentication server will directly issue a token for logging in to the second server to the current user, without the user having to enter the login account information again. The process of logging in to the third server is the same, and seamless login between multiple servers can be achieved.

[0038] It can be seen that the above-mentioned authentication process no longer relies on cookies to store the user's login account information, but completes the authentication by setting a "user device fingerprint set". Therefore, the above-mentioned scheme is no longer limited to the browser login occasion. More importantly, the above-mentioned scheme of the present application is applicable to the seamless login of various types of (mobile or non-mobile) terminal devices. In other words, the embodiment of the present application can expand the seamless login that was originally limited to the browser to the seamless login of any type of terminal device. For example, through the mobile APP, the seamless login to multiple resource servers to obtain resources is compared to the previous operations that need to be based on browser cookies to complete the authentication, or the operations that need to repeatedly provide login account information on the APP. The seamless login solution of the embodiment of the present application can realize the APP's seamless login to multiple resource servers. The solution of the present application can especially provide great convenience for mobile device users.

[0039] As an example, according to the processing method of the embodiment of the present application, step S101 can be implemented through the following process: the first user initiates an access request to the first server through the first terminal. If the first server indicates that the user is not logged in, the first terminal sends a first message to the authentication server. The first message includes the device fingerprint of the first terminal, wherein the device fingerprint is a unique identifier of the terminal device. The authentication server confirms the token under it based on the device fingerprint of the first terminal. If the authentication server feedbacks that there is no token corresponding to the device fingerprint of the first terminal, the authentication server requires the first terminal to input the login information of the first user for logging in to the first server. Then the first terminal sends the login information to the authentication server. After verification by the authentication server, the authentication server issues a first token for accessing the first server to the first terminal, and stores the device fingerprint of the first terminal in the user device fingerprint set of the first user. After receiving the first token, the first terminal uses the first token to access the first server.

[0040] For example, suppose the first user uses the A application of mobile phone A to access the first server to obtain the corresponding resources. If the first user has not logged in or the first server has not detected the login status of the first user because the original login status has expired, been cleared, or other reasons, the first server will feedback the situation to the mobile phone A application. At this time, the mobile phone A application will carry the device fingerprint of the mobile phone to access the authentication server. The authentication server queries the token status under the device fingerprint. When there is no token, the first user enters the login information on the mobile phone A application, such as the account number and password. The authentication server verifies the login information to confirm whether it has access rights to the first server. After the verification is passed, the first token is issued to the mobile phone A application, and the authentication server records the device fingerprint of the mobile phone. Later, during the validity period of the first token, the first user can use the A application to directly access the first server to obtain relevant resources without having to enter the login information again.

[0041] As an example, step S102 can be implemented through the following process: a first user initiates an access request to a second server through a first terminal. If the second server indicates that the user is not logged in, the first terminal sends a second message to the authentication server, where the second message includes the device fingerprint of the first terminal, so that the authentication server determines, based on the device fingerprint of the first terminal, that there is a first token corresponding to the device fingerprint of the first terminal, and sends a second token for accessing the second server to the first terminal; after receiving the second token returned by the authentication server, the first terminal uses the second token to access the second server.

[0042] For example, suppose the first user uses the B application of mobile phone A to access the second server to obtain the corresponding resources. If the first user has not logged in or the second server has not detected the first user's login status because the original login status has expired, cleared, or other reasons, the second server will feedback the situation to the mobile phone B application. At this time, the mobile phone B application will carry the device fingerprint of the mobile phone to access the authentication server. The authentication server queries the token status under the device fingerprint. Assuming that the first token under the device fingerprint is still valid, the authentication server will issue the second token to the mobile phone B application accordingly. At this time, there are the first token and the second token under the device fingerprint. Later, during the validity period of the second token, the first user can use the B application to directly access the second server to obtain relevant resources without entering login information.

[0043] In the embodiments of the present application, "device fingerprint" can be understood as the unique identity of the terminal to the authentication server, which can be in the form of a string of characters, ID or hash value. Optionally, the device fingerprint can use the existing unique identification information of the device, such as the International Mobile Equipment Identity (IMEI), the browser user agent (UA) or a character set. Preferably, the device fingerprint can use a hash value, such as a hash value calculated based on IMEI, UA and / or a character set, where the character set can be a combination of one or more of the terminal's IP address, MAC address or screen resolution.

[0044] For example, the device fingerprint of a mobile phone can be IMEI, which is usually 15 digits and divided into four parts: TAC (Type Approval Code): the first 6 digits; FAC (Final Assembly Code): the middle 2 digits; SNR (Serial Number): the next 6 digits; SP (Spare Number): the last digit. For example, the IMEI code of a mobile phone is 35-123456-789101-2. Inputting this IMEI code into a hash function, such as SHA-256, can get a unique hash value, for example: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6, which can be used as the device fingerprint of the mobile phone.

[0045] For example, the device fingerprint of a browser can be a UA string, such as: Mozilla / 5.0 (Windows NT10.0; Win64; x64) AppleWebKit / 537.36 (KHTML, like Gecko) C / 91.0.4472.124 Safari / 537.36. This UA string indicates that the request is initiated by a 64-bit C browser running on Windows 10. Similarly, by hashing this UA string, a unique hash value can be obtained, for example: b1c2d3e4f5g6h7i8j9k0l1m2n3o4p5q6r7s8t9u0v1w2x3y4z5a6. This hash value can be used as the device fingerprint of the device where the browser is located (which may be a PC or a mobile terminal device).

[0046] For another example, the character set may be a combination of one or more of the terminal's IP address, MAC address, or screen resolution. For example, a character set may be 192.168.1.100 (IP address) plus 1024x768 (screen resolution of the current device), which is 192.168.1.100_1024x768. A hash operation may be performed on this character set to obtain a unique hash value, such as c1d2e3f4g5h6i7j8k9l0m1n2o3p4q5r6s7t8u9v0w1x2y3z4a5b6, which may be used as the device fingerprint of the terminal (which may be a PC or a mobile terminal device).

[0047] In the embodiment of the present application, regarding the "user device fingerprint set", the user device fingerprint set includes the device fingerprints of some or all terminal devices corresponding to some or all login information of the user. Based on this, in a user device fingerprint set corresponding to multiple terminal devices, each device fingerprint points to the same user.

[0048] For example, when a user registers a personal account on a resource server, he or she fills in user personal information (such as user name, password, mobile phone number, ID number or email address, etc.). All of this information can constitute the user's login information. The authentication server can associate the user login information sent by the terminal with the personal information filled in by the user when registering.

[0049] Assume that the first user first accesses the first server through the application in mobile phone A, and provides the device fingerprint of mobile phone A and login information 1 to the authentication server. At this time, the device fingerprint of mobile phone A of the first user is stored in the user device fingerprint set of the first user; then the first user uses application A of mobile phone A to try to access the second server, and provides the device fingerprint of mobile phone A to the authentication server. At this time, the authentication server can confirm that the device fingerprint of mobile phone A already exists in the user device fingerprint set of the first user, so it can be judged that the first user is legitimate, and the token of the second server is allowed to be issued to the first user.

[0050] The above situation meets the Figure 3 In other embodiments of the present application, there is also a situation where the first user continues to access the first and second servers through mobile phone B. The authentication and seamless login process with the help of the user device fingerprint set in this case will be described in detail below.

[0051] Figure 4 The flowchart of a multi-terminal senseless login access method based on a token and device fingerprint in an embodiment of the present application on the authentication server side is shown as follows: Figure 4 The following steps are shown:

[0052] S201, an authentication server receives a device fingerprint of a first terminal and login information for the first server, wherein the first terminal is not logged in on the first server;

[0053] S202, the authentication server sends a first token to the first terminal according to the device fingerprint and login information of the first terminal, and stores the device fingerprint of the first terminal in a user device fingerprint set of the first user, wherein the first token is used for the first terminal to access the first server;

[0054] S203, the authentication server receives the device fingerprint of the first terminal;

[0055] S204, the authentication server confirms the existence of the first token through the user device fingerprint set of the first user; the authentication server generates a second token based on the first token and sends it to the first terminal, and the second token is used by the first terminal to access the second server; wherein the user device fingerprint set includes the device fingerprints of some or all terminal devices corresponding to part or all of the user's login information, wherein the device fingerprint is a unique identifier of the terminal device.

[0056] As an example, multiple servers (such as the first server and the second server) in the embodiments of the present application belong to the same authentication server, and login authentication is performed through the same authentication server. For example, a centralized authentication server (CAS) can be used to set up the CAS according to the process of the embodiments of the present application to provide user verification, token issuance, and maintenance of user device fingerprint sets for multiple servers, thereby realizing user-free login.

[0057] This application sets a user device fingerprint set, eliminates the need to send an authorization code and omits the step of verifying the authorization code before issuing a token, confirms the user's identity through the user device fingerprint set, and then directly issues a new target server token based on the user's existing tokens of other servers, thereby enabling the user to log in and access the target server seamlessly. The above process does not require verification of the authorization code before issuing the token, and does not require user participation, thereby achieving multi-server seamless login on mobile terminals.

[0058] According to the embodiments of the present application, reference Figure 5 If the first user needs to access multiple servers through multiple terminals, the multi-terminal seamless login access method of the present application includes the following processing on the terminal side:

[0059] S301, when the second terminal is not logged in to the first server, the second terminal sends the device fingerprint of the second terminal and the login information for the first server to the authentication server, so that the authentication server returns a third token and stores the device fingerprint of the second terminal in the user device fingerprint set of the first user, and the third token is used for the second terminal to access the first server;

[0060] S302, when the third terminal is not logged in to the second server, the third terminal sends the device fingerprint of the third terminal and the login information for the second server to the authentication server, so that the authentication server returns a fourth token, and stores the device fingerprint of the third terminal in the user device fingerprint set of the first user, and the fourth token is used for the third terminal to access the second server;

[0061] S303, when the second terminal is not logged in to the second server, the second terminal sends the device fingerprint of the second terminal to the authentication server, so that the authentication server confirms that the third terminal is in a logged-in state on the second server through the user device fingerprint set of the first user, and then returns a fifth token to the second terminal, wherein the fifth token is used by the second terminal to access the second server.

[0062] Correspondingly, refer to Figure 6 If the first user needs to access multiple servers through multiple terminals, the multi-terminal non-sense login access method of the present application includes the following processing on the authentication server side:

[0063] S401, the authentication server receives a device fingerprint of a second terminal and login information for a first server, wherein the second terminal is not logged in on the first server;

[0064] S402, the authentication server sends a third token to the second terminal according to the device fingerprint and login information of the second terminal, and stores the device fingerprint of the second terminal in the user device fingerprint set of the first user, wherein the third token is used by the second terminal to access the first server;

[0065] S403, the authentication server receives a device fingerprint of a third terminal and login information for a second server, wherein the third terminal is not logged in on the second server;

[0066] S404, the authentication server sends a fourth token to the third terminal according to the device fingerprint and login information of the third terminal, and stores the device fingerprint of the third terminal in the user device fingerprint set of the first user, wherein the third token is used for the third terminal to access the second server;

[0067] S405, the authentication server receives a device fingerprint of the second terminal, wherein the second terminal is not logged in on the second server;

[0068] S406, the authentication server confirms that the third terminal is in a logged-in state on the second server through the user device fingerprint set of the first user;

[0069] S407: The authentication server returns a fifth token to the second terminal, where the fifth token is used by the second terminal to access the second server.

[0070] That is to say, according to the embodiments of the present application, when a user accesses the first server and the second server through multiple terminal devices, the device fingerprints and related login information of these terminal devices will be stored in the device fingerprint set of the current user. Moreover, when the user uses a terminal device to access the second server, without the need for user login information, a seamless login is not only performed based on the login state of the terminal device on the first server. For example, when the login state of the terminal device on the first server fails, the authentication server can confirm through the device fingerprint set of the current user that the current user already has a token on another terminal device. At this time, the authentication server will directly issue a token for logging in to the second server to the current user, without the need for the user to enter the login account information again. The process of logging in to the third server is the same, and seamless login between multiple servers can be achieved.

[0071] It can be seen that the above-mentioned authentication process further expands the user's seamless login across terminal devices. Compared with the user on the same terminal device, completing authentication and convenient access to different servers through a "user device fingerprint set", the above-mentioned seamless login solution of the embodiment of the present application can realize seamless login on multiple different terminal devices and to multiple resource servers, further bringing convenience to mobile device users.

[0072] As an example, the above-mentioned embodiment of the present application can be implemented through the following process. In step 301, the first user initiates an access request to the first server through the second terminal. If the first server indicates that the user is not logged in, the second terminal sends a first message to the authentication server, and the first message includes the device fingerprint of the second terminal. The authentication server confirms the token under it based on the device fingerprint of the second terminal. If the authentication server feedbacks that there is no token corresponding to the device fingerprint of the second terminal, the authentication server requires the second terminal to input the login information used by the first user to log in to the first server. Then the second terminal sends the login information to the authentication server. After verification by the authentication server, the authentication server issues a third token for accessing the first server to the second terminal, and stores the device fingerprint of the second terminal in the user device fingerprint set of the first user. After receiving the third token, the second terminal uses the third token to access the first server.

[0073] For example, suppose the first user uses the A application of the B mobile phone to access the first server to obtain the corresponding resources. If the first user has not logged in or the first server has not detected the first user's login status because the original login status has expired, been cleared, or other reasons, the first server will feedback the situation to the mobile phone A application. At this time, the mobile phone A application will carry the device fingerprint of the mobile phone to access the authentication server. The authentication server queries the token status under the device fingerprint. When there is no token, the first user enters the login information on the mobile phone A application, such as the account number and password. The authentication server verifies the login information to confirm whether it has access rights to the first server. After the verification is passed, the third token is issued to the mobile phone A application, and the authentication server records the device fingerprint of the mobile phone. Later, during the validity period of the third token, the first user can use the A application to directly access the first server to obtain relevant resources without having to enter the login information again.

[0074] In step 302, the first user initiates an access request to the second server through the third terminal. If the second server indicates that the user is not logged in, the third terminal sends a second message to the authentication server. The second message includes the device fingerprint of the third terminal, where the device fingerprint is the unique identifier of the terminal device. The authentication server confirms the token under the third terminal based on the device fingerprint of the third terminal. If the authentication server feedbacks that there is no token corresponding to the device fingerprint of the third terminal, the authentication server requires the third terminal to input the login information used by the first user to log in to the second server. Then the third terminal sends the login information to the authentication server. After verification by the authentication server, the authentication server issues a fourth token for accessing the second server to the third terminal, and stores the device fingerprint of the third terminal in the user device fingerprint set of the first user. After receiving the fourth token, the third terminal uses the fourth token to access the second server.

[0075] For example, suppose the first user uses the A browser of computer A to access the second server to obtain the corresponding resources. If the first user has not logged in or the second server has not detected the login status of the first user due to other reasons such as the original login status being invalid or cleared, the second server will feedback the situation to the A browser. At this time, the A browser will carry the device fingerprint of the A browser to access the authentication server. The authentication server queries the token status under the device fingerprint. When there is no token, the first user enters the login information on the A browser, such as the account password. The authentication server verifies the login information to confirm whether it has the access right to the second server. After the verification is passed, the fourth token is issued to the A browser. At the same time, the authentication server records the device fingerprint of the A browser. At this time, based on the login information when the first user accesses the first server on the B mobile phone and the login information when the first user accesses the second server on the A browser, the unique identity of the first user can be pointed to. Therefore, the authentication server will make a union of the device fingerprint of the B mobile phone and the device fingerprint of the A browser, that is, both are included in the device fingerprint set of the first user. At this time, the device fingerprint set has the third token and the fourth token. Later, during the validity period of the fourth token, the first user can use the A browser to directly access the first server to obtain relevant resources without entering the login information again.

[0076] In step 303, the first user initiates an access request to the second server through the second terminal. If the second server indicates that the user is not logged in, the second terminal sends a third message to the authentication server, where the third message includes the device fingerprint of the second terminal, so that the authentication server determines the existence of a fourth token corresponding to the device fingerprint of the third terminal based on the device fingerprint of the second terminal, and sends a fifth token for accessing the second server to the second terminal; after receiving the fifth token returned by the authentication server, the second terminal uses the fifth token to access the second server.

[0077] For example, suppose the first user uses the B application of the B mobile phone to access the second server to obtain the corresponding resources. If the first user has not logged in or the second server has not detected the first user's login status because the original login status has expired, cleared, or other reasons, the second server will feedback the situation to the mobile phone B application. At this time, the mobile phone B application will carry the device fingerprint of the mobile phone to access the authentication server. The authentication server will check the token status under the device fingerprint. Assuming that the third token under the device fingerprint has expired, but the fourth token under the device fingerprint of the A browser in the device fingerprint set is still valid, the authentication server will issue the fifth token to the mobile phone B application accordingly. At this time, the first user's device fingerprint set contains the fourth token and the fifth token. Later, during the validity period of the fifth token, the first user can use the B application to directly access the second server to obtain relevant resources without entering login information.

[0078] The advantage of this setting is that since the application sets up a user device fingerprint set, it is possible to confirm the legitimacy of the user based on the login status of the user's other devices on other servers, so that a new token can be directly issued to the user's current device. It can be seen that by setting a user device fingerprint set, seamless login across multiple terminals and domains can be achieved, and the operation of the same user using different terminals to log in to different servers is supported. There is no restriction on the type of terminal device, and seamless login and access to the target server can be easily achieved through PC browsers and mobile device APPs.

[0079] According to an embodiment of the present application, optionally, when the tokens under the device fingerprint of the second terminal and the device fingerprint of the third terminal in the user device fingerprint set of the first user are both valid, the first user selects one of them to issue a new token to the corresponding terminal to access the resource server.

[0080] For example, suppose the first user uses the A application on the A mobile phone to access the first server and uses the A browser on the A computer to access the second server, and stores the device fingerprint of the A mobile phone and the device fingerprint of the A browser in the first user's device fingerprint set. When the first user uses the B application on the A mobile phone to access the second server, when the tokens under the device fingerprint of the A mobile phone and the device fingerprint of the A browser are both valid, the first user chooses which device fingerprint to use to issue a new token for the B application to access the second server.

[0081] According to an embodiment of the present application, optionally, the authentication server records the number of times the first user's login information is sent by the terminal, and stores the device fingerprint whose number within a predetermined time period is greater than a predetermined threshold in a user device fingerprint set of the first user.

[0082] For example, suppose the threshold set by the authentication server is: 2 times within 10 days. At this time, when the first user uses the A application of the A mobile phone to access the first server for the first time, he obtains a token and accesses by entering the login information. At this time, the user device fingerprint set of the first user does not store the device fingerprint of the A mobile phone. Within 10 days, the first user uses the A application of the A mobile phone to access the first server for the second time, and obtains a token and accesses by entering the login information again. At this time, it is determined that the A mobile phone is the first user's usual mobile phone, and the device fingerprint of the A mobile phone is added to the user device fingerprint set of the first user.

[0083] Login information usually represents an access request initiated by the user himself. By judging whether the corresponding terminal is a device commonly used by the user based on the number of times the user enters the login information for access, and further deciding whether to record the device fingerprint, the security of single sign-on based on the device fingerprint can be improved.

[0084] According to an embodiment of the present application, optionally, the authentication server records the number of occurrences of each device fingerprint of the first user received, and removes device fingerprints whose number of occurrences within a predetermined time period is less than a predetermined threshold from the user device fingerprint set of the first user.

[0085] For example, suppose the threshold set by the authentication server is: 2 times within 10 days. At this time, suppose that mobile phone A only accesses the authentication server once with the device fingerprint within 10 days. At this time, it is determined that mobile phone A is no longer the first user's usual mobile phone. At this time, it is removed from the first user's device fingerprint set to improve the security of single sign-on using device fingerprint.

[0086] The above describes the implementation methods and advantages of the embodiments of the present application through multiple embodiments. The following describes the specific processing process of the embodiments of the present application in detail with reference to specific examples.

[0087] Example 1: Single terminal logs in to multiple servers

[0088] 1. Log in to the "Recruitment Platform" for the first time through a browser

[0089] Suppose we have a system called "Recruitment Platform" with a domain name of ehire.51job.com. Before Xiao Zhang can access the platform, he needs to register an account. After Xiao Zhang fills in his email address (such as xiaozhang@a.com) and password (such as 123456) as login information, the recruitment platform saves this information in its database.

[0090] Figure 7 Schematic diagram of a multi-terminal seamless login access method in one embodiment of the present application. Figure 7 As shown. According to this application, Xiao Zhang wants to access the job list on the recruitment platform. He opens the C browser and enters the URL. The browser sends a request to the recruitment platform. When the recruitment platform receives the access request, since Xiao Zhang has not logged in, the recruitment platform detects that there is no login state and returns a redirect instruction and the address of the CAS server to the browser. The browser then accesses the CAS server with UserAgent-1 for identity authentication according to the instruction. The CAS server determines the token status under UserAgent-1. Since it is the first login, there is no token under the UserAgent-1, and the CAS server returns this status to the browser.

[0091] Xiao Zhang enters the login information to log in, and the browser sends the login information to the CAS server for verification. After the CAS server verifies that the information is correct, it issues access token 1, which is valid for a certain period of time. The CAS server also performs the first binding operation. The CAS server records the corresponding relationship between UserAgent, user account information, and token, as shown in Table 1 below:

[0092] Table 1

[0093]

[0094] After the browser obtains access token 1, it uses token 1 to initiate an access request to the recruitment platform. The recruitment platform redirects to the CAS server to verify the validity of token 1, including checking whether token 1 is expired or revoked. After confirming that token 1 is valid, the verification result is returned to the recruitment platform. Based on this, the recruitment platform returns the resources on the recruitment platform, such as job lists, to the browser.

[0095] 2. Log in to the "Online Store" for the first time through a browser

[0096] Assume that we have another system called "Online Mall" with the domain name mall.51job.com. Before user Xiao Zhang can access the platform, he needs to register an account. After Xiao Zhang fills in his email address (such as xiaozhang@a.com) and password (such as 123456) as login information, the online mall will save this information in its database.

[0097] like Figure 2 As shown, the process of the prior art (taking OAuth2.0_SSO as an example) is that when a user accesses the resource server 2 through a terminal, since the login operation has been performed before and the terminal fingerprint information is saved in the cookie, it includes: the user requests resources on the terminal, and the resource server 2 finds that the user is not logged in, but there is the terminal fingerprint information in the cookie, so it will redirect to the CAS server with the terminal fingerprint information. After receiving the request with the terminal fingerprint information, the CAS server verifies the validity of the terminal fingerprint. If the fingerprint is valid, it means that the user has completed the login operation elsewhere, then the CAS server will directly return the authorization code to the resource server 2. After receiving the authorization code, the resource server 2 will send an authorization request to the CAS server to obtain the token and the user's detailed information. After the CAS server verifies the authorization code and passes it, it will issue a token and return the user's detailed information. Finally, the resource server 2 obtains the necessary permissions and user information to provide services to the user.

[0098] This embodiment is significantly different from the usual process of the prior art. The following example illustrates that Xiao Zhang wants to access the product list on the online mall. He opens the C browser and enters the URL. The browser sends a request to the online mall. When the online mall receives the access request, since Xiao Zhang has not logged in, the online mall detects that he is not logged in and returns a redirect instruction and the address of the CAS server to the browser. The browser then accesses the CAS server with UserAgent-1 for identity authentication according to the instruction. The CAS server determines the token status under UserAgent-1:

[0099] At this time, when token 1 is still valid, the CAS server verifies the token. After verification, it issues token 2 belonging to the online mall to the browser. The access token is valid for a certain period of time. The CAS server will also perform the first binding operation. The CAS server records the correspondence between UserAgent, user account information, and token, as shown in Table 2 below. At this time, the user's device ID set will be formed according to UserAgent, as shown in Table 3 below:

[0100] Table 2

[0101]

[0102] Table 3

[0103]

[0104]

[0105] After the browser obtains access token 2, it uses token 2 to initiate an access request to the online mall. The online mall redirects to the CAS server to verify the validity of token 2. After confirming that token 2 is valid, it returns the verification result to the online mall. The online mall returns the resources on the online mall, such as the product list, to the browser accordingly.

[0106] Among them, when the token 1 of the recruitment platform has expired, it is displayed that there is no token under the UserAgent. The CAS server returns this situation to the browser. Xiao Zhang needs to enter the login information to log in to obtain token 2 for access. Similarly, the CAS server will record the correspondence between UserAgent and user account information and token.

[0107] 3. Not the first login to the "Recruitment Platform" or "Online Mall"

[0108] Whether it is a recruitment platform or an online mall, the same C browser is still used for access during the subsequent login process. If its own token is still valid, the browser directly uses the token to initiate an access request to the corresponding resource server. After the CAS server verifies that the token is valid, the corresponding resource server returns the corresponding resource to the browser.

[0109] If the token itself has expired, carry UserAgent to access the CAS server for identity authentication. The CAS server determines the status of the token under it based on the UserAgent. At this time, if the token of other resource servers under the UserAgent is still valid, a new token can be obtained for access.

[0110] Assuming that token 2 has expired, when Xiao Zhang uses browser C to visit the online mall, since there is no login state, the browser carries UserAgent-1 to access the CAS server. The CAS server queries the device ID set based on UserAgent-1 and finds that token 1 of the recruitment platform is still valid. After verification, the CAS server issues token 3 belonging to the online mall based on the token and updates the device ID set at the same time.

[0111] Of course, it is not limited to recruitment platforms and online shopping malls. When Xiao Zhang accesses any other resource server through the C browser and is issued a token, he can bind the browser's UserAgent with the token to form a device ID set. Based on this device ID set, Xiao Zhang can obtain a convenient, secure and efficient single sign-on experience.

[0112] To further improve security, the browser usage habits can be used to determine that the habitual user is the user corresponding to the login information, that is, Xiao Zhang. For example, when a user accesses any resource server, only if the login information is entered more than twice, the UserAgent, login information and corresponding token are bound, that is, the token is included in the device ID set.

[0113] Example 2: Multiple terminals log in to multiple servers

[0114] Figure 8 is a schematic diagram of a multi-terminal seamless login access method in another embodiment of the present application. Figure 8 As shown:

[0115] In this embodiment, the interaction logic between the terminal and the resource server and CAS server is basically the same as that in Embodiment 1. The difference in this embodiment lies in the cross-device single sign-on between multiple terminals and its specific implementation method. Figure 2As described above, the prior art can only implement single sign-on to different resource servers on one terminal, while the embodiments of the present application can implement cross-device single sign-on between multiple terminals.

[0116] 1. Log in to the "Recruitment Platform" for the first time through the mobile application

[0117] Assume that we have a system called "Recruitment Platform" with a website address of ehire.51job.com, which can be accessed through browsers on computers, mobile applications, browsers on mobile phones, etc. Before accessing the platform, user Xiao Zhang needs to register an account. When registering an account, the information that the user needs to fill in is pre-set, such as user name, password, mobile phone number, ID number or email address, etc. In this embodiment, Xiao Zhang fills in the email address (such as xiaozhang@a.com) and password (such as 123456) as login information, and also includes the ID number (such as 3303...1234) for unique identity identification. The recruitment platform saves this information in its database, and this information will serve as the key to identifying the user's identity across devices.

[0118] Xiao Zhang wants to access the job list on the recruitment platform. He opens the APP on A's phone, and the APP sends a request to the recruitment platform. When the recruitment platform receives the access request, since Xiao Zhang has not logged in yet, the recruitment platform detects that he is not logged in and returns a redirect instruction and the address of the CAS server to the APP. The APP then accesses the CAS server for identity authentication based on the IMEI of A's phone (such as 123456-78-901234-5). The CAS server determines the token status under it based on the IMEI. Since it is the first login, there is no token under the IMEI, and the CAS server returns the status to the APP.

[0119] Xiao Zhang enters the login information to log in, and the APP sends the login information to the CAS server for verification. After the CAS server verifies that the information is correct, it issues access token 1, which is valid for a certain period of time. The CAS server will also perform the first binding operation. The CAS server records the corresponding relationship between IMEI, user account, and token, as shown in Table 4 below:

[0120] Table 4

[0121]

[0122] After the APP obtains access token 1, it uses token 1 to initiate an access request to the recruitment platform. The recruitment platform redirects to the CAS server to verify the validity of token 1. After confirming that token 1 is valid, it returns the verification result to the recruitment platform. Based on this, the recruitment platform returns the resources on the recruitment platform, such as job lists, to the browser.

[0123] 2. Log in to the "Online Store" for the first time through a computer browser

[0124] Suppose we also have a system called "Online Mall" with the URL mall.51job.com. Before user Xiao Zhang can access the platform, he needs to register an account. When registering an account, Xiao Zhang fills in his email address (such as xiaozhang@a.com) and password (such as 123456) as login information. In addition, he also includes his ID number (such as 3303...1234) for unique identification. The online mall stores this information in its database.

[0125] Xiao Zhang wants to access the product list on the online mall, so he opens the C browser on computer A. The browser sends a request to the online mall. When the online mall receives the access request, since Xiao Zhang has not logged in yet, the online mall detects that he is not logged in and returns a redirect instruction and the address of the CAS server to the browser. The browser then accesses the CAS server with UserAgent-1 for identity authentication based on the instruction. The CAS server determines the token status under UserAgent-1. Since it is the first login, there is no token under the UserAgent, and the CAS server returns this status to the browser.

[0126] Xiao Zhang enters the login information to log in, and the browser sends the login information to the CAS server for verification. After the CAS server verifies that the information is correct, it issues access token 2, which is valid for a certain period of time. The CAS server also performs the first binding operation. The CAS server records the corresponding relationship between UserAgent-1 and the user account and token, as shown in Table 5 below:

[0127] Table 5

[0128]

[0129] At this time, the CAS server will also determine the unique identity of the user based on the consistency of the user account information, such as the ID number in the account information, thus forming a set of IMEI, UserAgent, user account, and token, that is, a device ID set, as shown in Table 6 below:

[0130] Table 6

[0131]

[0132] Of course, it is not limited to recruitment platforms and online shopping malls. When Xiao Zhang accesses any other resource server through a browser and is issued a token, he can bind the browser's UserAgent to the token to form a device ID set. Based on this device ID set, Xiao Zhang can obtain a convenient, secure and efficient single sign-on experience.

[0133] 3. Not the first login to the "Recruitment Platform" or "Online Mall"

[0134] Whether it is a recruitment platform or an online shopping mall, in the subsequent login process, if you still use the terminal for the first login to access, if your own token is still valid, the corresponding terminal directly uses the token to initiate an access request to the corresponding resource server, and after the CAS server verifies that the token is valid, the corresponding resource server returns the corresponding resource to the browser.

[0135] There are two other situations. One is that Xiao Zhang accesses the recruitment platform through the APP of A's mobile phone, but his own token has expired (or Xiao Zhang accesses the online mall through the C browser of A's computer, but his own token has expired); the other is that Xiao Zhang accesses the online mall through the APP of A's mobile phone, but the recruitment platform's token has expired (or Xiao Zhang accesses the recruitment platform through the C browser of A's computer, but the online mall's token has expired).

[0136] In the first scenario, for example, token 1 of the recruitment platform has expired. At this time, the APP carries the IMEI of phone A to access the CAS server for identity authentication. The CAS server queries the token status in the device ID set based on the IMEI. At this time, when the tokens of other resource servers under the device ID set are still valid, for example, token 2 under UserAgent-1 is still valid, a new token 3 can be issued to the recruitment platform for access, and the device ID set can be updated.

[0137] In the second scenario, when the APP of mobile phone A accesses the online mall, the token 1 used to access the recruitment platform can be queried based on the IMEI of mobile phone A. However, since token 1 has expired, the CAS server queries the token status in the device ID set based on the IMEI. At this time, when there are tokens of other resource servers under the device ID set that are still valid, for example, token 2 under UserAgent-1 is still valid, a new token 4 can be issued for access to the online mall visited by mobile phone A, and the device ID set can be updated.

[0138] To further improve security, the browser usage habits can be used to determine that the habitual user is the user corresponding to the login information, that is, Xiao Zhang. For example, when a user accesses any resource server, only if the login information is entered more than twice, the UserAgent, login information and corresponding token are bound, that is, the token is included in the device ID set.

[0139] The electronic device in the embodiment of the present application may be a user terminal device, a server, other computing devices, or a cloud server. Fig. 9 A schematic diagram of an electronic device used to implement the multi-terminal seamless login access method of an embodiment of the present application is shown. The electronic device may include a processor 601 and a memory 602 storing computer program instructions. When the processor 601 executes the computer program instructions, it implements the process or function of any of the above-mentioned embodiments.

[0140] Specifically, the processor 601 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application. The memory 602 may include a large-capacity memory for data or instructions. For example, the memory 602 may be at least one of the following: a hard disk drive (HDD), a read-only memory (ROM), a random access memory (RAM), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, a universal serial bus (USB) drive or other physical / tangible memory storage device. For another example, the memory 602 may include a removable or non-removable (or fixed) medium. For another example, the memory 602 may be inside or outside the integrated gateway disaster recovery device. The memory 602 may be a non-volatile solid-state memory. In other words, the memory 602 usually includes a tangible (non-transitory) computer-readable storage medium (such as a memory device) encoded with computer-executable instructions, and when the software is executed (such as executed by one or more processors), the operation described in the method of the embodiment of the present application can be performed. The processor 601 implements the process or function of any method in the above embodiments by reading and executing the computer program instructions stored in the memory 602.

[0141] In one example, Fig. 9The electronic device shown may also include a communication interface 603 and a bus 610. Among them, the processor 601, the memory 602, and the communication interface 603 are connected through the bus 610 and complete the communication between each other. The communication interface 603 is mainly used to realize the communication between each module, device, unit and / or device in the embodiment of the present application. The bus 610 includes hardware, software or both, and can couple the components of the online data traffic billing device to each other. For example, the bus may include at least one of the following: an accelerated graphics port (AGP) or other graphics bus, an enhanced industrial standard architecture (EISA) bus, a front-end bus (FSB), a hypertransport (HT) interconnect, an industrial standard architecture (ISA) bus, an infinite bandwidth interconnect, a low pin count (LPC) bus, a memory bus, a micro channel architecture (MCA) bus, a peripheral component interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a serial advanced technology attachment (SATA) bus, a video electronics standard association local (VLB) bus or other suitable buses. The bus 610 may include one or more buses. Although the embodiments of the present application describe or illustrate a specific bus, the embodiments of the present application may consider any suitable bus or interconnection method.

[0142] In combination with the method in the above embodiments, an embodiment of the present application also provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the process or function of any method in the above embodiments is implemented.

[0143] In addition, an embodiment of the present application further provides a computer program product, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the process or function of any one of the methods in the above embodiments is implemented.

[0144] The above exemplarily describes the flowcharts and / or block diagrams of the methods, devices, systems and computer program products of the embodiments of the present application, and describes the relevant various aspects. It should be understood that each box or combination thereof in the flowchart and / or block diagram can be implemented by computer program instructions, or by dedicated hardware that performs a specified function or action, or by a combination of dedicated hardware and computer instructions. For example, these computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to form a machine that enables these instructions executed by such a processor to enable the implementation of the functions / actions specified in each box or combination thereof in the flowchart and / or block diagram. Such a processor can be a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.

[0145] The functional blocks shown in the structured block diagram of the embodiment of the present application can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc.; when implemented in software, it is a program or code segment used to perform the required task. The program or code segment can be stored in a memory, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0146] It should be noted that the present application is not limited to the specific configurations and processes described above or shown in the figures. The above is only a specific implementation mode of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the described system, device, module or unit can refer to the corresponding process in the method embodiment without further description. It should be understood that the scope of protection of the present application is not limited to this. Any technician familiar with the technical field can think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the scope of protection of the present application.

Claims

1. A multi-terminal non-sensing login access method based on tokens and device fingerprints, characterized in that: Applied to a terminal device, the method comprises: When a first user accesses multiple servers through a first terminal, the first terminal sends a device fingerprint of the first terminal and login information for the first server to an authentication server without logging into the first server, so that the authentication server returns a first token and stores the device fingerprint of the first terminal in a user device fingerprint set of the first user, wherein the first token is used for the first terminal to access the first server; When the first terminal is not logged in to the second server, the first terminal sends the device fingerprint of the first terminal to the authentication server, so that the authentication server confirms the existence of the first token through the user device fingerprint set of the first user, and generates a second token according to the first token, and sends it to the first terminal, wherein the second token is used by the first terminal to access the second server; The user device fingerprint set includes device fingerprints of some or all terminal devices corresponding to part or all of the user's login information, wherein the device fingerprint is a unique identifier of the terminal device.

2. According to the multi-terminal seamless login access method of claim 1, when the first user accesses multiple servers through multiple terminals, it also includes: When the second terminal is not logged in to the first server, the second terminal sends the device fingerprint of the second terminal and the login information for the first server to the authentication server, so that the authentication server returns a third token and stores the device fingerprint of the second terminal in the user device fingerprint set of the first user, and the third token is used for the second terminal to access the first server; When the third terminal is not logged in to the second server, the third terminal sends the device fingerprint of the third terminal and the login information for the second server to the authentication server, so that the authentication server returns a fourth token and stores the device fingerprint of the third terminal in the user device fingerprint set of the first user, and the fourth token is used for the third terminal to access the second server; When the second terminal is not logged in to the second server, the second terminal sends the device fingerprint of the second terminal to the authentication server, so that the authentication server confirms that the third terminal is in a logged-in state on the second server through the user device fingerprint set of the first user, and then returns a fifth token to the second terminal, where the fifth token is used by the second terminal to access the second server.

3. According to the multi-terminal seamless login access method according to any one of claims 1 or 2, the device fingerprint is a hash value, and the hash value is calculated based on at least one of the following: International Mobile Equipment Identity IMEI code, browser user agent UA, and character set.

4. A multi-terminal non-sensing login access method based on tokens and device fingerprints, applied to an authentication server, characterized in that: include: The authentication server receives a device fingerprint of the first terminal and login information for the first server, wherein the first terminal is not logged in on the first server; The authentication server sends a first token to the first terminal according to the device fingerprint and login information of the first terminal, and stores the device fingerprint of the first terminal in the user device fingerprint set of the first user, wherein the first token is used for the first terminal to access the first server; The authentication server receives the device fingerprint of the first terminal; The authentication server confirms the existence of the first token through the user device fingerprint set of the first user; The authentication server generates a second token according to the first token and sends it to the first terminal, where the second token is used by the first terminal to access the second server; The user device fingerprint set includes device fingerprints of some or all terminal devices corresponding to part or all of the user's login information, wherein the device fingerprint is a unique identifier of the terminal device.

5. The multi-terminal seamless login access method according to claim 4, when the first user accesses multiple servers through multiple terminals, further comprising: The authentication server receives a device fingerprint of the second terminal and login information for the first server, wherein the second terminal is not logged in on the first server; The authentication server sends a third token to the second terminal according to the device fingerprint and login information of the second terminal, and stores the device fingerprint of the second terminal in the user device fingerprint set of the first user, wherein the third token is used by the second terminal to access the first server; The authentication server receives a device fingerprint of the third terminal and login information for the second server, wherein the third terminal is not logged in on the second server; The authentication server sends a fourth token to the third terminal according to the device fingerprint and login information of the third terminal, and stores the device fingerprint of the third terminal in the user device fingerprint set of the first user, wherein the third token is used for the third terminal to access the second server; The authentication server receives a device fingerprint of the second terminal, wherein the second terminal is not logged in on the second server; The authentication server confirms that the third terminal is in a logged-in state on the second server through the user device fingerprint set of the first user; The authentication server returns a fifth token to the second terminal, where the fifth token is used by the second terminal to access the second server.

6. The multi-terminal non-sensing login access method according to any one of claims 4 or 5, further comprising: The authentication server records the number of times the first user's login information is sent by the terminal, and stores the device fingerprint whose number is greater than a predetermined threshold within a predetermined time period in a user device fingerprint set of the first user.

7. The multi-terminal seamless login access method according to any one of claims 4 or 5, further comprising: The authentication server records the number of occurrences of each device fingerprint of the first user received, and removes the device fingerprint whose number of occurrences within a predetermined time period is less than a predetermined threshold from the user device fingerprint set of the first user.

8. According to the multi-terminal seamless login access method according to any one of claims 4 or 5, the device fingerprint is a hash value, and the hash value is calculated based on at least one of the following: International Mobile Equipment Identity IMEI code, browser user agent UA, and a character set.

9. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; when the electronic device executes the computer program instructions, the method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images