Cloud application login method, device and equipment and computer storage medium

Abstract

The invention discloses a cloud application login method, device and equipment and a computer storage medium. The method comprises the following steps: in response to a first request for acquiring a token sent by a cloud machine client, determining a cloud application key according to a cloud application identity identifier in the first request; encrypting the cloud mobile phone information and the user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number and the token expiration time to obtain an encryption result; generating a token according to an encryption result; and sending the token to the cloud mobile phone client to enable the cloud mobile phone client to send the token to the cloud application server, so that the cloud application server decrypts based on the token to obtain the user identity information, and sends the user identity information to the cloud application client to enable the cloud application client to log in the cloud application based on the user identity information. According to the invention, the cloud application can be logged in safely and conveniently.

Description

Technical Field

[0001] The present application belongs to the field of cloud computing technology, and in particular, relates to a cloud application login method, device, equipment and computer storage medium. Background Art

[0002] With the continuous development of cloud computing, big data and other technologies, cloud phones are gradually becoming widely known and used. Users can use cloud phones by logging into their cloud phone accounts on the client, entering the cloud phone interface and performing corresponding operations.

[0003] As cloud phone technology continues to mature and become more popular, more and more applications can appear in cloud phones, thereby enriching cloud phone functions and improving the user experience of cloud phones. However, after a user logs in to a cloud phone, when they need to start an application in the cloud phone, that is, a cloud application, they often need to authenticate and log in again, which causes inconvenience to the user. Therefore, how to quickly and conveniently log in to a cloud application has become a technical problem that needs to be solved urgently by relevant technicians. Summary of the invention

[0004] The embodiments of the present application provide a cloud application login method, apparatus, device and computer storage medium, which can realize fast login of cloud applications.

[0005] In a first aspect, an embodiment of the present application provides a cloud application login method, which is applied to a cloud phone authentication center, and the method includes: responding to a first request for obtaining a token sent by a cloud machine client, determining a cloud application key according to a cloud application identity identifier in the first request; encrypting cloud phone information and user identity information according to the cloud application key, a symmetric encryption algorithm library version, a symmetric encryption algorithm selector, a random number, and a token expiration time to obtain an encryption result; generating a token according to the encryption result; sending the token to the cloud phone client, so that the cloud phone client sends the token to the cloud application server, and then the cloud application server decrypts the token based on the token to obtain the user identity information, and sends the user identity information to the cloud application client, so that the cloud application client logs in to the cloud application based on the user identity information.

[0006] In one implementation, cloud phone information and user identity information are encrypted according to a cloud application key, a symmetric encryption algorithm library version, a symmetric encryption algorithm selector, a random number, and a token expiration time to obtain an encryption result, including: determining a symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; encrypting the cloud phone information and user identity information once using the cloud application key and the symmetric encryption algorithm to obtain a first encryption result; using a private key of an asymmetric key to encrypt the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time for a second time to obtain a second encryption result; generating a token according to the encryption result, including: generating a token according to the second encryption result.

[0007] In one embodiment, before responding to a first request for obtaining a token sent by the cloud machine client and determining the cloud application key based on the cloud application identity in the first request, the method also includes: obtaining an asymmetric key and a symmetric encryption algorithm library version; receiving a second request for registering a cloud application sent by the cloud phone platform, the second request being sent after the cloud phone platform pushes the cloud application installation package to the cloud phone, the second request including the cloud application package name and the application signature; generating a cloud application identity and a cloud application key based on the cloud application package name and the application signature; and sending the public key of the asymmetric key and the symmetric encryption algorithm library to the cloud application server.

[0008] In one embodiment, after sending the token to the cloud phone client, the method also includes: receiving first verification information sent by the cloud application server, the first verification information including a first signature, a cloud application identity, and a token, the first signature being obtained by the cloud application server signing the cloud phone information, user identity information, a random number, and an application identity; verifying the token using the first verification information; and if the first verification information is successfully verified, sending verification success information and user identity information to the cloud application server, thereby causing the cloud application server to send the user identity information to the cloud application client, so that the cloud application client logs in to the cloud application based on the user identity information.

[0009] In one embodiment, the token is verified using the first verification information, including: using the public key in the asymmetric key to decrypt the token for the first time to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time; judging whether the token is expired based on the token expiration time and the current system time; if it is determined that the token is not expired, judging whether the random number is repeated; if the random number is not repeated, determining the application key based on the cloud application identity; determining the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; decrypting the first encryption result based on the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain user identity information; signing the application identification and the decrypted cloud phone information, user identity information, and random number to obtain a second signature; verifying whether the first signature and the second signature are consistent; if the first signature and the second signature are consistent, determining that the verification is successful.

[0010] In one embodiment, the method also includes: receiving a fourth request sent by the cloud application server to obtain an encryption algorithm library; determining a symmetric encryption algorithm library corresponding to a first version number corresponding to the fourth request; and sending the symmetric encryption algorithm library corresponding to the first version number to the cloud application server.

[0011] In one embodiment, before determining the cloud application key based on the cloud application identity in the first request, the method also includes: responding to a sixth request for cloud phone login authentication initiated by the cloud phone client, verifying the user identity information in the sixth request; when the user identity information is verified, responding to the first request for obtaining a token sent by the cloud machine client, determining the cloud application key based on the cloud application identity in the first request.

[0012] In the second aspect, an embodiment of the present application provides a cloud application login method, which is applied to a cloud phone client, and the method includes: receiving a first request for obtaining a token sent by the cloud application client; forwarding the first request to a cloud phone authentication center, so that the cloud phone authentication center determines the cloud application key based on the cloud application identity in the first request; encrypting the cloud phone information and the user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time to obtain an encryption result; generating a token based on the encryption result.

[0013] In one embodiment, before receiving a first request for obtaining a token sent by a cloud application client, the method further includes: sending a sixth request for cloud phone login authentication to a cloud phone authentication center, wherein the sixth request includes user identity information.

[0014] On the third aspect, an embodiment of the present application provides a cloud application login method, which is applied to a cloud application client, and the method includes: sending a first request to obtain a token to a cloud phone client; receiving the token sent by the cloud phone client; in response to the user's confirmation operation of logging into the cloud application, sending a third request for cloud application login carrying the token to the cloud application server, so that the cloud application server decrypts the token and obtains user identity information, and then the cloud application server sends the user identity information to the cloud application client; receiving the user identity information; and logging in to the cloud application according to the user identity information.

[0015] In one embodiment, after a third request for cloud application login carrying a token is sent to a cloud application server in response to a user's operation of confirming the login to the cloud application, the method also includes: in response to a user's operation of confirming the login to the cloud application, a third request for cloud application login carrying a token is sent to the cloud application server, so that the cloud application server decrypts the token to obtain cloud phone information, user identity information, a random number, and token expiration time; performs signature processing based on the cloud phone information, user identity information, random number, and cloud application identifier to obtain a first signature; sends first verification information including the first signature, cloud application identifier, and token to a cloud phone authentication center so that the cloud phone authentication center performs verification; if the verification by the cloud phone authentication center is successful, receives the user identity information sent by the cloud application server; and logs in to the cloud application based on the user identity information.

[0016] In the fourth aspect, an embodiment of the present application provides a cloud application login method, which is applied to a cloud application server, including: receiving a public key in an asymmetric key sent by a cloud phone authentication center and a symmetric encryption algorithm library version and a third request for cloud application login carrying a token sent by a cloud application client; obtaining a cloud application key corresponding to the cloud application server; using the cloud application key, symmetric encryption algorithm library version, symmetric encryption algorithm selector, asymmetric key, random number and token expiration time to decrypt the token to obtain user identity information; sending the user identity information to the cloud application client, so that the cloud application client logs in to the cloud application based on the user identity information.

[0017] In one embodiment, the token is decrypted using the cloud application key, symmetric encryption algorithm library version, symmetric encryption algorithm selector, asymmetric key, random number and token expiration time to obtain user identity information, including: decrypting the token using the public key in the asymmetric key to obtain the first encryption result, symmetric encryption algorithm library version, symmetric encryption algorithm selector, random number, token expiration time; determining the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; obtaining user identity information based on the decryption algorithm corresponding to the symmetric encryption algorithm, cloud application key decryption and the first encryption result.

[0018] In one embodiment, cloud phone information can be obtained by decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key; after obtaining the user identity information by decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key, the method also includes: performing signature processing according to the cloud phone information, user identity information, a random number and a cloud application identifier to obtain a first signature; sending first verification information including the first signature, the cloud application identifier and the token to a cloud phone authentication center so that the cloud phone authentication center performs verification; receiving the verification success information and user identity information sent by the cloud phone authentication center; sending the user identity information to the cloud application client so that the cloud application client logs in to the cloud application based on the user identity information.

[0019] In one embodiment, a symmetric encryption algorithm is determined based on a symmetric encryption algorithm library version and a symmetric encryption algorithm selector, including: determining whether a first version number corresponding to the symmetric encryption algorithm library version is consistent with a second version number corresponding to a current symmetric encryption algorithm library version; when the first version number is inconsistent with the second version number, sending a fourth request to a cloud phone authentication center to obtain the encryption algorithm library; when the symmetric encryption algorithm library corresponding to the first version number is received, determining the symmetric encryption algorithm in the symmetric encryption algorithm library corresponding to the first version number using a symmetric encryption algorithm selector; when the first version number is consistent with the second version number, determining the symmetric encryption algorithm in the current symmetric encryption algorithm library using a symmetric encryption algorithm selector.

[0020] In a fifth aspect, an embodiment of the present application provides a cloud application login device, which is applied to a cloud phone authentication center, and the device includes:

[0021] A first determination module, configured to respond to a first request for obtaining a token sent by a cloud client and determine a cloud application key according to a cloud application identity in the first request;

[0022] A second determination module is used to determine the symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector;

[0023] An encryption module, used to encrypt the cloud phone information and the user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time to obtain an encryption result;

[0024] A generation module, used for generating a token according to the secondary encryption result;

[0025] The sending module is used to send a token to the cloud phone client, so that the cloud phone client sends the token to the cloud application server, and then the cloud application server decrypts the token to obtain the user identity information, and sends the user identity information to the cloud application client, so that the cloud application client logs in to the cloud application based on the user identity information.

[0026] In a sixth aspect, an embodiment of the present application provides a cloud application login device, which is applied to a cloud phone client, and the device includes:

[0027] A first receiving module, configured to receive a first request for obtaining a token sent by a cloud application client;

[0028] A first sending module is used to forward the first request to a cloud phone authentication center, so that the cloud phone authentication center determines the cloud application key according to the cloud application identity in the first request; encrypts the cloud phone information and the user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time to obtain an encryption result; and generates a token according to the encryption result;

[0029] The second receiving module is used to receive the token returned by the cloud phone authentication center;

[0030] The second sending module is used to send a token to the cloud application server, so that the cloud application server can send the decrypted user identity information to the cloud application client, so that the cloud application client can log in to the cloud application based on the user identity information.

[0031] In a seventh aspect, an embodiment of the present application provides a cloud application login device, which is applied to a cloud application client, and the device includes:

[0032] A first sending module, used to send a first request for obtaining a token to a cloud phone client;

[0033] The first receiving module is used to receive the token sent by the cloud phone client;

[0034] A second sending module is used to send a third request for cloud application login carrying a token to the cloud application server in response to the user's operation of confirming logging into the cloud application, so that the cloud application server decrypts the token to obtain the user identity information, and then the cloud application server sends the user identity information to the cloud application client;

[0035] A second receiving module, used for receiving user identity information;

[0036] The login module is used to log in to the cloud application based on the user's identity information.

[0037] In an eighth aspect, an embodiment of the present application provides a cloud application login device, which is applied to a cloud application server, and the device includes:

[0038] A receiving module, used to receive the public key in the asymmetric key and the symmetric encryption algorithm library version sent by the cloud phone authentication center and the third request for cloud application login carrying the token sent by the cloud application client;

[0039] A determination module, used to obtain a cloud application key corresponding to the cloud application server;

[0040] A decryption module, used to decrypt the token using the cloud application key and the public key in the asymmetric key to obtain user identity information;

[0041] The sending module is used to send the user identity information to the cloud application client, so that the cloud application client can log in to the cloud application based on the user identity information.

[0042] In the ninth aspect, an embodiment of the present application provides a cloud application login device, the device comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the cloud application login method in the first aspect or any one of the embodiments of the first aspect; or implements the cloud application login method in the second aspect or any one of the embodiments of the second aspect; implements the cloud application login method in the third aspect or any one of the embodiments of the third aspect; implements the cloud application login method in the fourth aspect or any one of the embodiments of the fourth aspect.

[0043] In the tenth aspect, a computer-readable storage medium having computer program instructions stored thereon, wherein when the computer program instructions are executed by a processor, the cloud application login method in the first aspect or any one of the embodiments of the first aspect is implemented; or the cloud application login method in the second aspect or any one of the embodiments of the second aspect is implemented; the cloud application login method in the third aspect or any one of the embodiments of the third aspect is implemented; or the cloud application login method in the fourth aspect or any one of the embodiments of the fourth aspect is implemented.

[0044] In the eleventh aspect, an embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes a cloud application login method such as the first aspect or any one of the embodiments of the first aspect; or a cloud application login method such as the second aspect or any one of the embodiments of the second aspect; or a cloud application login method such as the third aspect or any one of the embodiments of the third aspect; or a cloud application login method such as the fourth aspect or any one of the embodiments of the fourth aspect.

[0045] The cloud application login method, device, equipment and computer storage medium of the embodiment of the present application can encrypt the user identity information twice after the first authentication of the user identity information to generate a unified token for identity authentication. When the cloud application obtains the token in an active or passive manner, the token can be decrypted to obtain the user identity information, and can log in based on the identity information, providing convenience for the user to log in to the cloud application. In addition, the user identity information can be first encrypted by combining the application key corresponding to the cloud application with the encryption algorithm, so that only the corresponding cloud application can decrypt it, thereby ensuring the confidentiality and security of the data. Further, the user identity information, encryption algorithm, random number and token expiration time after the initial encryption are encrypted twice by the private key in the asymmetric key, so as to enhance the confidentiality and security of the data. In addition, the random number and token expiration time in the second encryption can be used to avoid short-term and long-term replay attacks, further improving the confidentiality and security of the data, thereby ensuring the data security of the user in the process of conveniently logging in to the cloud application and avoiding data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A schematic diagram of a cloud application login method provided by an embodiment of the present application is shown;

[0048] Figure 2 A schematic diagram of a process flow of another cloud application login method provided by an embodiment of the present application is shown;

[0049] Figure 3 A schematic diagram of a process flow of another cloud application login method provided by an embodiment of the present application is shown;

[0050] Figure 4 is a structural diagram of a cloud application login device provided by another embodiment of the present application;

[0051] Figure 5 is a structural diagram of a cloud application login device provided by another embodiment of the present application;

[0052] Figure 6 is a structural diagram of a cloud application login device provided by another embodiment of the present application;

[0053] Figure 7 is a structural diagram of a cloud application login device provided by another embodiment of the present application;

[0054] Figure 8 It is a structural diagram of a cloud application login device provided by yet another embodiment of the present application. DETAILED DESCRIPTION

[0055] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0056] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0057] As technologies such as cloud computing and big data mature, cloud applications are gradually entering the public eye. More and more companies and users are aware of the superiority of cloud applications, and the use of cloud applications is becoming more and more popular. In related technologies, you can log in to a cloud phone and enter the cloud phone interface, where the cloud phone interface may include one or more cloud application controls. When a user clicks on a cloud application control, the corresponding cloud application can be started. Alternatively, in related technologies, after logging into the H5 page of a cloud application, which is a web page developed based on the Hyper Text Markup Language version 5 (HTML5) technology, the user can directly enter the cloud phone and enable the corresponding cloud application.

[0058] However, after logging into the cloud phone with authentication information, users often need to authenticate and log in again when they need to start the cloud application in the cloud phone. Alternatively, after entering the cloud application through the H5 page for logging into the cloud application, if the cloud application requires logging in, the user still needs to enter the authentication information again. Based on the above cloud application login process, users are required to enter authentication information multiple times before they can log in to the cloud application. The operation is cumbersome, which brings inconvenience to users and affects the user experience.

[0059] In the related technology, in the real machine environment, the application can quickly obtain a number through the operator network based on the Subscriber Identity Module (SIM) card. After the user confirms the number, he can log in to obtain the number and complete the quick login. However, in the cloud phone environment, the hardware is virtualized and there is no corresponding physical SIM card. Therefore, it is impossible to complete the quick number authentication through the operator network.

[0060] In addition, in a real machine environment, you can log in through third-party applications. However, in a cloud phone environment, virtualized environment risk control is required. Therefore, third-party applications are usually not available for login authorization in a cloud phone environment.

[0061] Therefore, how to log in to cloud applications quickly and conveniently has become a technical problem that needs to be solved urgently by relevant technical personnel.

[0062] In order to solve the problems of the prior art, the embodiments of the present application provide a cloud application login method, device, equipment and computer storage medium. The cloud application login method provided by the embodiments of the present application is first introduced below.

[0063] Figure 1 A flowchart of a cloud application login method provided by an embodiment of the present application is shown.

[0064] like Figure 1 As shown, the cloud application login method includes the following steps:

[0065] S101. The cloud application client sends a first request for obtaining a token to the cloud phone client.

[0066] S102. The cloud phone client forwards the first request to the cloud phone authentication center.

[0067] S103: The cloud phone authentication center determines the cloud application key according to the cloud application identity in the first request.

[0068] S104. The cloud phone authentication center encrypts the cloud phone information and user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number and the token expiration time to obtain an encryption result.

[0069] S105. The cloud phone authentication center generates a token according to the encryption result.

[0070] S106. The cloud phone authentication center sends a token to the cloud phone client.

[0071] S107. The cloud phone client sends a token to the cloud application client.

[0072] S108: In response to the user's operation of confirming logging into the cloud application, the cloud application client sends a third request for cloud application login carrying the token to the cloud application server.

[0073] S109: The cloud application server obtains the cloud application key corresponding to the cloud application server.

[0074] S110. Decrypt the token using the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain the user identity information.

[0075] S111. The cloud application server sends the user identity information to the cloud application client.

[0076] S112: The cloud application client logs in to the cloud application according to the user identity information.

[0077] In some embodiments, in S101 , the cloud application client may send a first request to the cloud phone client, wherein the first request may be used to obtain a token.

[0078] In some optional embodiments, before sending the first request to the cloud phone client, the cloud phone client may also send a sixth request to the cloud phone authentication center. The sixth request may be used to request the cloud phone authentication center to perform cloud phone login authentication. In one example, the cloud phone client may send the sixth request to the cloud phone authentication center after receiving the user's cloud phone login operation.

[0079] In the embodiment of the present application, the sixth request may include user identity information. The user identity information may be information required when logging into a cloud application. In one example, the cloud phone client may send the authentication information entered by the user to the cloud phone authentication center.

[0080] In an embodiment of the present application, a cloud phone client may include a cloud phone front end. Among them, the cloud phone front end can be used to receive user identity information input by the user, and the user identity information can be used to log in to the cloud phone. For example, the user identity information may include authentication information entered by the user. Furthermore, a software development kit (SDK) can be embedded in the cloud phone front end as an end-side agent to achieve communication between the cloud phone client and the remote virtual cloud phone. It is understandable that a corresponding application is installed in the remote virtual cloud phone as a cloud-side agent, which communicates with the end-side agent of the cloud phone client through the cloud-side agent, thereby establishing a connection between the cloud phone client and the cloud application.

[0081] In some optional embodiments, after receiving the sixth request sent by the cloud phone client, the cloud phone authentication center may verify the user identity information in the sixth request.

[0082] In the embodiment of the present application, the cloud phone authentication platform can be used to authenticate the user identity and provide identity authentication services to third-party partners, such as cloud applications. In addition, the cloud phone authentication center can also be used to generate tokens, where the tokens can be used to store and verify user identity information.

[0083] In an embodiment of the present application, the cloud phone authentication center can verify the user identity information in the sixth request. If the verification is successful, the cloud phone client can log in to the cloud phone interface. In one example, the cloud phone authentication center can return the user identity information and authentication parameters to the cloud phone client when the user identity information is verified. Upon receiving the user identity information and authentication parameters, the cloud phone client can send a fifth request to the cloud phone platform to obtain the cloud phone information, wherein the fifth request may include authentication parameters. Upon receiving the fifth request, the cloud phone platform can authenticate the authentication parameters in the fifth request through the cloud phone authentication center, and if the authentication is successful, the cloud phone platform can return the cloud phone information to the cloud phone client. The cloud phone client can log in to the cloud phone interface based on the user identity information and the cloud phone information. Among them, the cloud phone platform can be a cloud phone business platform, which can be used to process cloud phone operation data and business data, and connect with third-party partners at the same time.

[0084] Furthermore, it is understandable that the cloud phone authentication center and the cloud phone platform can be located at the cloud phone server. Moreover, the cloud phone platform and the cloud phone authentication center can communicate with the cloud phone client via HyperText Transfer Protocol (HTTP).

[0085] In some embodiments, in S101, the cloud application client may send a first request to the cloud phone client to obtain a token when the user clicks on the cloud application control in the cloud phone or the user logs in to the H5 page corresponding to the cloud application. The first request may be a request to obtain a token from the cloud phone client, and the first request may include a cloud application identity, i.e., a cloud application ID. The cloud application client may be an application provided by a third-party partner running in the cloud phone.

[0086] In the embodiment of the present application, the cloud application client can establish communication with the cloud side proxy, and then send the first request to the cloud phone client through the cloud side proxy. In one example, when the cloud application client logs in to the cloud application by the user, the cloud side proxy can send the first request to the cloud side proxy. When the cloud side proxy receives the first request, it can forward the first request to the end-side proxy, so that after receiving the first request, the cloud phone client can integrate the application ID corresponding to the first request and the cloud phone identity identifier to obtain the first request with the application ID and the cloud phone identity identifier.

[0087] Among them, the communication between the cloud application client and the cloud-side proxy can be established in the following ways: the cloud-side proxy establishes a TCP server, and the cloud application client connects to the cloud-side proxy through a socket; the cloud-side proxy establishes a binder service, and the cloud application client communicates through the binder inter-process communication binding service; the cloud-side proxy calls up the cloud application through the scheme protocol and carries parameters in the scheme protocol address.

[0088] In some embodiments, in S102, after receiving the first request sent by the cloud application client, the cloud phone client may forward the first request to the cloud phone authentication center. In one example, the cloud phone client may send the first request after information integration to the cloud phone authentication center. The communication process between the cloud phone client and the cloud phone authentication center is consistent with the above process and will not be repeated here.

[0089] In some embodiments, in S103, the cloud phone authentication center can receive the first request for obtaining a token sent by the cloud phone client when the user identity information is verified, that is, when the cloud phone is successfully logged in. And determine the cloud application key according to the cloud application identity in the first request. There is a corresponding relationship between the cloud application identity and the cloud application key.

[0090] In an embodiment of the present application, to ensure that the cloud phone authentication center can obtain the corresponding cloud application key based on the cloud application identity, before the cloud phone authentication center determines the cloud application key according to the cloud application identity in the first request, the cloud phone authentication center needs to determine the cloud application existing in the cloud phone and establish a corresponding relationship between the cloud application ID of the cloud application and the cloud application key.

[0091] In the embodiment of the present application, the cloud phone authentication center can generate an asymmetric key and a symmetric encryption algorithm library. The asymmetric key may include a public key and a private key. The private key may be used to represent the current cloud phone platform environment; the public key may be used to identify the real machine environment or other cloud phone platform environments. The symmetric encryption algorithm library may be a symmetric encryption algorithm library of multiple versions.

[0092] In an embodiment of the present application, the cloud phone authentication center can obtain an asymmetric key and obtain a version of a symmetric encryption algorithm library corresponding to the encryption operation. After the cloud phone platform pushes the cloud application installation package to the cloud phone, and the cloud phone authentication center receives the second request for registering the cloud application sent by the cloud phone platform, the cloud phone authentication center can generate a cloud application identity and a cloud application key corresponding to the cloud application identity based on the cloud application package name and the cloud application signature. Among them, the second request may include the cloud application package name and the cloud application signature. Furthermore, the cloud phone authentication center may send the public key in the obtained asymmetric key and the symmetric encryption algorithm library to the cloud application server. Among them, the symmetric encryption algorithm library may be a symmetric encryption algorithm library with a version number.

[0093] In one example, after a third-party partner, such as a cloud application developer, sends a request to the cloud phone platform to apply for cloud application, the cloud phone platform can push the cloud application installation package to the cloud phone. After the cloud phone installs the cloud application, the cloud phone platform can register the cloud application with the cloud phone authentication center. The request to register the cloud application can include information such as the package name of the cloud application and the cloud application signature. The cloud phone authentication center can generate a cloud application ID and a cloud application key based on the package name of the cloud application and the cloud application signature, and return the cloud application ID and the cloud application key to the cloud phone platform. The cloud phone platform can send the cloud application ID, the cloud application key, and the public key in the asymmetric key to the third-party partner. In addition, the cloud phone authentication center can also send the public key in the asymmetric key and the encryption algorithm library to the cloud application server.

[0094] In an embodiment of the present application, cloud applications are registered by obtaining the cloud application during the process of installing the cloud application on the cloud phone, thereby ensuring that each cloud application in the cloud phone has a corresponding cloud phone identity and a corresponding cloud application key in the cloud phone authentication center. Therefore, when the corresponding cloud application needs to be encrypted, the corresponding cloud application key can be determined based on the cloud application identity corresponding to the cloud application, and then encryption is performed based on the cloud application key, ensuring that only the correct cloud application can effectively decrypt during decryption, thereby ensuring that data will not be leaked during transmission, effectively ensuring data security.

[0095] In some embodiments, in S104, the cloud phone authentication center may encrypt the cloud phone information and user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time to obtain an encryption result.

[0096] Exemplarily, the symmetric encryption algorithm library version may be the version number of the symmetric encryption algorithm library used for encryption. The symmetric encryption algorithm library may be pre-stored in the cloud phone authentication center by relevant technical personnel. The symmetric encryption algorithm selector may be used to determine the encryption algorithm used to encrypt the cloud phone information and user identity information from the symmetric encryption algorithm library. In one example, the cloud phone authentication center may determine the symmetric encryption algorithm selector by a random algorithm.

[0097] Exemplarily, the random number can be used for signing to prevent replay attacks. In one example, the random number can be a set of digital sequences generated by the cloud phone authentication center through a random process or a random algorithm. The token expiration time is used to specify the validity period of the token. Among them, the token expiration time can also include the generation time to better determine the timeliness of the token.

[0098] In some embodiments, in S105, the cloud phone authentication center generates a token based on the encryption result.

[0099] Exemplarily, the cloud phone authentication center can process the cloud phone information and user identity information encrypted by the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time to obtain a token.

[0100] In some embodiments, in S106, the cloud phone authentication center may send a token to the cloud phone client. In S107, the cloud phone client receives the token returned by the cloud phone authentication center and sends the token to the cloud application client.

[0101] Among them, the data interaction process between the cloud phone authentication center and the cloud phone client and the interaction process between the cloud phone client and the cloud application server support are the same as those in the above embodiment and will not be elaborated here.

[0102] In some embodiments, in S108, the cloud application client receives the token sent by the cloud phone client. After receiving the token, the cloud application client sends a third request to the cloud application server in response to the user's confirmation operation of logging into the cloud application. The third request can be used to request logging into the cloud application, and the third request carries the token.

[0103] In the embodiment of the present application, when the cloud application client receives the token, it can display a control in the cloud application interface to the user to confirm whether to log in. For example, when the cloud application client receives the token, it can display a pop-up window to prompt the user to confirm logging in to the cloud application. When the user confirms logging in to the cloud application, the cloud application client can send a third request for cloud application login carrying the token to the cloud application server.

[0104] In some embodiments, the cloud application server may receive a third request for cloud application login carrying a token sent by the cloud application client.

[0105] In the embodiment of the present application, before the cloud application server receives the third request, it can receive the public key in the asymmetric key and the symmetric encryption algorithm library sent by the cloud phone authentication center, so that the cloud application server can decrypt the token in the third request based on the public key in the asymmetric key and the symmetric encryption algorithm library received.

[0106] In some embodiments, in S109, the cloud application server obtains the corresponding cloud application key, wherein the cloud application server stores the cloud application identity corresponding to the cloud application.

[0107] In some embodiments, in S110, the cloud application server may use the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to decrypt the token to obtain the user identity information.

[0108] Exemplarily, the cloud application server may use the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to decrypt the token to obtain identity information.

[0109] In some embodiments, in S111, the cloud application server may send the user identity information to the cloud application client. And in S112, the cloud application client may receive the user identity information and log in to the cloud application according to the received user identity information.

[0110] In the embodiment of the present application, the user identity information can be encrypted using the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time to generate a unified token for identity authentication. When the cloud application obtains the token in an active or passive manner, the token can be decrypted to obtain the user identity information, and can log in based on the identity information, providing convenience for the user to log in to the cloud application. In addition, the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time can ensure the data security of the user in the process of logging in to the cloud application and avoid data leakage.

[0111] Furthermore, in order to ensure the data security of users when logging into cloud applications, as another implementation method in the embodiments of the present application, the present application also provides another implementation method of the cloud application login method, please refer to the following embodiments for details.

[0112] Figure 2 FIG. 1 is a flow chart showing a cloud application login method provided by another embodiment of the present application. Figure 2 As shown, the cloud application login method includes the following steps:

[0113] S201. The cloud application client sends a first request for obtaining a token to the cloud phone client.

[0114] S202. The cloud phone client forwards the first request to the cloud phone authentication center.

[0115] S203: The cloud phone authentication center determines the cloud application key according to the cloud application identity in the first request.

[0116] S204. The cloud phone authentication center determines the symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector.

[0117] S205. The cloud phone authentication center uses the cloud application key and the symmetric encryption algorithm to encrypt the cloud phone information and user identity information once to obtain the first encryption result.

[0118] S206. The cloud phone authentication center uses the private key of the asymmetric key to perform a second encryption on the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain a second encryption result.

[0119] S207. The cloud phone authentication center generates a token based on the second encryption result.

[0120] S208. The cloud phone authentication center sends a token to the cloud phone client.

[0121] S209: The cloud phone client sends a token to the cloud application client.

[0122] S210: In response to the user's operation of confirming logging into the cloud application, the cloud application client sends a third request for cloud application login carrying a token to the cloud application server.

[0123] S211. The cloud application server uses the public key in the asymmetric key to decrypt the token and obtains the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time.

[0124] S212: The cloud application server obtains the corresponding cloud application key.

[0125] S213. The cloud application server determines the symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector.

[0126] S214. The cloud application server decrypts the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information.

[0127] S215. The cloud application server sends the user identity information to the cloud application client.

[0128] S216: The cloud application client logs in to the cloud application according to the user identity information.

[0129] Among them, steps S201-S203 are consistent with steps S101-S103, steps S208-S210 are consistent with steps S106-S108, and steps S215-S216 are consistent with steps S111-S112, which will not be described in detail here.

[0130] In some embodiments, in S204, the cloud phone authentication center may determine the symmetric encryption algorithm based on the encryption algorithm library version and the symmetric encryption algorithm selector.

[0131] In an embodiment of the present application, the cloud phone authentication center can determine the target encryption algorithm library according to the version number of the encryption algorithm library, and use the symmetric encryption algorithm selector to determine the symmetric encryption algorithm in the target encryption algorithm library.

[0132] In some embodiments, in S205, the cloud phone authentication center may use the cloud application key and the symmetric encryption algorithm to encrypt the cloud phone information and the user identity information once to obtain a first encryption result.

[0133] In some embodiments, in S206, the cloud phone authentication center can use the private key of the asymmetric key to perform a second encryption on the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time to obtain a second encryption result.

[0134] The random number can be used for signing to prevent replay attacks. In one example, the random number can be a set of digital sequences generated by the cloud phone authentication center through a random process or a random algorithm. The token expiration time is used to specify the validity period of the token. The token expiration time can also include the generation time to better determine the timeliness of the token.

[0135] In some embodiments, in S207, the cloud phone authentication center generates a token based on the second encryption result.

[0136] In an embodiment of the present application, the cloud phone authentication center can encrypt the user identity information and cloud phone information once through the cloud application key and the symmetric encryption algorithm, and use the private key in the asymmetric key to encrypt the user identity information and cloud phone information after the first encryption for a second time, so as to enhance the security during data transmission.

[0137] In some embodiments, in S211, the cloud application server can use the public key in the asymmetric key to decrypt the token in the third request to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time.

[0138] In an embodiment of the present application, after receiving the third request, the cloud application server can use the public key in the asymmetric key to decrypt the token in the third request to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time.

[0139] In the embodiment of the present application, before the cloud application server receives the third request, it can receive the public key in the asymmetric key and the symmetric encryption algorithm library sent by the cloud phone authentication center, so that the cloud application server can decrypt the token in the third request based on the public key in the asymmetric key and the symmetric encryption algorithm library received.

[0140] In some embodiments, in S212, the cloud application server obtains the corresponding cloud application key, wherein the cloud application server stores the cloud application identity corresponding to the cloud application.

[0141] In some embodiments, in S213, the cloud application server may determine the symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector after the first decryption.

[0142] In an embodiment of the present application, the cloud application server can determine the corresponding target encryption algorithm library based on the symmetric encryption algorithm library version obtained by decryption, and use the symmetric encryption algorithm selector to determine the symmetric encryption algorithm in the target encryption algorithm library.

[0143] In the embodiment of the present application, the cloud application server can determine whether the first version number corresponding to the decrypted symmetric encryption algorithm library version is consistent with the second version number corresponding to the symmetric encryption algorithm library version currently stored in the cloud application server. If it is determined that the first version number is inconsistent with the second version number, the cloud application server can send a fourth request to the cloud phone authentication center to obtain the encryption algorithm library, wherein the fourth request may include the first version number.

[0144] Furthermore, after receiving the fourth request for obtaining the encryption algorithm library sent by the cloud application server, the cloud phone authentication center can obtain the symmetric encryption algorithm library corresponding to the first version number in the fourth request, and send the symmetric encryption algorithm library corresponding to the first version number to the cloud application server.

[0145] Furthermore, when the cloud application server receives the symmetric encryption algorithm library corresponding to the first version number, the symmetric encryption algorithm selector can be used to determine the symmetric encryption algorithm in the symmetric encryption algorithm library corresponding to the first version number. If the cloud application server determines that the first version number is consistent with the second version number, the symmetric encryption algorithm selector can be directly used to determine the symmetric encryption algorithm in the current symmetric encryption algorithm library without sending a fourth request to the cloud phone authentication center.

[0146] In some embodiments, in S214, the cloud application server may decrypt the first encryption result according to a decryption algorithm corresponding to the symmetric encryption algorithm and a cloud application key to obtain user identity information.

[0147] In an embodiment of the present application, the cloud application server can determine the corresponding decryption algorithm based on the symmetric encryption algorithm, and use the decryption algorithm and the cloud application key to decrypt the first encryption result to obtain the user identity information.

[0148] In the embodiment of the present application, the user identity information can be encrypted twice to generate a unified token for identity authentication. When the cloud application obtains the token in an active or passive manner, the token can be decrypted to obtain the user identity information, and can log in based on the identity information, providing convenience for the user to log in to the cloud application. In addition, the user identity information can be first encrypted by combining the application key corresponding to the cloud application with the encryption algorithm, so that only the corresponding cloud application can decrypt it, thereby ensuring the confidentiality and security of the data. In addition, encryption with a private key can ensure the uniqueness of the cloud phone platform, that is, it can distinguish whether it is a specific cloud phone platform environment. In addition, the cloud phone information parameter token can distinguish whether it is a specific cloud phone environment. Further, the user identity information, encryption algorithm, random number and token expiration time after the initial encryption are encrypted twice by the private key in the asymmetric key, so as to enhance the confidentiality and security of the data. The random number and token expiration time in the second encryption can be used to avoid short-term and long-term replay attacks, further improve the confidentiality and security of the data, thereby ensuring the data security of the user in the process of logging in to the cloud application and avoiding data leakage.

[0149] In order to avoid data tampering and ensure the security and integrity of the token, as another implementation method in the embodiments of the present application, the present application also provides another implementation method of the cloud application login method, please refer to the following embodiments for details.

[0150] Figure 3 FIG. 1 is a flow chart showing another cloud application login method provided by an embodiment of the present application. Figure 3 As shown, after decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information, the cloud application login method further includes the following steps:

[0151] S217. The cloud application server performs signature processing according to the cloud phone information, user identity information, random number and cloud application identifier to obtain a first signature.

[0152] S218. The cloud application server sends the first verification information including the first signature, the cloud application identifier and the token to the cloud phone authentication center.

[0153] S219. The cloud phone authentication center verifies the token using the first verification information.

[0154] S220. When the first verification information is successfully verified, the cloud phone authentication center sends a verification success message and user identity information to the cloud application server.

[0155] S215. The cloud application server sends the user identity information to the cloud application client.

[0156] S216: The cloud application client logs in to the cloud application according to the user identity information.

[0157] In some embodiments, in S217, the cloud application server may perform a signature process on the decrypted cloud phone information, user identity information, random number, and cloud application identifier to obtain a first signature.

[0158] In the embodiment of the present application, the cloud application server can also obtain the cloud phone information by decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key. Further, the cloud phone information, user identity information, random number and cloud application identifier can be used for signature processing to obtain the first signature.

[0159] In some embodiments, in S218, the cloud application server may send first verification information including the first signature, the cloud application identifier, and the token to the cloud phone authentication center. Further, in S219, the cloud phone authentication center receives the first verification information sent by the cloud application server, and uses the first verification information to verify the token.

[0160] In an embodiment of the present application, after receiving the first verification information, the cloud phone authentication center can use the public key in the asymmetric key to decrypt the token in the first verification information for the first time, and obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time. And record the decrypted random number. Further, the cloud phone authentication center determines whether the token is expired according to the token expiration time and the current system time. If it is determined that the token is not expired, it is determined whether the random number is repeated with the random number of the historical record. If the random number is not repeated, the application key is determined according to the cloud application identity. And according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector, the symmetric encryption algorithm is determined. Further, the first encryption result can be decrypted according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information. And the cloud application identity and the decrypted cloud phone information, user identity information, and random number are signed to obtain a second signature. The cloud phone authentication center can verify whether the first signature and the second signature are consistent. If the first signature and the second signature are consistent, it is determined that the verification is successful.

[0161] In the embodiment of the present application, by determining whether the first signature and the second signature are consistent, it is possible to determine whether the data has been tampered with during transmission, thereby better ensuring the security of the user logging into the cloud phone.

[0162] In some embodiments, in S220, when the first verification information is successfully verified, the cloud phone authentication center can send verification success information and user identity information to the cloud application server. Further, in S215, the cloud application server can receive the verification success information and user identity information sent by the cloud phone authentication center, and send the user identity information to the cloud application client. Furthermore, in S216, after receiving the user identity information sent by the cloud application server, the cloud application client can log in to the cloud application according to the user identity information.

[0163] In an embodiment of the present application, before the cloud application server sends the user identity information to the cloud application client, the user identity information can be verified by obtaining a signature, thereby preventing the user identity information from being tampered with during transmission, thereby ensuring the integrity of the user identity information.

[0164] Based on the cloud application login method provided in the above embodiment, the present application also provides a specific implementation of a cloud application login device. Please refer to the following embodiment.

[0165] See first Figure 4 The cloud application login device 400 applied to the cloud phone authentication center provided in the embodiment of the present application includes the following units:

[0166] The first determination module 401 is used to respond to a first request for obtaining a token sent by the cloud client and determine a cloud application key according to a cloud application identity in the first request.

[0167] The second determination module 402 is used to determine the symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector.

[0168] The encryption module 403 is used to encrypt the cloud phone information and user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time to obtain an encryption result.

[0169] The generating module 404 is used to generate a token according to the secondary encryption result.

[0170] Sending module 405 is used to send a token to the cloud phone client, so that the cloud phone client sends the token to the cloud application server, and then the cloud application server decrypts the token to obtain the user identity information, and sends the user identity information to the cloud application client, so that the cloud application client logs in to the cloud application based on the user identity information.

[0171] In the embodiment of the present application, the encryption module 403 encrypts the cloud phone information and the user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time in the following manner to obtain an encryption result: determine the symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; use the cloud application key and the symmetric encryption algorithm to encrypt the cloud phone information and the user identity information once to obtain a first encryption result; use the private key of the asymmetric key to encrypt the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time for a second time to obtain a second encryption result; the generation module 404 generates a token according to the encryption result in the following manner: generate a token according to the second encryption result.

[0172] In the embodiment of the present application, the cloud application login device 400 also includes a receiving module 406, which is used to receive the first verification information sent by the cloud application server. The first verification information includes a first signature, a cloud application identity, and a token. The first signature is obtained by the cloud application server signing the cloud phone information, the user identity information, the random number, and the application identity. The verification module 407 is used to verify the token using the first verification information. The sending module 405 is also used to send the verification success information and the user identity information to the cloud application server when the first verification information is successfully verified, so that the cloud application server sends the user identity information to the cloud application client, so that the cloud application client logs in to the cloud application based on the user identity information.

[0173] In an embodiment of the present application, the verification module 407 verifies the token using the first verification information in the following manner: use the public key in the asymmetric key to decrypt the token for the first time to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time; record the random number; determine whether the token is expired based on the token expiration time and the current system time; if it is determined that the token is not expired, determine whether the random number is repeated with the random number in the historical record; if the random number is not repeated, determine the application key based on the cloud application identity; determine the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; decrypt the first encryption result based on the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain user identity information; sign the cloud application identity and the decrypted cloud phone information, user identity information, and random number to obtain a second signature; verify whether the first signature and the second signature are consistent; if the first signature and the second signature are consistent, determine that the verification is successful.

[0174] In the embodiment of the present application, the receiving module 406 is also used to receive a fourth request sent by the cloud application server to obtain the encryption algorithm library. The cloud application login device 400 also includes a third determination module 409, which is used to determine the symmetric encryption algorithm library corresponding to the first version number corresponding to the fourth request. The sending module 405 is also used to send the symmetric encryption algorithm library corresponding to the first version number to the cloud application server.

[0175] Furthermore, the present application also provides a specific implementation of a cloud application login device 500 applied to a cloud phone client. Please refer to the following embodiments.

[0176] See first Figure 5 The cloud application login device 500 applied to the cloud phone client provided in the embodiment of the present application includes the following units:

[0177] The first receiving module 501 is used to receive a first request for obtaining a token sent by a cloud application client.

[0178] The first sending module 502 is used to forward the first request to the cloud phone authentication center, so that the cloud phone authentication center determines the cloud application key according to the cloud application identity in the first request. The cloud phone information and the user identity information are encrypted according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time to obtain an encryption result; and a token is generated according to the encryption result.

[0179] The second receiving module 503 is used to receive the token returned by the cloud phone authentication center.

[0180] The second sending module 504 is used to send a token to the cloud application server, so that the cloud application server can send the decrypted user identity information to the cloud application client, so that the cloud application client can log in to the cloud application based on the user identity information.

[0181] Furthermore, the present application also provides a specific implementation of a cloud application login device 600 applied to a cloud application client. Please refer to the following embodiments.

[0182] See first Figure 6 The cloud application login device 600 applied to the cloud application client provided in the embodiment of the present application includes the following units:

[0183] The first sending module 601 is used to send a first request for obtaining a token to the cloud phone client.

[0184] The first receiving module 602 is used to receive the token sent by the cloud phone client.

[0185] The second sending module 603 is used to respond to the user's confirmation operation of logging into the cloud application, and send a third request for cloud application login carrying a token to the cloud application server, so that the cloud application server decrypts the token to obtain the user identity information, and then the cloud application server sends the user identity information to the cloud application client.

[0186] The second receiving module 604 is used to receive user identity information.

[0187] The login module 605 is used to log in to the cloud application according to the user identity information.

[0188] In an embodiment of the present application, the second sending module 603 is also used to respond to the user's confirmation operation of logging into the cloud application, and send a third request for cloud application login carrying a token to the cloud application server, so that the cloud application server decrypts the token to obtain cloud phone information, user identity information, random number and token expiration time; performs signature processing based on the cloud phone information, user identity information, random number and cloud application identification to obtain a first signature; sends the first verification information including the first signature, cloud application identification and token to the cloud phone authentication center, so that the cloud phone authentication center can perform verification. The second receiving module 604 is also used to receive the user identity information sent by the cloud application server when the cloud phone authentication center successfully verifies. The login module 605 is also used to log in to the cloud application based on the user identity information.

[0189] Furthermore, the present application also provides a specific implementation of a cloud application login device 700 applied to a cloud application server. Please refer to the following embodiments.

[0190] See first Figure 7 The cloud application login device 700 applied to the cloud application server provided in the embodiment of the present application includes the following units:

[0191] The receiving module 701 is used for receiving a third request for cloud application login carrying a token sent by a cloud application client.

[0192] The acquisition module 702 is used to acquire the cloud application key corresponding to the cloud application server.

[0193] The decryption module 703 is used to decrypt the token using the cloud application key to obtain user identity information.

[0194] The sending module 704 is used to send the user identity information to the cloud application client, so that the cloud application client can log in to the cloud application based on the user identity information.

[0195] In the embodiment of the present application, the cloud phone information can also be obtained by decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key.

[0196] In an embodiment of the present application, the decryption module 703 uses the cloud application key to decrypt the token in the following manner to obtain user identity information: use the public key in the asymmetric key to decrypt the token to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time; determine the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; obtain the user identity information based on the decryption algorithm corresponding to the symmetric encryption algorithm, the cloud application key decryption, and the first encryption result.

[0197] The cloud application login device 700 also includes a verification module 705. After decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information, the verification module 705 is used to perform signature processing according to the cloud phone information, user identity information, random number and cloud application identifier to obtain a first signature; send the first verification information including the first signature, cloud application identifier and token to the cloud phone authentication center so that the cloud phone authentication center performs verification; receive the verification success information and user identity information sent by the cloud phone authentication center; send the user identity information to the cloud application client so that the cloud application client logs in to the cloud application based on the user identity information.

[0198] In an embodiment of the present application, the cloud application login device 700 also includes a determination module 704 for: determining the symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector: determining whether the first version number corresponding to the symmetric encryption algorithm library version is consistent with the second version number corresponding to the current symmetric encryption algorithm library version; when the first version number is inconsistent with the second version number, sending a fourth request to the cloud phone authentication center to obtain the encryption algorithm library; when receiving the symmetric encryption algorithm library corresponding to the first version number, using the symmetric encryption algorithm selector to determine the symmetric encryption algorithm in the symmetric encryption algorithm library corresponding to the first version number; when the first version number is consistent with the second version number, using the symmetric encryption algorithm selector to determine the symmetric encryption algorithm in the current symmetric encryption algorithm library.

[0199] The cloud application login device of the embodiment of the present application can encrypt the user identity information twice after the first authentication of the user identity information to generate a unified token for identity authentication. When the cloud application obtains the token in an active or passive manner, the token can be decrypted to obtain the user identity information, and can log in based on the identity information, providing convenience for the user to log in to the cloud application. In addition, the user identity information can be first encrypted by combining the application key corresponding to the cloud application with the encryption algorithm, so that only the corresponding cloud application can decrypt it, thereby ensuring the confidentiality and security of the data. Further, the user identity information, encryption algorithm, random number and token expiration time after the initial encryption are encrypted twice by the private key in the asymmetric key, so as to enhance the confidentiality and security of the data. In addition, the random number and token expiration time in the second encryption can be used to avoid short-term and long-term replay attacks, further improving the confidentiality and security of the data, thereby ensuring the data security of the user in the process of conveniently logging in to the cloud application and avoiding data leakage.

[0200] Figure 8 A schematic diagram of the hardware structure of the cloud application login provided in an embodiment of the present application is shown.

[0201] The cloud application login device may include a processor 801 and a memory 802 storing computer program instructions.

[0202] Specifically, the processor 801 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0203] The memory 802 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 802 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 802 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 802 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 802 is a non-volatile solid-state memory.

[0204] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0205] The processor 801 implements any one of the cloud application login methods in the above embodiments by reading and executing computer program instructions stored in the memory 802 .

[0206] In one example, the cloud application login device may further include a communication interface 803 and a bus 810. Figure 8 As shown, the processor 801, the memory 802, and the communication interface 803 are connected via a bus 810 and communicate with each other.

[0207] The communication interface 803 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0208] Bus 810 includes hardware, software or both, and the parts of online data flow billing equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front-end bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 810 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0209] The cloud application login device can be used by the user to perform the cloud application login operation in the cloud application login method in the embodiment of the present application, thereby realizing the combination of Figures 1 to 7 Described is a cloud application login method and device.

[0210] In addition, in combination with the cloud application login method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the cloud application login methods in the above embodiment is implemented.

[0211] The present embodiment also provides a computer program product, including a computer program, which, when executed, implements any one of the cloud application login methods in the above embodiments.

[0212] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0213] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0214] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0215] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0216] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A cloud application login method, characterized in that: Applied to a cloud phone authentication center, the method includes: In response to a first request for obtaining a token sent by a cloud phone client, determining a cloud application key according to a cloud application identity in the first request; Encrypt the cloud phone information and user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain an encryption result; Generate a token according to the encryption result; The token is sent to the cloud phone client so that the cloud phone client sends the token to the cloud application server, and the cloud application server decrypts the token based on the token to obtain the user identity information, and sends the user identity information to the cloud application client so that the cloud application client logs in to the cloud application based on the user identity information.

2. The method according to claim 1, characterized in that The cloud phone information and the user identity information are encrypted according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain an encryption result, including: Determine the symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; Encrypt the cloud phone information and the user identity information once using the cloud application key and the symmetric encryption algorithm to obtain a first encryption result; Using a private key of an asymmetric key, re-encrypt the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time to obtain a second encryption result; Generating a token according to the encryption result comprises: A token is generated according to the second encryption result.

3. The method according to any one of claims 1 to 2, characterized in that: After sending the token to the cloud phone client, the method further includes: Receive first verification information sent by the cloud application server, where the first verification information includes a first signature, the cloud application identity, and the token, where the first signature is obtained by the cloud application server by signing the cloud phone information, the user identity information, the random number, and the application identity; Verifying the token using the first verification information; When the first verification information is successfully verified, the verification success information and the user identity information are sent to the cloud application server, and then the cloud application server sends the user identity information to the cloud application client, so that the cloud application client logs in to the cloud application based on the user identity information.

4. The method according to claim 3, characterized in that The verifying the token by using the first verification information includes: Decrypting the token for the first time using the public key in the asymmetric key to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number and the token expiration time; Recording the random number; Determine whether the token is expired according to the token expiration time and the system current time; If it is determined that the token is not expired, determining whether the random number is the same as the random number in the historical record; When the random number is not repeated, determining the application key according to the cloud application identity; Determine a symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; Decrypt the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain user identity information; The cloud application identity and the decrypted cloud phone information, user identity information and random number are signed to obtain a second signature; Verifying whether the first signature and the second signature are consistent; When the first signature and the second signature are consistent, it is determined that the verification is successful.

5. A cloud application login method, characterized in that: Applied to a cloud phone client, the method includes: Receive a first request for obtaining a token sent by a cloud application client; Forwarding the first request to a cloud phone authentication center, so that the cloud phone authentication center determines the cloud application key according to the cloud application identity in the first request; encrypting the cloud phone information and the user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain an encryption result; generating a token according to the encryption result; Receive the token returned by the cloud phone authentication center; The token is sent to the cloud application server so that the cloud application server can send the decrypted user identity information to the cloud application client, so that the cloud application client can log in to the cloud application based on the user identity information.

6. A cloud application login method, characterized in that: Applied to a cloud application client, the method includes: Send the first request to obtain the token to the cloud phone client; Receive the token sent by the cloud phone client; In response to the user's operation of confirming logging into the cloud application, a third request for cloud application login carrying a token is sent to the cloud application server, so that the cloud application server decrypts the token to obtain user identity information, and then the cloud application server sends the user identity information to the cloud application client; receiving the user identity information; Log in to the cloud application according to the user identity information.

7. The method according to claim 6, characterized in that After sending a third cloud application login request carrying a token to the cloud application server in response to the user's operation of confirming logging into the cloud application, the method further includes: In response to the user's operation of confirming logging into the cloud application, a third request for cloud application login carrying a token is sent to the cloud application server, so that the cloud application server decrypts the token to obtain cloud phone information, user identity information, a random number, and token expiration time; a signature process is performed according to the cloud phone information, the user identity information, the random number, and the cloud application identifier to obtain a first signature; and first verification information including the first signature, the cloud application identifier, and the token is sent to a cloud phone authentication center so that the cloud phone authentication center performs verification; If the cloud phone authentication center verifies successfully, receiving the user identity information sent by the cloud application server; Log in to the cloud application based on user identity information.

8. A cloud application login method, characterized in that: Applied to cloud application servers, including: receiving a third request for cloud application login carrying a token sent by a cloud application client; Obtaining a cloud application key corresponding to the cloud application server; Decrypt the token using the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain the user identity information; The user identity information is sent to the cloud application client, so that the cloud application client logs in to the cloud application based on the user identity information.

9. The method according to claim 8, characterized in that The cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number and the token expiration time are used to decrypt the token to obtain the user identity information, including: Decrypt the token using the public key in the asymmetric key to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time; Determine a symmetric encryption algorithm according to the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; The first encryption result is decrypted according to a decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain user identity information.

10. The method according to claim 9, characterized in that The cloud phone information can also be obtained by decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key; After decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information, the method further includes: Perform signature processing according to the cloud phone information, the user identity information, the random number, and the cloud application identifier to obtain a first signature; Sending first verification information including the first signature, the cloud application identifier, and the token to a cloud phone authentication center so that the cloud phone authentication center performs verification; Receiving verification success information and user identity information sent by the cloud phone authentication center; The user identity information is sent to the cloud application client, so that the cloud application client logs in to the cloud application based on the user identity information.

Images