A cloud application login method, apparatus, device, and computer storage medium

Abstract

This application discloses a cloud application login method, apparatus, device, and computer storage medium. The method includes: responding to a first request from a cloud client to obtain a token; determining a cloud application key based on the cloud application identity identifier in the first request; encrypting cloud phone information and user identity information using the cloud application key, a symmetric encryption algorithm library version, a symmetric encryption algorithm selector, an asymmetric key, a random number, and a token expiration time to obtain an encryption result; generating a token based on the encryption result; and sending the token to the cloud phone client, causing the cloud phone client to send the token to the cloud application server, thereby enabling the cloud application server to decrypt the token to obtain the user identity information and send the user identity information to the cloud application client, allowing the cloud application client to log in to the cloud application based on the user identity information. This application enables secure and convenient login to cloud applications.

Description

Technical Field

[0001] This application belongs to the field of cloud computing technology, and in particular relates to a cloud application login method, apparatus, device and computer storage medium. Background Technology

[0002] With the continuous development of technologies such as cloud computing and big data, cloud phones have gradually gained widespread recognition and use. Users log in to their cloud phone accounts on a client, enter the cloud phone interface, and perform corresponding operations to use the cloud phone.

[0003] With the continuous maturation and popularization of cloud phone technology, more and more applications are appearing on cloud phones, enriching their functionality and enhancing the user experience. However, after logging into a cloud phone, users often need to authenticate and log in again to launch a specific application, causing inconvenience. Therefore, how to quickly and conveniently log in to cloud applications has become a pressing technical problem for relevant engineers. Summary of the Invention

[0004] This application provides a cloud application login method, apparatus, device, and computer storage medium, which enables fast login to cloud applications.

[0005] In a first aspect, embodiments of this application provide a cloud application login method applied to a cloud phone authentication center. The method includes: responding to a first request from a cloud phone client to obtain a token; determining a cloud application key based on the cloud application identity identifier in the first request; encrypting cloud phone information and user identity information based on the cloud application key, a symmetric encryption algorithm library version, a symmetric encryption algorithm selector, a random number, and a token expiration time to obtain an encryption result; generating a token based on the encryption result; and sending the token to the cloud phone client so that the cloud phone client sends the token to the cloud application server, thereby enabling the cloud application server to decrypt the token to obtain user identity information and send the user identity information to the cloud application client so that the cloud application client can log in to the cloud application based on the user identity information.

[0006] In one implementation, encrypting cloud phone information and user identity information based on a cloud application key, a symmetric encryption algorithm library version, a symmetric encryption algorithm selector, a random number, and a token expiration time to obtain an encryption result includes: determining a symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; encrypting the cloud phone information and user identity information once using the cloud application key and the symmetric encryption algorithm to obtain a first encryption result; encrypting the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time a second time using the private key of the asymmetric key to obtain a second encryption result; and generating a token based on the encryption result, including generating a token based on the second encryption result.

[0007] In one implementation, before determining the cloud application key based on the cloud application identity identifier in the first request in response to a first request to obtain a token from a cloud client, the method further includes: obtaining an asymmetric key and a symmetric encryption algorithm library version; receiving a second request to register a cloud application from a cloud phone platform, the second request being sent after the cloud phone platform pushes the cloud application installation package to the cloud phone, the second request including the cloud application package name and application signature; generating a cloud application identity identifier and a cloud application key based on the cloud application package name and application signature; and sending the public key of the asymmetric key and the symmetric encryption algorithm library to the cloud application server.

[0008] In one embodiment, after sending a token to the cloud phone client, the method further includes: receiving first verification information sent by the cloud application server, the first verification information including a first signature, a cloud application identity identifier, and a token, wherein the first signature is obtained by the cloud application server through signature processing of cloud phone information, user identity information, a random number, and the application identity identifier; verifying the token using the first verification information; and, if the first verification information is successfully verified, sending verification success information and user identity information to the cloud application server, thereby causing the cloud application server to send the user identity information to the cloud application client, enabling the cloud application client to log in to the cloud application based on the user identity information.

[0009] In one implementation, verifying the token using the first verification information includes: decrypting the token for the first time using the public key in the asymmetric key to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time; determining whether the token has expired based on the token expiration time and the current system time; if the token has not expired, determining whether the random number is repeated; if the random number is not repeated, determining the application key based on the cloud application identity identifier; determining the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; decrypting the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain user identity information; signing the application identifier, the decrypted cloud phone information, the user identity information, and the random number to obtain a second signature; verifying whether the first signature and the second signature are consistent; and determining that the verification is successful if the first signature and the second signature are consistent.

[0010] In one embodiment, the method further includes: receiving a fourth request from a cloud application server to obtain an encryption algorithm library; determining the symmetric encryption algorithm library corresponding to the first version number of the fourth request; and sending the symmetric encryption algorithm library corresponding to the first version number to the cloud application server.

[0011] In one embodiment, before determining the cloud application key based on the cloud application identity identifier in the first request, the method further includes: in response to a sixth request for cloud phone login authentication initiated by the cloud phone client, verifying the user identity information in the sixth request; if the user identity information is verified successfully, in response to a first request to obtain a token sent by the cloud phone client, determining the cloud application key based on the cloud application identity identifier in the first request.

[0012] Secondly, embodiments of this application provide a cloud application login method applied to a cloud mobile client. The method includes: receiving a first request from the cloud application client to obtain a token; forwarding the first request to a cloud mobile authentication center, so that the cloud mobile authentication center determines a cloud application key based on the cloud application identity identifier in the first request; encrypting the cloud mobile information and the user identity information based on the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time to obtain an encryption result; and generating a token based on the encryption result.

[0013] In one implementation, before receiving the first request to obtain a token from the cloud application client, the method further includes: sending a sixth request for cloud phone login authentication to the cloud phone authentication center, the sixth request including user identity information.

[0014] Thirdly, embodiments of this application provide a cloud application login method applied to a cloud application client. The method includes: sending a first request to a cloud mobile client to obtain a token; receiving a token sent by the cloud mobile client; responding to a user's confirmation of logging into the cloud application, sending a third request carrying a token to a cloud application server to log in to the cloud application, so that the cloud application server decrypts the token to obtain user identity information, and then sends the user identity information to the cloud application client; receiving the user identity information; and logging into the cloud application based on the user identity information.

[0015] In one embodiment, after sending a third request for cloud application login carrying a token to the cloud application server in response to the user's confirmation of login to the cloud application, the method further includes: sending a third request for cloud application login carrying a token to the cloud application server in response to the user's confirmation of login to the cloud application, so that the cloud application server decrypts the token to obtain cloud phone information, user identity information, a random number, and token expiration time; performing signature processing based on the cloud phone information, user identity information, random number, and cloud application identifier to obtain a first signature; sending first verification information including the first signature, cloud application identifier, and token to the cloud phone authentication center for verification by the cloud phone authentication center; if the verification by the cloud phone authentication center is successful, receiving the user identity information sent by the cloud application server; and logging into the cloud application based on the user identity information.

[0016] Fourthly, this application provides a cloud application login method applied to a cloud application server, comprising: receiving a public key from an asymmetric key and a symmetric encryption algorithm library version sent by a cloud mobile phone authentication center, and a third request for cloud application login carrying a token sent by a cloud application client; obtaining a cloud application key corresponding to the cloud application server; decrypting the token using the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, a random number, and the token expiration time to obtain user identity information; and sending the user identity information to the cloud application client so that the cloud application client can log in to the cloud application based on the user identity information.

[0017] In one implementation, the token is decrypted using the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, a random number, and the token expiration time to obtain user identity information. This includes: decrypting the token using the public key in the asymmetric key to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time; determining the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; and obtaining the user identity information based on the decryption algorithm corresponding to the symmetric encryption algorithm, the cloud application key decryption, and the first encryption result.

[0018] In one implementation, the cloud phone information can be obtained by decrypting the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key. After obtaining the user identity information by decrypting the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key, the method further includes: performing signature processing based on the cloud phone information, user identity information, random number, and cloud application identifier to obtain a first signature; sending first verification information containing the first signature, cloud application identifier, and token to the cloud phone authentication center for verification; receiving verification success information and user identity information from the cloud phone authentication center; and sending the user identity information to the cloud application client to enable the cloud application client to log in to the cloud application based on the user identity information.

[0019] In one implementation, determining a symmetric encryption algorithm based on the symmetric encryption algorithm library version and a symmetric encryption algorithm selector includes: determining whether a first version number corresponding to the current symmetric encryption algorithm library version is consistent with a second version number corresponding to the current symmetric encryption algorithm library version; if the first version number and the second version number are inconsistent, sending a fourth request to the cloud phone authentication center to obtain the encryption algorithm library; if the symmetric encryption algorithm library corresponding to the first version number is received, determining the symmetric encryption algorithm in the symmetric encryption algorithm library corresponding to the first version number using the symmetric encryption algorithm selector; if the first version number and the second version number are consistent, determining the symmetric encryption algorithm in the current symmetric encryption algorithm library using the symmetric encryption algorithm selector.

[0020] Fifthly, embodiments of this application provide a cloud application login device applied to a cloud mobile phone authentication center, the device comprising:

[0021] The first determining module is used to respond to the first request to obtain a token sent by the cloud machine client and determine the cloud application key based on the cloud application identity identifier in the first request;

[0022] The second determining module is used to determine the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector;

[0023] The encryption module is used to encrypt the cloud phone information and the user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time, so as to obtain the encryption result;

[0024] The generation module is used to generate tokens based on the encryption result.

[0025] The sending module is used to send a token to the cloud mobile client, so that the cloud mobile client sends the token to the cloud application server, and then the cloud application server decrypts the token to obtain the user's identity information, and sends the user's identity information to the cloud application client, so that the cloud application client can log in to the cloud application based on the user's identity information.

[0026] Sixthly, embodiments of this application provide a cloud application login device for use with cloud mobile clients. The device includes:

[0027] The first receiving module is used to receive the first request for obtaining a token sent by the cloud application client;

[0028] The first sending module is used to forward the first request to the cloud phone authentication center, so that the cloud phone authentication center can determine the cloud application key based on the cloud application identity identifier in the first request; encrypt the cloud phone information and the user identity information according to the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time to obtain an encryption result; and generate a token based on the encryption result.

[0029] The second receiving module is used to receive the token returned by the cloud phone authentication center;

[0030] The second sending module is used to send a token to the cloud application server so that the cloud application server can send the decrypted user identity information to the cloud application client, enabling the cloud application client to log in to the cloud application based on the user identity information.

[0031] Seventhly, embodiments of this application provide a cloud application login device, applied to a cloud application client, the device comprising:

[0032] The first sending module is used to send a first request to the cloud mobile client to obtain a token;

[0033] The first receiving module is used to receive tokens sent by the cloud phone client;

[0034] The second sending module is used to respond to the user's confirmation of login to the cloud application by sending a third request for cloud application login carrying a token to the cloud application server, so that the cloud application server can decrypt the token, obtain the user's identity information, and then send the user's identity information to the cloud application client.

[0035] The second receiving module is used to receive user identity information;

[0036] The login module is used to log in to cloud applications based on user identity information.

[0037] Eighthly, embodiments of this application provide a cloud application login device, applied to a cloud application server, the device comprising:

[0038] The receiving module is used to receive the public key in the asymmetric key sent by the cloud phone authentication center, the version of the symmetric encryption algorithm library, and the third request for cloud application login carrying a token sent by the cloud application client.

[0039] The determination module is used to obtain the cloud application key corresponding to the cloud application server.

[0040] The decryption module is used to decrypt the token using the cloud application key and the public key in the asymmetric key to obtain user identity information;

[0041] The sending module is used to send user identity information to the cloud application client so that the cloud application client can log in to the cloud application based on the user identity information.

[0042] Ninthly, embodiments of this application provide a cloud application login device, the device comprising: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the cloud application login method of the first aspect or any embodiment of the first aspect; or implements the cloud application login method of the second aspect or any embodiment of the second aspect; implements the cloud application login method of the third aspect or any embodiment of the third aspect; or implements the cloud application login method of the fourth aspect or any embodiment of the fourth aspect.

[0043] Tenthly, a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the cloud application login method of the first aspect or any embodiment of the first aspect; or implement the cloud application login method of the second aspect or any embodiment of the second aspect; implement the cloud application login method of the third aspect or any embodiment of the third aspect; or implement the cloud application login method of the fourth aspect or any embodiment of the fourth aspect.

[0044] In the eleventh aspect, embodiments of this application provide a computer program product, wherein instructions in the computer program product, when executed by a processor of an electronic device, cause the electronic device to perform a cloud application login method as described in the first aspect or any embodiment of the first aspect; or a cloud application login method as described in the second aspect or any embodiment of the second aspect; a cloud application login method as described in the third aspect or any embodiment of the third aspect; or a cloud application login method as described in the fourth aspect or any embodiment of the fourth aspect.

[0045] The cloud application login method, apparatus, device, and computer storage medium of this application embodiment can encrypt the user's identity information twice after the initial authentication to generate a unified token for identity authentication. When the cloud application obtains the token actively or passively, it can decrypt the token to obtain the user's identity information and log in based on this information, providing convenience for users to log in to the cloud application. Furthermore, the user's identity information can be initially encrypted using the cloud application's corresponding application key combined with an encryption algorithm, ensuring that only the corresponding cloud application can decrypt it, thereby ensuring data confidentiality and security. Further, the initially encrypted user identity information, encryption algorithm, random number, and token expiration time are then encrypted a second time using the private key in an asymmetric key, further enhancing data confidentiality and security. Moreover, the random number and token expiration time in the second encryption can be used to prevent short-term and long-term replay attacks, further improving data confidentiality and security, thereby ensuring data security for users during convenient cloud application login and preventing data leakage. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 A flowchart illustrating a cloud application login method according to an embodiment of this application is shown;

[0048] Figure 2 A flowchart illustrating another cloud application login method provided in one embodiment of this application is shown;

[0049] Figure 3 A flowchart illustrating another cloud application login method provided in an embodiment of this application is shown;

[0050] Figure 4 This is a schematic diagram of the structure of a cloud application login device provided in another embodiment of this application;

[0051] Figure 5 This is a schematic diagram of the structure of a cloud application login device provided in another embodiment of this application;

[0052] Figure 6 This is a schematic diagram of the structure of a cloud application login device provided in another embodiment of this application;

[0053] Figure 7 This is a schematic diagram of the structure of a cloud application login device provided in another embodiment of this application;

[0054] Figure 8 This is a schematic diagram of the structure of a cloud application login device provided in another embodiment of this application. Detailed Implementation

[0055] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0056] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0057] With the gradual maturation of technologies such as cloud computing and big data, cloud applications are increasingly gaining public attention. More and more enterprises and users are recognizing the advantages of cloud applications, leading to their widespread adoption. One related technology allows users to log into a cloud phone and access its interface, which may include controls for one or more cloud applications. Clicking on these controls launches the corresponding cloud application. Alternatively, another technology allows users to log into a cloud application's H5 page (a webpage developed using Hyper Text Markup Language version 5, HTML5) and directly access the cloud phone and activate the corresponding cloud application.

[0058] However, after logging into the cloud phone with authentication information, users often need to authenticate and log in again to launch cloud applications within the cloud phone. Alternatively, after accessing a cloud application through an H5 page, if the application requires login, the user still needs to enter authentication information again. These cloud application login processes all require users to enter authentication information multiple times to log in, which is cumbersome, inconvenient, and negatively impacts the user experience.

[0059] In related technologies, in a physical device environment, applications can quickly retrieve a number via the carrier network based on the Subscriber Identity Module (SIM) card. After confirming the number, the user can log in and complete the number retrieval authentication quickly. However, in a cloud phone environment, the hardware is virtualized and there is no corresponding physical SIM card. Therefore, it is impossible to complete the quick number retrieval authentication via the carrier network.

[0060] Furthermore, in a physical device environment, login can be authorized through third-party applications. However, in a cloud phone environment, virtualization environment risk control measures are required; therefore, login via third-party applications is typically not possible in a cloud phone environment.

[0061] Therefore, how to quickly and conveniently log in to cloud applications has become a technical problem that relevant technical personnel urgently need to solve.

[0062] To address the problems of the prior art, embodiments of this application provide a cloud application login method, apparatus, device, and computer storage medium. The cloud application login method provided in this application embodiment will be described first below.

[0063] Figure 1 A flowchart illustrating a cloud application login method provided in one embodiment of this application is shown.

[0064] like Figure 1 As shown, the cloud application login method includes the following steps:

[0065] S101, The cloud application client sends the first request to the cloud mobile client to obtain a token.

[0066] S102, the cloud phone client forwards the first request to the cloud phone authentication center.

[0067] S103. The cloud phone authentication center determines the cloud application key based on the cloud application identity identifier in the first request.

[0068] S104. The cloud phone authentication center encrypts the cloud phone information and user identity information based on the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain the encryption result.

[0069] S105. The cloud phone authentication center generates a token based on the encryption result.

[0070] S106, The cloud phone authentication center sends a token to the cloud phone client.

[0071] S107, The cloud mobile client sends a token to the cloud application client.

[0072] S108. In response to the user's confirmation of logging into the cloud application, the cloud application client sends a third request carrying a token to the cloud application server for cloud application login.

[0073] S109. Obtain the cloud application key corresponding to the cloud application server.

[0074] S110. Use the cloud application key, symmetric encryption algorithm library version, symmetric encryption algorithm selector, asymmetric key, random number, and token expiration time to decrypt the token and obtain the user identity information.

[0075] S111, The cloud application server sends the user's identity information to the cloud application client.

[0076] S112. The cloud application client logs into the cloud application based on the user's identity information.

[0077] In some embodiments, in S101, the cloud application client may send a first request to the cloud mobile client, wherein the first request may be used to obtain a token.

[0078] In some optional embodiments, before sending the first request to the cloud phone client, the cloud phone client may also send a sixth request to the cloud phone authentication center. This sixth request can be used to request the cloud phone authentication center to perform cloud phone login authentication. In one example, the cloud phone client may send the sixth request to the cloud phone authentication center after receiving the user's cloud phone login operation.

[0079] In this embodiment of the application, the sixth request may include user identity information. This user identity information may be information required for cloud application login. In one example, the cloud phone client may send the authentication information entered by the user to the cloud phone authentication center.

[0080] In this embodiment, the cloud phone client may include a cloud phone front-end. The cloud phone front-end can receive user-inputted identity information, which can be used for cloud phone login. For example, the user-inputted identity information may include authentication information. Furthermore, a software development kit (SDK) can be embedded in the cloud phone front-end as an end-side proxy to enable communication between the cloud phone client and the remote virtual cloud phone. It is understood that the remote virtual cloud phone has a corresponding application installed as a cloud-side proxy, communicating with the end-side proxy of the cloud phone client through the cloud-side proxy, thereby establishing a connection between the cloud phone client and the cloud application.

[0081] In some optional embodiments, after receiving the sixth request sent by the cloud phone client, the cloud phone authentication center can verify the user identity information in the sixth request.

[0082] In this embodiment, the cloud phone authentication platform can be used to authenticate user identities and provide identity verification services to third-party partners, such as cloud applications. Furthermore, the cloud phone authentication center can also be used to generate tokens, which can be used to store and verify user identity information.

[0083] In this embodiment, the cloud phone authentication center can verify the user identity information in the sixth request. If the verification is successful, the cloud phone client can log in to the cloud phone interface. In one example, after successfully verifying the user identity information, the cloud phone authentication center can return the user identity information and authentication parameters to the cloud phone client. Upon receiving the user identity information and authentication parameters, the cloud phone client can send a fifth request to the cloud phone platform to obtain cloud phone information, where the fifth request may include authentication parameters. Upon receiving the fifth request, the cloud phone platform can authenticate the authentication parameters in the fifth request through the cloud phone authentication center. If the authentication is successful, the cloud phone platform can return cloud phone information to the cloud phone client. The cloud phone client can then log in to the cloud phone interface based on the user identity information and the cloud phone information. The cloud phone platform can be a cloud phone business platform, used to process cloud phone operational data and business data, and also to connect with third-party partners.

[0084] Furthermore, it is understood that the cloud phone authentication center and the cloud phone platform can reside on the cloud phone server side. Moreover, the cloud phone platform and the cloud phone authentication center can communicate with the cloud phone client via Hypertext Transfer Protocol (HTTP).

[0085] In some embodiments, in S101, the cloud application client can send a first request to the cloud phone client to obtain a token when the user clicks on a cloud application control in the cloud phone or when the user logs into the H5 page corresponding to the cloud application. The first request may be a request to obtain a token from the cloud phone client, and may include a cloud application identity identifier, i.e., a cloud application ID. The cloud application client may be an application provided by a third-party partner running on the cloud phone.

[0086] In this embodiment, the cloud application client can establish communication with a cloud-side proxy, and then send a first request to the cloud phone client through the cloud-side proxy. In one example, when a user logs into a cloud application, the cloud application client can send a first request to the cloud-side proxy. Upon receiving the first request, the cloud-side proxy can forward the first request to the client-side proxy, so that the cloud phone client, upon receiving the first request, can integrate the application ID and cloud phone identity identifier corresponding to the first request to obtain a first request with the application ID and cloud phone identity identifier.

[0087] The communication between the cloud application client and the cloud-side agent can be established in the following ways: the cloud-side agent establishes a TCP server, and the cloud application client connects to the cloud-side agent via socket; the cloud-side agent establishes a binder service, and the cloud application client communicates with the service through binder inter-process communication; the cloud-side agent invokes the cloud application through the scheme protocol, carrying parameters in the scheme protocol address.

[0088] In some embodiments, in S102, after receiving the first request sent by the cloud application client, the cloud phone client can forward the first request to the cloud phone authentication center. In one example, the cloud phone client can send the first request with integrated information to the cloud phone authentication center. The communication process between the cloud phone client and the cloud phone authentication center is the same as described above and will not be repeated here.

[0089] In some embodiments, in S103, the cloud phone authentication center can receive a first request to obtain a token from the cloud phone client after the user's identity information has been verified, i.e., the user has successfully logged into the cloud phone. The center then determines the cloud application key based on the cloud application identity identifier in the first request. There is a corresponding relationship between the cloud application identity identifier and the cloud application key.

[0090] In this embodiment of the application, in order to ensure that the cloud phone authentication center can obtain the corresponding cloud application key based on the cloud application identity identifier, before the cloud phone authentication center determines the cloud application key according to the cloud application identity identifier in the first request, the cloud phone authentication center needs to determine the cloud application existing in the cloud phone and establish the correspondence between the cloud application ID and the cloud application key.

[0091] In this embodiment, the cloud phone authentication center can generate asymmetric keys and a symmetric encryption algorithm library. The asymmetric key may include a public key and a private key. The private key can be used to represent the current cloud phone platform environment; the public key can be used to identify a real device environment or other cloud phone platform environments. The symmetric encryption algorithm library may contain multiple versions of the symmetric encryption algorithm library.

[0092] In this embodiment, the cloud phone authentication center can obtain an asymmetric key and a version of the symmetric encryption algorithm library used for encryption operations. After the cloud phone platform pushes the cloud application installation package to the cloud phone, and the cloud phone authentication center receives the second request from the cloud phone platform to register the cloud application, the cloud phone authentication center can generate a cloud application identity identifier and a cloud application key corresponding to the cloud application identity identifier based on the cloud application package name and cloud application signature. The second request may include the cloud application package name and cloud application signature. Furthermore, the cloud phone authentication center can send the public key from the obtained asymmetric key and the symmetric encryption algorithm library to the cloud application server. The symmetric encryption algorithm library may be a versioned symmetric encryption algorithm library.

[0093] In one example, after a third-party partner, such as a cloud application developer, sends a request to the cloud phone platform to cloudify its application, the cloud phone platform can push the application's installation package to the cloud phone. After the cloud application is installed on the cloud phone, the cloud phone platform can request to register the cloud application with a cloud phone certification center. This registration request may include information such as the cloud application's package name and signature. The cloud phone certification center can generate a cloud application ID and a cloud application key based on the package name and signature, and return these to the cloud phone platform. The cloud phone platform can then send the cloud application ID, cloud application key, and the public key from the asymmetric key to the third-party partner. Furthermore, the cloud phone certification center can also send the public key from the asymmetric key and the encryption algorithm library to the cloud application server.

[0094] In this embodiment, by registering cloud applications during the installation process on the cloud phone, it is ensured that each cloud application on the cloud phone has a corresponding cloud phone identity and a corresponding cloud application key in the cloud phone authentication center. Therefore, when it is necessary to encrypt a cloud application, the corresponding cloud application key can be determined based on the cloud application identity, and encryption can be performed based on the cloud application key. This ensures that only the correct cloud application can be effectively decrypted during decryption, thereby ensuring that data is not leaked during transmission and effectively guaranteeing data security.

[0095] In some embodiments, in S104, the cloud phone authentication center can encrypt the cloud phone information and user identity information based on the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time to obtain the encryption result.

[0096] For example, the symmetric encryption algorithm library version can be the version number of the symmetric encryption algorithm library used for encryption. This symmetric encryption algorithm library can be pre-stored by relevant technical personnel in the cloud phone authentication center. The symmetric encryption algorithm selector can be used to determine the encryption algorithm from the symmetric encryption algorithm library for encrypting cloud phone information and user identity information. In one example, the cloud phone authentication center can determine the symmetric encryption algorithm selector using a random algorithm.

[0097] For example, the random number can be used for signing to prevent replay attacks. In one example, the random number can be a sequence of numbers generated by the cloud phone authentication center through a random process or algorithm. The token expiration time specifies the validity period of the token. The token expiration time may also include the generation time to better determine the token's timeliness.

[0098] In some embodiments, in S105, the cloud phone authentication center generates a token based on the encryption result.

[0099] For example, the cloud phone authentication center can process cloud phone information and user identity information that are encrypted using cloud application keys, symmetric encryption algorithm library versions, symmetric encryption algorithm selectors, random numbers, and token expiration times to obtain a token.

[0100] In some embodiments, in S106, the cloud phone authentication center can send a token to the cloud phone client. In S107, the cloud phone client receives the token returned by the cloud phone authentication center and sends the token to the cloud application client.

[0101] The data interaction process between the cloud phone authentication center and the cloud phone client, as well as the interaction process between the cloud phone client and the cloud application server support, are the same as in the above embodiments, and will not be described in detail here.

[0102] In some embodiments, in S108, the cloud application client receives a token sent by the cloud mobile client. After receiving the token, the cloud application client, in response to the user's confirmation of login to the cloud application, sends a third request to the cloud application server. This third request can be used to request login to the cloud application, and it carries the token.

[0103] In this embodiment, upon receiving a token, the cloud application client can display a confirmation control to the user on the cloud application interface. For example, upon receiving a token, the cloud application client can display a pop-up window prompting the user to confirm login to the cloud application. After the user confirms login, the cloud application client can send a third login request carrying the token to the cloud application server.

[0104] In some embodiments, the cloud application server may receive a third request for cloud application login carrying a token sent by the cloud application client.

[0105] In this embodiment, before the cloud application server receives the third request, it can receive the public key from the asymmetric key and the symmetric encryption algorithm library sent by the cloud phone authentication center. This allows the cloud application server to decrypt the token in the third request based on the received public key from the asymmetric key and the symmetric encryption algorithm library.

[0106] In some embodiments, in S109, the cloud application server obtains the corresponding cloud application key. The cloud application server stores the cloud application identity identifier corresponding to the cloud application.

[0107] In some embodiments, in S110, the cloud application server can use the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to decrypt the token and obtain the user identity information.

[0108] For example, the cloud application server can use the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to decrypt the token, thereby obtaining the identity information.

[0109] In some embodiments, in S111, the cloud application server can send user identity information to the cloud application client. Furthermore, in S112, the cloud application client can receive the user identity information and log in to the cloud application based on the received user identity information.

[0110] In this embodiment, user identity information can be encrypted using a cloud application key, a symmetric encryption algorithm library version, a symmetric encryption algorithm selector, a random number, and a token expiration time to generate a unified token for authentication. Once the cloud application obtains the token actively or passively, it can decrypt it to obtain the user's identity information and log in based on this information, facilitating user login to the cloud application. Furthermore, the use of the cloud application key, symmetric encryption algorithm library version, symmetric encryption algorithm selector, random number, and token expiration time ensures data security during the cloud application login process and prevents data leakage.

[0111] Furthermore, to ensure user data security during the cloud application login process, as another implementation method in this application embodiment, this application also provides another implementation method for the cloud application login method, as detailed in the following embodiments.

[0112] Figure 2 A flowchart illustrating a cloud application login method according to another embodiment of this application is shown. Figure 2 As shown, the cloud application login method includes the following steps:

[0113] S201, The cloud application client sends the first request to the cloud mobile client to obtain a token.

[0114] S202, the cloud phone client forwards the first request to the cloud phone authentication center.

[0115] S203. The cloud phone authentication center determines the cloud application key based on the cloud application identity identifier in the first request.

[0116] S204. The cloud phone authentication center determines the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector.

[0117] S205. The cloud phone authentication center uses the cloud application key and symmetric encryption algorithm to encrypt the cloud phone information and user identity information once, and obtains the first encryption result.

[0118] S206. The cloud phone authentication center uses the private key of the asymmetric key to perform a second encryption on the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain the second encryption result.

[0119] S207, The cloud phone authentication center generates a token based on the second encryption result.

[0120] S208, the cloud phone authentication center sends a token to the cloud phone client.

[0121] S209, The cloud mobile client sends a token to the cloud application client.

[0122] S210. In response to the user's confirmation of logging into the cloud application, the cloud application client sends a third request carrying a token to the cloud application server for cloud application login.

[0123] S211. The cloud application server uses the public key in the asymmetric key to decrypt the token and obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time.

[0124] S212. Obtain the corresponding cloud application key from the cloud application server.

[0125] S213. The cloud application server determines the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector.

[0126] S214. The cloud application server decrypts the first encryption result based on the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user's identity information.

[0127] S215. The cloud application server sends the user's identity information to the cloud application client.

[0128] S216. The cloud application client logs into the cloud application based on the user's identity information.

[0129] Steps S201-S203 are the same as steps S101-S103, steps S208-S210 are the same as steps S106-S108, and steps S215-S216 are the same as steps S111-S112. They will not be elaborated on here.

[0130] In some embodiments, in S204, the cloud phone authentication center can determine the symmetric encryption algorithm based on the encryption algorithm library version and the symmetric encryption algorithm selector.

[0131] In this embodiment of the application, the cloud phone authentication center can determine the target encryption algorithm library based on the version number of the encryption algorithm library, and use the symmetric encryption algorithm selector to determine the symmetric encryption algorithm in the target encryption algorithm library.

[0132] In some embodiments, in S205, the cloud phone authentication center can use the cloud application key and the symmetric encryption algorithm to encrypt the cloud phone information and user identity information once to obtain the first encryption result.

[0133] In some embodiments, in S206, the cloud phone authentication center can use the private key of the asymmetric key to perform secondary encryption on the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time to obtain the second encryption result.

[0134] The random number can be used for signing, thus preventing replay attacks. In one example, the random number can be a sequence of numbers generated by the cloud phone authentication center through a random process or algorithm. The token expiration time specifies the valid period of the token. The token expiration time can also include the generation time to better determine the token's timeliness.

[0135] In some embodiments, in S207, the cloud phone authentication center generates a token based on the second encryption result.

[0136] In this embodiment, the cloud phone authentication center can encrypt the user's identity information and cloud phone information once using the cloud application key and symmetric encryption algorithm, and then use the private key in the asymmetric key to encrypt the first encrypted identity information and cloud phone information a second time, thereby enhancing the security of data transmission.

[0137] In some embodiments, in S211, the cloud application server can use the public key in the asymmetric key to decrypt the token in the third request to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time.

[0138] In this embodiment of the application, after receiving the third request, the cloud application server can use the public key in the asymmetric key to decrypt the token in the third request to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time.

[0139] In this embodiment, before the cloud application server receives the third request, it can receive the public key from the asymmetric key and the symmetric encryption algorithm library sent by the cloud phone authentication center. This allows the cloud application server to decrypt the token in the third request based on the received public key from the asymmetric key and the symmetric encryption algorithm library.

[0140] In some embodiments, in S212, the cloud application server obtains the corresponding cloud application key. The cloud application server stores the cloud application identity identifier corresponding to the cloud application.

[0141] In some embodiments, in S213, the cloud application server can determine the symmetric encryption algorithm based on the symmetric encryption algorithm library version after the first decryption and the symmetric encryption algorithm selector.

[0142] In this embodiment of the application, the cloud application server can determine the corresponding target encryption algorithm library based on the version of the symmetric encryption algorithm library obtained by decryption, and use the symmetric encryption algorithm selector to determine the symmetric encryption algorithm in the target encryption algorithm library.

[0143] In this embodiment, the cloud application server can determine whether the first version number corresponding to the decrypted symmetric encryption algorithm library version is consistent with the second version number corresponding to the symmetric encryption algorithm library version stored in the current cloud application server. If it is determined that the first version number and the second version number are inconsistent, the cloud application server can send a fourth request to the cloud phone authentication center to obtain the encryption algorithm library, wherein the fourth request may include the first version number.

[0144] Furthermore, after receiving the fourth request from the cloud application server to obtain the encryption algorithm library, the cloud phone authentication center can obtain the symmetric encryption algorithm library corresponding to the first version number in the fourth request, and send the symmetric encryption algorithm library corresponding to the first version number to the cloud application server.

[0145] Furthermore, if the cloud application server receives the symmetric encryption algorithm library corresponding to the first version number, it can use the symmetric encryption algorithm selector to determine the symmetric encryption algorithm from the symmetric encryption algorithm library corresponding to the first version number. If the cloud application server determines that the first version number and the second version number are the same, it can directly use the symmetric encryption algorithm selector to determine the symmetric encryption algorithm from the current symmetric encryption algorithm library without needing to send a fourth request to the cloud phone authentication center.

[0146] In some embodiments, in S214, the cloud application server can decrypt the first encryption result based on the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information.

[0147] In this embodiment, the cloud application server can determine the corresponding decryption algorithm based on the symmetric encryption algorithm, and use the decryption algorithm and the cloud application key to decrypt the first encryption result to obtain the user's identity information.

[0148] In this embodiment, user identity information can be encrypted twice to generate a unified token for authentication. Once the cloud application obtains the token actively or passively, it can decrypt it to obtain the user identity information and log in based on this information, facilitating user login to the cloud application. Furthermore, the user identity information is initially encrypted using the cloud application's corresponding application key and encryption algorithm. This ensures that only the corresponding cloud application can decrypt it, thus guaranteeing data confidentiality and security. Encryption using a private key ensures the uniqueness of the cloud phone platform, distinguishing whether it belongs to a specific cloud phone platform environment. Additionally, the cloud phone information parameter token further distinguishes whether it belongs to a specific cloud phone environment. Further, the initially encrypted user identity information, encryption algorithm, random number, and token expiration time are then encrypted a second time using the private key in the asymmetric key, enhancing data confidentiality and security. The random number and token expiration time in the second encryption can prevent short-term and long-term replay attacks, further improving data confidentiality and security, thereby ensuring user data security during cloud application login and preventing data leakage.

[0149] To prevent data tampering and ensure the security and integrity of tokens, as another implementation method in this application, this application also provides another implementation method for the cloud application login method, as detailed in the following embodiments.

[0150] Figure 3 This illustration shows a flowchart of yet another cloud application login method provided in one embodiment of this application. Figure 3 As shown, after decrypting the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information, the cloud application login method further includes the following steps:

[0151] S217. The cloud application server performs signature processing based on the cloud phone information, user identity information, random number, and cloud application identifier to obtain the first signature.

[0152] S218, the cloud application server will send the first verification information, including the first signature, cloud application identifier, and token, to the cloud phone authentication center.

[0153] S219. The cloud phone authentication center uses the first verification information to verify the token.

[0154] S220. If the first verification information is successfully verified, the cloud phone authentication center sends the verification success information and user identity information to the cloud application server.

[0155] S215. The cloud application server sends the user's identity information to the cloud application client.

[0156] S216. The cloud application client logs into the cloud application based on the user's identity information.

[0157] In some embodiments, in S217, the cloud application server can perform signature processing on the decrypted cloud phone information, user identity information, random number and cloud application identifier to obtain a first signature.

[0158] In this embodiment, the cloud application server decrypts the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key, and can also obtain the cloud phone information. Furthermore, a first signature can be obtained by performing signature processing using the cloud phone information, user identity information, random number, and cloud application identifier.

[0159] In some embodiments, in S218, the cloud application server can send first verification information, including a first signature, a cloud application identifier, and a token, to the cloud phone authentication center. Further, in S219, the cloud phone authentication center receives the first verification information sent by the cloud application server and uses the first verification information to verify the token.

[0160] In this embodiment, after receiving the first verification information, the cloud phone authentication center can use the public key in the asymmetric key to decrypt the token in the first verification information for the first time, obtaining the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time. The decrypted random number is recorded. Further, the cloud phone authentication center determines whether the token has expired based on the token expiration time and the current system time. If the token has not expired, it checks whether the random number is a duplicate of a historical random number. If the random number is not a duplicate, it determines the application key based on the cloud application identity identifier. It then determines the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector. Further, it can decrypt the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information. The cloud application identity identifier, the decrypted cloud phone information, the user identity information, and the random number are then signed to obtain a second signature. The cloud phone authentication center can verify whether the first signature and the second signature are consistent. If the first signature and the second signature are consistent, the verification is successful.

[0161] In this embodiment of the application, by checking whether the first signature and the second signature are consistent, it can be determined whether the data has been tampered with during transmission, thereby better protecting the security of users logging into cloud phones.

[0162] In some embodiments, in S220, if the first verification information is successfully verified, the cloud phone authentication center can send verification success information and user identity information to the cloud application server. Further, in S215, the cloud application server can receive the verification success information and user identity information sent by the cloud phone authentication center and send the user identity information to the cloud application client. Even further, in S216, after receiving the user identity information sent by the cloud application server, the cloud application client can log in to the cloud application based on the user identity information.

[0163] In this embodiment of the application, before the cloud application server sends user identity information to the cloud application client, the user identity information can be verified by obtaining a signature, thereby preventing the user identity information from being tampered with during transmission and ensuring the integrity of the user identity information.

[0164] Based on the cloud application login method provided in the above embodiments, this application also provides specific implementations of the cloud application login device. Please refer to the following embodiments.

[0165] First see Figure 4 The cloud application login device 400 for cloud phone authentication center provided in this application embodiment includes the following units:

[0166] The first determining module 401 is used to respond to the first request sent by the cloud machine client to obtain a token and determine the cloud application key based on the cloud application identity identifier in the first request.

[0167] The second determining module 402 is used to determine the symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector.

[0168] Encryption module 403 is used to encrypt cloud phone information and user identity information based on cloud application key, symmetric encryption algorithm library version, symmetric encryption algorithm selector, random number and token expiration time to obtain encryption result.

[0169] Generation module 404 is used to generate a token based on the encryption result.

[0170] The sending module 405 is used to send a token to the cloud mobile client, so that the cloud mobile client sends the token to the cloud application server, and then the cloud application server decrypts the token to obtain the user identity information, and sends the user identity information to the cloud application client, so that the cloud application client can log in to the cloud application based on the user identity information.

[0171] In this embodiment, the encryption module 403 encrypts the cloud phone information and the user identity information using the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time to obtain an encryption result: A symmetric encryption algorithm is determined based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; the cloud phone information and the user identity information are encrypted once using the cloud application key and the symmetric encryption algorithm to obtain a first encryption result; the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time are then encrypted a second time using the private key of the asymmetric key to obtain a second encryption result; the generation module 404 generates a token based on the encryption result using the second encryption result.

[0172] In this embodiment, the cloud application login device 400 further includes a receiving module 406, used to receive first verification information sent by the cloud application server. The first verification information includes a first signature, a cloud application identity identifier, and a token. The first signature is obtained by the cloud application server through signature processing of cloud phone information, user identity information, a random number, and the application identity identifier. A verification module 407 is used to verify the token using the first verification information. A sending module 405 is further used to send verification success information and user identity information to the cloud application server if the first verification information is successfully verified, thereby enabling the cloud application server to send the user identity information to the cloud application client, allowing the cloud application client to log in to the cloud application based on the user identity information.

[0173] In this embodiment, the verification module 407 verifies the token using the first verification information in the following manner: The token is decrypted for the first time using the public key in the asymmetric key to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time; the random number is recorded; the token is determined to be expired based on the token expiration time and the current system time; if the token is not expired, the random number is determined to be the same as a historical random number; if the random number is not the same, the application key is determined based on the cloud application identity identifier; the symmetric encryption algorithm is determined based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; the first encryption result is decrypted using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information; the cloud application identity identifier, the decrypted cloud phone information, the user identity information, and the random number are signed to obtain a second signature; the first signature and the second signature are verified to be consistent; if the first signature and the second signature are consistent, the verification is successful.

[0174] In this embodiment, the receiving module 406 is further configured to receive a fourth request from the cloud application server to obtain an encryption algorithm library. The cloud application login device 400 also includes a third determining module 409, configured to determine the symmetric encryption algorithm library corresponding to the first version number of the fourth request. The sending module 405 is further configured to send the symmetric encryption algorithm library corresponding to the first version number to the cloud application server.

[0175] Furthermore, this application also provides a specific implementation of a cloud application login device 500 applied to a cloud mobile client. Please refer to the following embodiments.

[0176] First see Figure 5 The cloud application login device 500 for cloud mobile clients provided in this application embodiment includes the following units:

[0177] The first receiving module 501 is used to receive the first request for obtaining a token sent by the cloud application client.

[0178] The first sending module 502 is used to forward the first request to the cloud phone authentication center, so that the cloud phone authentication center can determine the cloud application key based on the cloud application identity identifier in the first request. The cloud phone information and the user identity information are encrypted using the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time to obtain an encryption result; a token is then generated based on the encryption result.

[0179] The second receiving module 503 is used to receive the token returned by the cloud phone authentication center.

[0180] The second sending module 504 is used to send a token to the cloud application server so that the cloud application server can send the decrypted user identity information to the cloud application client, enabling the cloud application client to log in to the cloud application based on the user identity information.

[0181] Furthermore, this application also provides a specific implementation of a cloud application login device 600 applied to a cloud application client. Please refer to the following embodiments.

[0182] First see Figure 6 The cloud application login device 600 for cloud application clients provided in this application embodiment includes the following units:

[0183] The first sending module 601 is used to send a first request to the cloud mobile client to obtain a token.

[0184] The first receiving module 602 is used to receive the token sent by the cloud mobile client.

[0185] The second sending module 603 is used to respond to the user's confirmation of logging into the cloud application by sending a third request for cloud application login carrying a token to the cloud application server, so that the cloud application server can decrypt the token to obtain the user's identity information, and then send the user's identity information to the cloud application client.

[0186] The second receiving module 604 is used to receive user identity information.

[0187] Login module 605 is used to log in to cloud applications based on user identity information.

[0188] In this embodiment, the second sending module 603 is further configured to, in response to the user's confirmation of login to the cloud application, send a third request for cloud application login carrying a token to the cloud application server, so that the cloud application server decrypts the token to obtain cloud phone information, user identity information, a random number, and the token expiration time; perform signature processing based on the cloud phone information, user identity information, random number, and cloud application identifier to obtain a first signature; and send first verification information containing the first signature, cloud application identifier, and token to the cloud phone authentication center for verification. The second receiving module 604 is further configured to, if the verification by the cloud phone authentication center is successful, receive the user identity information sent by the cloud application server. The login module 605 is further configured to log in to the cloud application based on the user identity information.

[0189] Furthermore, this application also provides a specific implementation of a cloud application login device 700 applied to a cloud application server. Please refer to the following embodiments.

[0190] First see Figure 7 The cloud application login device 700 for cloud application servers provided in this application embodiment includes the following units:

[0191] The receiving module 701 is used for a third request for cloud application login carrying a token sent by the cloud application client.

[0192] The acquisition module 702 is used to obtain the cloud application key corresponding to the cloud application server.

[0193] The decryption module 703 is used to decrypt the token using the cloud application key to obtain the user's identity information.

[0194] The sending module 704 is used to send user identity information to the cloud application client so that the cloud application client can log in to the cloud application based on the user identity information.

[0195] In this embodiment of the application, cloud phone information can also be obtained by decrypting the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key.

[0196] In this embodiment, the decryption module 703 uses the cloud application key to decrypt the token to obtain user identity information in the following manner: the token is decrypted using the public key in the asymmetric key to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, a random number, and the token expiration time; the symmetric encryption algorithm is determined based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; and the user identity information is obtained based on the decryption algorithm corresponding to the symmetric encryption algorithm, the cloud application key decryption, and the first encryption result.

[0197] The cloud application login device 700 also includes a verification module 705. After decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information, the verification module 705 performs signature processing based on the cloud phone information, user identity information, random number, and cloud application identifier to obtain a first signature; sends the first verification information containing the first signature, cloud application identifier, and token to the cloud phone authentication center for verification; receives the verification success information and user identity information sent by the cloud phone authentication center; and sends the user identity information to the cloud application client so that the cloud application client can log in to the cloud application based on the user identity information.

[0198] In this embodiment of the application, the cloud application login device 700 further includes a determining module 704 configured to: determine a symmetric encryption algorithm based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; determine whether the first version number corresponding to the symmetric encryption algorithm library version is consistent with the second version number corresponding to the current symmetric encryption algorithm library version; if the first version number and the second version number are inconsistent, send a fourth request to the cloud mobile phone authentication center to obtain the encryption algorithm library; if the symmetric encryption algorithm library corresponding to the first version number is received, determine the symmetric encryption algorithm in the symmetric encryption algorithm library corresponding to the first version number using the symmetric encryption algorithm selector; if the first version number and the second version number are consistent, determine the symmetric encryption algorithm in the current symmetric encryption algorithm library using the symmetric encryption algorithm selector.

[0199] The cloud application login device of this application embodiment can encrypt the user's identity information twice after the initial authentication to generate a unified token for identity authentication. When the cloud application obtains the token actively or passively, it can decrypt the token to obtain the user's identity information and log in based on this information, providing convenience for users to log in to the cloud application. Furthermore, the user's identity information can be initially encrypted using the cloud application's corresponding application key and encryption algorithm, ensuring that only the corresponding cloud application can decrypt it, thereby ensuring data confidentiality and security. Further, the initially encrypted user identity information, encryption algorithm, random number, and token expiration time are then encrypted a second time using the private key in the asymmetric key, further enhancing data confidentiality and security. Moreover, the random number and token expiration time in the second encryption can be used to prevent short-term and long-term replay attacks, further improving data confidentiality and security, thereby ensuring data security for users during convenient cloud application login and preventing data leakage.

[0200] Figure 8 A schematic diagram of the hardware structure for cloud application login provided in an embodiment of this application is shown.

[0201] The cloud application login device may include a processor 801 and a memory 802 storing computer program instructions.

[0202] Specifically, the processor 801 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0203] Memory 802 may include mass storage for data or instructions. For example, and not limitingly, memory 802 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 802 may include removable or non-removable (or fixed) media. Where appropriate, memory 802 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 802 is non-volatile solid-state memory.

[0204] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the methods according to one aspect of this disclosure.

[0205] The processor 801 reads and executes computer program instructions stored in the memory 802 to implement any of the cloud application login methods in the above embodiments.

[0206] In one example, the cloud application login device may also include a communication interface 803 and a bus 810. For example, Figure 8 As shown, the processor 801, memory 802, and communication interface 803 are connected through bus 810 and complete communication with each other.

[0207] The communication interface 803 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0208] Bus 810 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 810 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0209] This cloud application login device can enable users to perform corresponding cloud application login operations using the cloud application login method described in this application embodiment, thereby achieving a combination of... Figures 1 to 7 The cloud application login method and device described.

[0210] In addition, in conjunction with the cloud application login methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the cloud application login methods in the above embodiments.

[0211] This embodiment also provides a computer program product, including a computer program, which, when executed, implements any of the cloud application login methods described in the above embodiments.

[0212] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0213] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0214] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0215] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0216] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A cloud application login method, characterized by, Applied to cloud phone authentication centers, the method includes: In response to the first request to obtain a token sent by the cloud mobile client, the cloud application key is determined based on the cloud application identity identifier in the first request; The cloud phone information and user identity information are encrypted based on the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain the encryption result. Generate a token based on the encryption result; The token is sent to the cloud mobile client, so that the cloud mobile client sends the token to the cloud application server, and then the cloud application server decrypts the token to obtain the user identity information, and sends the user identity information to the cloud application client, so that the cloud application client logs into the cloud application based on the user identity information.

2. The method of claim 1, wherein, The encryption of the cloud phone information and the user identity information based on the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time yields the encryption result, including: The symmetric encryption algorithm is determined based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; The cloud application key and the symmetric encryption algorithm are used to encrypt the cloud phone information and the user identity information once to obtain the first encryption result; The first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time are encrypted a second time using the private key of the asymmetric key to obtain the second encryption result; The step of generating a token based on the encryption result includes: A token is generated based on the second encryption result.

3. The method according to any one of claims 1-2, characterized in that, After sending the token to the cloud phone client, the method further includes: The system receives first verification information sent by the cloud application server. The first verification information includes a first signature, the cloud application identity identifier, and the token. The first signature is obtained by the cloud application server through signature processing of the cloud phone information, the user identity information, the random number, and the cloud application identity identifier. The token is verified using the first verification information; If the first verification information is successfully verified, a verification success message and the user identity information are sent to the cloud application server, thereby causing the cloud application server to send the user identity information to the cloud application client, enabling the cloud application client to log in to the cloud application based on the user identity information.

4. The method according to claim 3, characterized in that, The step of verifying the token using the first verification information includes: The token is decrypted for the first time using the public key in the asymmetric key to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time; Record the random number; Determine whether the token has expired based on the token's expiration time and the system's current time; If it is determined that the token will not expire, determine whether the random number is a duplicate of a random number in the historical record; If the random number is not repeated, the application key is determined based on the cloud application identity. The symmetric encryption algorithm is determined based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; The user's identity information is obtained by decrypting the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key. The cloud application identity identifier, the decrypted cloud phone information, the user identity information, and the random number are signed to obtain a second signature; Verify whether the first signature and the second signature are consistent; If the first signature and the second signature match, the verification is considered successful.

5. A cloud application login method, characterized in that, Applied to cloud mobile clients, the method includes: Receive the first request from the cloud application client to obtain a token; The first request is forwarded to the cloud phone authentication center, so that the cloud phone authentication center determines the cloud application key based on the cloud application identity identifier in the first request; the cloud phone information and user identity information are encrypted based on the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain the encryption result; and a token is generated based on the encryption result. Receive the token returned by the cloud phone authentication center; The token is sent to the cloud application server so that the cloud application server can send the decrypted user identity information to the cloud application client, enabling the cloud application client to log in to the cloud application based on the user identity information.

6. A cloud application login method, characterized in that, Applied to cloud application clients, the method includes: Send a first request to the cloud phone client to obtain a token. The first request contains a cloud application identity identifier, so that the cloud phone authentication center can determine the cloud application key based on the cloud application identity identifier. Receive a token sent by the cloud phone client, wherein the token is obtained by the cloud phone authentication center by encrypting cloud phone information and user identity information based on the cloud application key, symmetric encryption algorithm library version, symmetric encryption algorithm selector, asymmetric key, random number and token expiration time; In response to the user's confirmation of logging into the cloud application, a third request for cloud application login carrying a token is sent to the cloud application server, so that the cloud application server can decrypt the token to obtain the user's identity information, and then send the user's identity information to the cloud application client. Receive the user identity information; Log in to the cloud application based on the user's identity information.

7. The method according to claim 6, characterized in that, After sending a third request carrying a token for cloud application login to the cloud application server in response to the user's confirmation of login to the cloud application, the method further includes: In response to the user's confirmation of login to the cloud application, a third request carrying a token for cloud application login is sent to the cloud application server, so that the cloud application server can decrypt the token to obtain cloud phone information, user identity information, random number, and token expiration time; a signature is processed based on the cloud phone information, the user identity information, the random number, and the cloud application identity identifier to obtain a first signature; and first verification information containing the first signature, the cloud application identity identifier, and the token is sent to the cloud phone authentication center for verification. If the verification at the cloud phone authentication center is successful, the user identity information sent by the cloud application server will be received. Log in to the cloud application based on your user identity information.

8. A cloud application login method, characterized in that, Applied to cloud application servers, including: Receive a third request from the cloud application client to log in to the cloud application, carrying a token; Obtain the cloud application key corresponding to the cloud application server; The user's identity information is obtained by decrypting the token using the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time. The user's identity information is sent to the cloud application client so that the cloud application client can log in to the cloud application based on the user's identity information.

9. The method according to claim 8, characterized in that, The process of decrypting the token using the cloud application key, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the asymmetric key, the random number, and the token expiration time to obtain user identity information includes: The token is decrypted using the public key in the asymmetric key to obtain the first encryption result, the symmetric encryption algorithm library version, the symmetric encryption algorithm selector, the random number, and the token expiration time; The symmetric encryption algorithm is determined based on the symmetric encryption algorithm library version and the symmetric encryption algorithm selector; The user's identity information is obtained by decrypting the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key.

10. The method according to claim 9, characterized in that, The cloud phone information can also be obtained by decrypting the first encryption result using the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key. After decrypting the first encryption result according to the decryption algorithm corresponding to the symmetric encryption algorithm and the cloud application key to obtain the user identity information, the method further includes: The first signature is obtained by performing signature processing based on the cloud phone information, the user identity information, the random number, and the cloud application identity identifier; The first verification information, which includes the first signature, the cloud application identity identifier, and the token, is sent to the cloud phone authentication center so that the cloud phone authentication center can perform verification. Receive the verification success message and user identity information sent by the cloud phone authentication center; The user's identity information is sent to the cloud application client so that the cloud application client can log in to the cloud application based on the user's identity information.

Images