User identity authentication system and method based on integrated service platform

Abstract

The invention provides a user identity authentication system and method based on an integrated service platform. The method is applied to an integrated service platform comprising a first service module and a second service module, and an adapter module and an authentication module which can be reused and decoupled from the service module are developed in the platform to serve as a user identity authentication system of the integrated service platform. The identity authentication operation such as account login does not need to be repeatedly executed for each service module, the authentication process is simplified, the user experience is improved, meanwhile, the data security in the user identity authentication process is improved, and the problem that identity authentication systems are different and cannot be mutually trusted in an integrated scene of each service module is solved. Besides, the user identity authentication is based on an independently developed user identity authentication system, and the system comprises a reusable adapter module and an authentication module which are decoupled from the service module, so that the practicability and the universality of the user identity authentication method and the corresponding system are improved.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a user identity authentication system and method based on an integrated business platform. Background Art

[0002] During the integrated application development phase, when integrating target applications such as Web applications into third-party business platforms, it is usually necessary to deeply integrate with the third-party business platforms to achieve efficient collaboration between the applications and the business platforms. In order to improve user experience, Web applications often rely on the functions of third-party business platforms and need to be integrated through data synchronization or interface calls. However, some third-party business platforms have their own unique user account authentication systems and are unwilling or inconvenient to support the account authentication system of Web applications. If Web applications directly trust the accounts of third-party business platforms, there may be a risk of data leakage. Similar problems may also exist when integrating between third-party business platforms.

[0003] In addition, in the application stage based on this, when users enter the target application through a third-party application platform, the user identity authentication problem is involved. In summary, in the scenario based on the integration of the third-party application platform and the target application, there is a problem of different identity authentication systems and lack of mutual trust, but this will bring about the problem of complex process and large amount of data used in the identity authentication process, and the security of the data in the identity authentication process cannot be guaranteed. Therefore, a user identity authentication method based on an integrated business platform is needed to solve the problem of complex identity authentication process and low data security. Summary of the invention

[0004] The purpose of this application is to solve at least one of the above-mentioned technical defects, especially the technical defects in the prior art that the front-end data volume and data interpretability of the user identity authentication process based on the integrated business platform are limited, and the prediction effect depends on the experience of personnel.

[0005] In a first aspect, the present application provides a user identity authentication system based on an integrated business platform, the system comprising:

[0006] An adapter module, used to identify the binding status of the target user on the first business module or the second business module, generate a user authentication address according to the account information of the target user, and verify the user characteristics of the target user when the target user performs identity authentication;

[0007] an authentication module, configured to obtain the binding status of the target user in the second business module through the first account information of the first business module, and to bind the first account information of the target user in the first business module with the second account information of the second business module;

[0008] The adapter module is connected to the first business module and to the authentication module, the authentication module is connected to the second business module, and the first business module is used to perform identity authentication through the adapter module and the authentication module and access the second business module.

[0009] In a second aspect, the present application provides a user identity authentication method based on an integrated business platform, the method being applied to the system as described in the first aspect, the method comprising:

[0010] Obtaining the first account information of the target user through the first business module;

[0011] Generate an authentication address through an adapter module according to the first account information, and redirect the target user to the authentication address through the first business module;

[0012] Determine the user identity information through the adapter module, and determine the binding status of the target user on the second business module according to the user identity information through the authentication module;

[0013] According to the binding situation, identity authentication is performed on the target user on the second business module. If the identity authentication passes, the application authority of the second business module is opened to the target user.

[0014] As an optional implementation manner, the first account information includes a first identity feature of the target user in the first business module;

[0015] The step of generating an authentication address through an adapter module according to the first account information includes:

[0016] Performing an encryption operation on the first identity feature through the adapter module to obtain an encrypted first encryption feature and generate a session sequence number;

[0017] generating an authentication address according to the first encryption feature and the session sequence number, and transmitting the authentication address to the first service module;

[0018] And, determining the user identity information through the adapter module, and determining the binding status of the target user on the second business module according to the user identity information through the authentication module, includes:

[0019] When the target user accesses the authentication address, the adapter module obtains the identity of the target user according to the session serial number, and determines the binding status of the target user on the second business module according to the identity.

[0020] As an optional implementation manner, the binding status of the target user on the second service module is already bound;

[0021] The performing identity authentication on the target user on the second service module according to the binding condition includes:

[0022] Acquire the second account information of the target user on the second module;

[0023] Wherein, the second account information includes a second identity feature;

[0024] Performing an encryption operation on the second identity feature to obtain an encrypted second encryption feature;

[0025] It is determined whether the first encryption feature is consistent with the second encryption feature. If the first encryption feature is consistent with the second encryption feature, the identity authentication is passed.

[0026] As an optional implementation, the encryption operation includes:

[0027] A hash operation is performed on the first account information or the second identity feature according to the first encryption parameter and the second encryption parameter.

[0028] As an optional implementation manner, the first encryption parameter includes a random number generated by the first business module and configured on the second business module during the establishment of the integrated business platform;

[0029] The second encryption parameter includes a random number generated by the second business module according to the first business module during the establishment of the integrated business platform.

[0030] As an optional implementation manner, the binding status of the target user on the second service module is unbound;

[0031] The method further comprises:

[0032] redirecting the target user to a login address through the adapter module;

[0033] According to the login address, determine the second account information of the target user on the second module, and determine whether the second account information of the target user is consistent with the first account information. If the second account information of the target user is consistent with the first account information, bind the target user to the second business module.

[0034] In a third aspect, the present application provides a user identity authentication device based on an integrated service platform, the device comprising:

[0035] An acquisition module, used to acquire the first account information of the target user through the first business module;

[0036] A processing module, configured to generate an authentication address through an adapter module according to the first account information, and redirect the target user to the authentication address through the first business module;

[0037] The processing module is further used to determine the user identity information through the adapter module, and determine the binding status of the target user on the second business module according to the user identity information through the authentication module;

[0038] The processing module is further used to perform identity authentication on the target user on the second business module according to the binding situation, and if the identity authentication passes, open the application authority of the second business module to the target user.

[0039] In a fourth aspect, the present application provides a computer device, comprising one or more processors and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the method described in the second aspect are performed.

[0040] In a fifth aspect, the present application provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the method described in the second aspect.

[0041] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0042] Based on any of the above embodiments, the method provided by the present application is applied to an integrated business platform including a first business module and a second business module. A reusable adapter module and an authentication module decoupled from the business module are developed in the platform as a user identity authentication system of the integrated business platform. In the user identity authentication process, first, according to the first account information and identity authentication request input by the target user at the first business module end, an authentication address is generated through the adapter module and pushed to the target user, and then the user identity information is confirmed. Through the unique identifier of the user identity on the integrated business platform, the binding status of the target user on the second business module is determined, and then the identity authentication is performed through the identity feature information encrypted by the target user on the first business module side and the second business module side respectively. After the identity authentication is passed, the application permissions of the second business module are opened to the target user. As a result, the target user does not need to repeatedly perform identity authentication operations such as account login for each business module in the identity authentication process, which simplifies the authentication process, improves the user experience, and at the same time improves the security of data in the user identity authentication process, solving the problem that the identity authentication systems of each business module are different and cannot trust each other in the integrated scenario. In addition, as mentioned above, since user authentication is based on a separately developed user authentication system, the system includes reusable adapter modules and authentication modules that are decoupled from business modules, which also improves the practicality and universality of such user authentication methods and corresponding systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0044] Figure 1 A flowchart of a user identity authentication method based on an integrated business platform provided in one embodiment of the present application;

[0045] Figure 2 A schematic diagram of the structure of a user identity authentication system based on an integrated business platform provided in one embodiment of the present application;

[0046] Figure 3 A flowchart of a user identity authentication method based on an integrated business platform provided in one embodiment of the present application;

[0047] Figure 4 A flowchart of a user identity authentication method based on an integrated business platform provided in one embodiment of the present application;

[0048] Figure 5This is a diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] First, let’s explain the important noun concepts:

[0051] Third-party business platform account: an account on a business platform provided and operated by a third party that is independent of target applications such as Web applications.

[0052] Application account: An application account is a user's identity credential in an application or service. It is used for identity authentication, user permission management, and storage and synchronization of personal information and data. It is an important basis for interaction between users and applications.

[0053] Account authentication system: The account authentication system is a mechanism system for authenticating the current user, allowing users to obtain access rights through different authentication elements such as account password, SMS verification code, etc. Since the account password or SMS verification code is provided independently by the platform, the authentication of the general platform is a closed-loop authentication system.

[0054] Integration: The process of seamlessly connecting and coordinating different business platforms, target applications, and business processes. Its purpose is to unify and coordinate the various independent parts so that they can interoperate effectively, thereby achieving data sharing, process optimization, and overall business efficiency improvement.

[0055] In some actual application scenarios, for example, when integrating a target application such as a Web application into a third-party business platform, it is usually necessary to deeply integrate with the third-party business platform to achieve efficient collaboration between the application and the business platform. Generally speaking, in order to improve the user experience, Web applications often rely on the functions of the third-party business platform and need to be integrated through data synchronization or interface calls. However, some third-party business platforms have their own unique user account authentication system and are unwilling or inconvenient to support the account authentication system of Web applications. If Web applications directly trust the accounts of third-party business platforms, there may be a risk of data leakage, which is a relatively high risk.

[0056] In some feasible implementations, a third-party platform account is used to log in to the target application. The process is that the user jumps to the third-party platform for authentication in the target application, and then the third-party platform returns the user information of the platform and binds the target application account with the third-party platform account, thereby supporting the completion of user authentication by logging in to the third-party platform, thereby solving the problem of users remembering multiple accounts. Specifically, this type of implementation is to add a new authentication method to the platform or application, which is usually provided by a platform with a large user base, and its purpose is to reduce the number of users who re-register or log in multiple times on the platform.

[0057] The application scenario of this application can be the connection between platforms or applications. When one platform uses the capabilities or applications of another platform, since both parties have their own authentication, the capability user does not access the authentication capabilities of the third-party platform for various reasons, and hopes that the account used by the capability provider corresponds to the account used by the capability user. In addition to transmitting a user ID, this application also transmits two user features to confirm that the account authenticated by the user on the capability provider platform is consistent with the account provided by the capability caller platform, and avoids user data leakage or snooping between the two platforms through hash calculation.

[0058] Specifically, the present application aims to solve the scenario where the authentication systems between the third-party business platform account and the target application account are inconsistent and cannot trust each other when the target application is integrated with the third-party business platform. In some embodiments, when the third-party business platform is integrated into the target application, according to the specification, the third-party business platform transmits the user's user information to the adapter module, and the user information includes the user's unique user ID and at least one user identity feature on the third-party business platform. The adapter module generates an authentication address with the account information customized by the third-party business platform. After the third-party business platform obtains the authentication address of the application, it allows the user to access the authentication address and the user performs authentication. After the user is authenticated, the adapter obtains the account unique identifier and user identity feature according to the current authenticated session, determines whether the third-party platform carries the corresponding identity feature, authenticates the current user after passing, and binds the current user ID with the third-party business platform account system ID. When the user enters the application from the third-party business platform again, the adapter device and the application account authentication binding device are accessed in sequence, and after obtaining the user ID of the third-party business platform, the data of the account in the target application is obtained through the account binding table, so that the user can directly enter the target application without secondary authentication.

[0059] In summary, combined with the specific implementation methods corresponding to the present application, the technical concept of the present application is that the corresponding method is applied to an integrated business platform including a first business module and a second business module, and a reusable adapter module and an authentication module decoupled from the business module are developed in the platform as a user identity authentication system of the integrated business platform. In the user identity authentication process, first, according to the first account information and identity authentication request input by the target user at the first business module end, the authentication address is generated through the adapter module and pushed to the target user, and then the user identity information is confirmed, and the binding status of the target user on the second business module is determined through the unique identification of the user identity on the integrated business platform, and then the identity authentication is performed through the identity feature information encrypted by the target user on the first business module side and the second business module side, and the application permissions of the second business module are opened to the target user after the identity authentication is passed. As a result, the target user does not need to repeatedly perform identity authentication operations such as account login for each business module in the identity authentication process, which simplifies the authentication process, improves the user experience, and at the same time improves the security of data in the user identity authentication process, solving the problem that the identity authentication systems of each business module are different and cannot trust each other in the integrated scenario. In addition, as mentioned above, since user authentication is based on a separately developed user authentication system, the system includes reusable adapter modules and authentication modules that are decoupled from business modules, which also improves the practicality and universality of such user authentication methods and corresponding systems.

[0060] See also Figure 1 , Figure 1 A flowchart of a user identity authentication method based on an integrated business platform provided in one embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes:

[0061] S101, obtaining first account information of a target user through a first business module;

[0062] The first account information may include information about the account itself used by the target user on the first business module, and may also include information related to the target user's identity authentication, such as the first identity feature mentioned in some implementations. The first account information is used to verify the user's identity during the access process. For details, please refer to the relevant implementation methods.

[0063] S102: Generate an authentication address through an adapter module according to the first account information, and redirect the target user to the authentication address through the first business module;

[0064] The adapter module is a part of the user identity authentication system based on the integrated business platform developed in this application. As a common processing module decoupled from each business module, it completes the task of acquiring and processing information related to the target user's identity. In this step, based on the first account information of the target user and the specific circumstances of the identity authentication, a corresponding session serial number is generated, and an authentication address that can identify the session serial number is further generated, which is then sent back to the first business module to guide the target user to enter the authentication address to continue to complete the process of acquiring user binding information.

[0065] S103, determining user identity information through the adapter module, and determining the binding status of the target user on the second business module according to the user identity information through the authentication module;

[0066] As mentioned above, after the user enters the authentication address, the authentication module is further used to determine the binding status of the target user on the second business module, thereby further determining whether the target user is accessing the second business module through the first business module for the first time. If it is bound, repeated authentication of the target user's identity can be avoided, thereby improving the efficiency of the target user's access to the second business module.

[0067] S104. Perform identity authentication on the target user in the second business module according to the binding situation. If the identity authentication passes, open application permissions of the second business module to the target user.

[0068] When the target user is not bound to the second service module, a corresponding binding process may be further performed through the authentication module. For details, please refer to the relevant implementation method.

[0069] When the identity authentication is passed, the application authority of the second business module is opened to the target user. When the identity authentication is not passed, the user is guided to update the identity.

[0070] In a specific application scenario, the relevant implementation methods of this step may include:

[0071] Taking the scenario of integration of a third-party service platform and a target application as an example, a target user uses the relevant functions of the target application on the second service module side through the third-party service platform on the first service module side.

[0072] The second business module verifies the target user binding relationship to confirm whether the target user's unique identifier has been bound to the account of this platform, and at the same time confirms whether the target user's currently authenticated features are consistent with the features transmitted by the third party. If it has been bound and the verified identity features are consistent, the application is entered directly. If it has been bound but the identity features are inconsistent, the target user's subject in the third-party business platform may have changed. The target user is reminded and told that if the target user needs to continue binding, he needs to enter the application separately to modify the authentication features, keep both sides consistent, and re-enter from the third-party platform.

[0073] If the target user is not bound in the second business module, the target user needs to authenticate once to obtain the target user's information and perform a comparison of the target user's features. After the target user's features are matched, the target user's unique identifier on the third-party business platform is bound to the target user account on the target application side and then enters the application. When the target user enters the application again from the third-party platform, the problem of repeated authentication for two or more entries is avoided.

[0074] The method corresponding to the present embodiment is applied to an integrated business platform including a first business module and a second business module. A reusable adapter module and an authentication module decoupled from the business module are developed in the platform as a user identity authentication system of the integrated business platform. In the user identity authentication process, firstly, according to the first account information and identity authentication request input by the target user at the first business module end, an authentication address is generated through the adapter module and pushed to the target user, and then the user identity information is confirmed. Through the unique identification of the user identity on the integrated business platform, the binding status of the target user on the second business module is determined, and then the identity authentication is performed through the identity feature information encrypted by the target user on the first business module side and the second business module side respectively. After the identity authentication is passed, the application rights of the second business module are opened to the target user. As a result, the target user does not need to repeatedly perform identity authentication operations such as account login for each business module in the identity authentication process, which simplifies the authentication process, improves the user experience, and at the same time improves the security of data in the user identity authentication process, solving the problem that the identity authentication systems of various business modules are different and cannot trust each other in the integrated scenario. In addition, as mentioned above, since user authentication is based on a separately developed user authentication system, the system includes reusable adapter modules and authentication modules that are decoupled from business modules, which also improves the practicality and universality of such user authentication methods and corresponding systems.

[0075] See also Figure 2 , Figure 2 A schematic diagram of the structure of a user identity authentication system based on an integrated business platform provided in one embodiment of the present application is shown in FIG. Figure 2 As shown, the system comprises:

[0076] An adapter module, used to identify the binding status of the target user on the first business module or the second business module, generate a user authentication address according to the account information of the target user, and verify the user characteristics of the target user when the target user performs identity authentication;

[0077] In short, the adapter module in this application is used as a common processing module that is decoupled from each business module to complete the task of acquiring and processing information related to the target user identity.

[0078] an authentication module, configured to obtain the binding status of the target user in the second business module through the first account information of the first business module, and to bind the first account information of the target user in the first business module with the second account information of the second business module;

[0079] In short, the authentication module in this application completes the tasks related to the binding between the target user and the corresponding business module.

[0080] The adapter module is connected to the first business module and to the authentication module, the authentication module is connected to the second business module, and the first business module is used to perform identity authentication through the adapter module and the authentication module and access the second business module.

[0081] In a specific application scenario, during the development phase of an integrated application platform, an application authentication binding device, namely an authentication module, is developed. This device supports binding third-party business platform account information with an in-application account and the ability to obtain corresponding binding information based on the third-party business platform account information.

[0082] The adapter device, i.e., the adapter module, is developed to support the third-party business platform to generate the target user authentication address through the account information. Before the target user is authenticated, it can identify whether it is bound and enter the application. When the target user is authenticated, the relevant identity features of the target user are verified to confirm that the target user is the target user that the third-party business platform expects to authenticate.

[0083] In addition, when the third-party business platform integrates the application, the third-party business platform needs to generate a random number R1 used during docking and configure it to the application. At the same time, the integrated application generates a random number R2 for the third-party platform that corresponds to the platform one by one. For details, please refer to the description of the encryption part.

[0084] Figure 2 In fact, it is a specific application scenario. Figure 2On the basis of the corresponding implementation mode, the first business module is represented by 11, equipped with one or more third-party business platforms, the second business module is represented by 14, equipped with one or more target applications, the adapter module is represented by 12, and the authentication module, that is, the application authentication binding device in the figure is represented by 13. It should be noted that in the present application, the third-party business platform is used as the first business module, and the target application is used as the second business module as a specific example for explanation, so the corresponding concepts should be understood equivalently in the description of the corresponding implementation mode. However, the present application can also be used for the integration between multiple target applications or the integration between multiple third-party business platforms, or the integration of multiple third-party business platforms corresponding to one target application, or the integration of one third-party business platform corresponding to multiple target applications. In summary, the method and system provided in the present application do not limit the specific architecture in the first business module and the second business module, and the technical personnel can make adaptive adjustments according to the actual scenario.

[0085] This embodiment provides an integrated business platform including a first business module and a second business module, and a reusable adapter module and an authentication module decoupled from the business module are developed in the platform as a user identity authentication system of the integrated business platform. In the user identity authentication process, firstly, according to the first account information and identity authentication request input by the target user at the first business module end, an authentication address is generated through the adapter module and pushed to the target user, and then the user identity information is confirmed, and the binding status of the target user on the second business module is determined through the unique identifier of the user identity on the integrated business platform, and then the identity authentication is performed through the identity feature information encrypted by the target user on the first business module side and the second business module side respectively, and the application authority of the second business module is opened to the target user after the identity authentication is passed. As a result, the target user does not need to repeatedly perform identity authentication operations such as account login for each business module in the identity authentication process, which simplifies the authentication process, improves the user experience, and at the same time improves the security of data in the user identity authentication process, solving the problem that the identity authentication systems of each business module are different and cannot trust each other in the integrated scenario. In addition, as mentioned above, since user authentication is based on a separately developed user authentication system, the system includes reusable adapter modules and authentication modules that are decoupled from business modules, which also improves the practicality and universality of such user authentication methods and corresponding systems.

[0086] As an optional implementation manner, the first account information includes a first identity feature of the target user in the first business module;

[0087] The step of generating an authentication address through an adapter module according to the first account information includes:

[0088] Performing an encryption operation on the first identity feature through the adapter module to obtain an encrypted first encryption feature and generate a session sequence number;

[0089] generating an authentication address according to the first encryption feature and the session sequence number, and transmitting the authentication address to the first service module;

[0090] And, determining the user identity information through the adapter module, and determining the binding status of the target user on the second business module according to the user identity information through the authentication module, includes:

[0091] When the target user accesses the authentication address, the adapter module obtains the identity of the target user according to the session serial number, and determines the binding status of the target user on the second business module according to the identity.

[0092] In this embodiment, there is provided an information encryption process on the first business module side, and a method for determining the binding status of the target user in the second business module according to the user identity information. Specifically, in the process of generating the authentication address, the first identity feature is first encrypted by the adapter module according to the preset encryption method, thereby generating a session serial number, and then the corresponding authentication address is generated according to the session serial number and the first encryption feature corresponding to the user, and redirected to the corresponding authentication address on the terminal corresponding to the target user to obtain the corresponding identity identification. After obtaining the identity identification of the user in the integrated platform, the binding status on other business modules, such as the second business module, can be determined to perform the next authentication process. In this method, the user information obtained by the first business module side is directly encrypted by the adapter module on the first business module side, and the corresponding first identity feature can be ensured not to be leaked to other business modules, thereby improving the security of data in the user identity authentication process, and solving the problem that the identity authentication systems of various business modules are different and cannot trust each other in the integrated scenario.

[0093] As an optional implementation manner, the binding status of the target user on the second service module is already bound;

[0094] The performing identity authentication on the target user on the second service module according to the binding condition includes:

[0095] Acquire the second account information of the target user on the second module;

[0096] Wherein, the second account information includes a second identity feature;

[0097] Performing an encryption operation on the second identity feature to obtain an encrypted second encryption feature;

[0098] It is determined whether the first encryption feature is consistent with the second encryption feature. If the first encryption feature is consistent with the second encryption feature, the identity authentication is passed.

[0099] In this embodiment, a specific scheme for authenticating the target user on the second business module side is provided. Under the condition that the target user identity has been bound to the second business module, the second identity feature corresponding to the target user on the second business module is also isolated from the identity feature information of different business modules through the adapter, thereby ensuring the security of the information. After the second identity feature is encrypted using the same encryption algorithm, its correlation with the first encryption feature is confirmed, and then the authentication result is obtained, thereby improving the security of data in the user authentication process and solving the problem that the identity authentication systems of various business modules are different and cannot trust each other in the integrated scenario.

[0100] As an optional implementation manner, the binding status of the target user on the second service module is unbound;

[0101] The method further comprises:

[0102] Redirecting the target user to a login address via the adapter module;

[0103] According to the login address, determine the second account information of the target user on the second module, and determine whether the second account information of the target user is consistent with the first account information. If the second account information of the target user is consistent with the first account information, bind the target user to the second business module.

[0104] In this implementation, when the target user has not been bound to the second business module, the adapter is used to guide the target user to enter the corresponding second account information at the login address. When it is determined that the second account information of the target user is consistent with the first account information, the identity verification passes and the target user is bound to the second business module. After the binding, the relevant process of identity authentication can be directly performed in subsequent logins, which improves the practicality and universality of user identity authentication while ensuring data security.

[0105] As an optional implementation, the encryption operation includes:

[0106] A hash operation is performed on the first account information or the second identity feature according to the first encryption parameter and the second encryption parameter.

[0107] This implementation method uses the preset first encryption parameter and the second encryption parameter to perform a hash operation on the corresponding account information during the encryption process, thereby improving the security and practicality of data during the user identity authentication process.

[0108] As an optional implementation manner, the first encryption parameter includes a random number generated by the first business module and configured on the second business module during the establishment of the integrated business platform;

[0109] The second encryption parameter includes a random number generated by the second business module according to the first business module during the establishment of the integrated business platform.

[0110] In the follow-up Figure 3 and Figure 4 In the corresponding application scenario, the contents related to the hash operation, the first encryption parameter and the second encryption parameter will be described in detail.

[0111] In this embodiment, a specific implementation method of the first encryption parameter and the second encryption parameter is given. When the integrated business platform is established, the first business module generates the corresponding first encryption parameter and configures it to the second business module. At the same time, the second business module generates personalized second encryption parameters according to each first business module. The value of the second encryption parameter is random, and the relevant permissions can be further verified during storage and call, thereby improving the effectiveness of data encryption operations, and further improving the security and practicality of data in the user authentication process.

[0112] See also Figure 3 , Figure 3 A flowchart of a user identity authentication method based on an integrated business platform provided in one embodiment of the present application is shown in FIG. Figure 3 As shown, when the various embodiments are applied in combination, a specific process can be as shown in the figure, and the specific implementation method of each step can also refer to the corresponding embodiment.

[0113] As mentioned above, in specific application scenarios, the third-party business platform is used as the first business module, and the target application is used as the second business module as a specific example for explanation, so the corresponding concepts should be understood equally in the description of the corresponding implementation methods.

[0114] 1. The target user enters the account number or requests information from the third-party business platform to enter the target application;

[0115] 2. The third-party business platform transmits the account information of the current platform to the adapter device, wherein the account information includes the unique identifier of the target user on the third-party business platform and the first identity feature of the target user that has been authenticated on the third-party business platform (for example, the first feature is the ID number, assuming the parameter is I and the value is i, the second feature is the mobile phone number, assuming the parameter is P and the value is p, supporting the choice of one or the other, the identity feature is calculated through a hash algorithm, when the ID number is transmitted, I is equal to SHA256(R1+R2+i), when the mobile phone number is transmitted, P is equal to SHA256(R1+R2+p), ensuring that the target user features of the third-party business platform are not leaked to the application, while supporting the application to verify the target user), the adapter device generates a session sequence number, caches the relationship between the session sequence number and the account information of the third-party business platform, and returns an authentication address that can identify the session sequence;

[0116] 3. After the third-party business platform obtains the authentication address, it redirects the target user to the authentication address;

[0117] 4. When the target user accesses the authentication address, the adapter obtains the target user information based on the session serial number, and then obtains the binding information based on the target user's unique identifier uid in the target user information;

[0118] 5. If the target user has been bound, obtain the second identity feature of the target user that has been authenticated in the target application, where the ID number is i2 and the mobile phone number is p2, and perform identity verification. Identity verification method: judge based on the characteristic parameters of the target user transmitted by the third-party business. If the parameter transmitted by the third-party business platform is I, calculate I2=SHA256(R1+R2+i2), and then compare I and I2 to see if they are consistent. If they are consistent, enter the application directly. If the parameter transmitted by the third-party business platform is P, calculate P2=SHA256(R1+R2+p2), and then compare P and P2 to see if they are consistent. If they are consistent, enter the application directly. Otherwise, remind the target user that the identity features between the third-party business platform and the business platform have changed. If you need to continue to use the secondary authentication-free entry, you need to keep the identity features on both sides consistent, and the target user will make modifications on the third-party business platform;

[0119] 6. If the target user is not bound, redirect through the adapter to guide the target user to the application authentication page;

[0120] 7. When the target user completes the identity authentication binding through the authentication binding device, the identity feature verification method described in step 5 is applied for verification;

[0121] 8. In the case of no binding, if the authentication result shows that the features are consistent, the application account will be bound to the third-party business platform;

[0122] 9. If the features are inconsistent, the target user is reminded that the current account authentication has failed and needs to request re-authentication, and then execute step 6;

[0123] 10. After the binding is completed, the target user enters the application from the third-party business platform again and executes step 5.

[0124] See also Figure 4 , Figure 4 A flowchart of a user identity authentication method based on an integrated business platform provided in one embodiment of the present application is shown in FIG. Figure 4 As shown, when the various embodiments are combined and applied, Figure 3 Based on the corresponding implementation method, Figure 4 The method shown combines Figure 2 As shown in the figure, the various subjects in the user identity authentication system based on the integrated business platform, the specific steps can be found in Figure 3 For the description of each module in the system and its meaning, please refer to Figure 2 Related description.

[0125] Furthermore, the user in the figure is actually a terminal used by the target user, which is used to initiate a request to enter the target application, complete identity authentication by entering relevant information through the authentication address, or log in by entering relevant information through the login address, so as to bind or directly use the target application and other functions.

[0126] The third-party business platform is the first business module. Users initiate requests to enter the target application through the third-party business platform. The third-party business platform is also used to interact with the adapter to initiate requests for authentication address generation. In this application, the encryption and authentication of identity features do not go through specific business modules, but are implemented using separately developed adapter modules and authentication modules.

[0127] As shown in the figure, the adapter module obtains the user's unique identity uid from the third-party business platform. This identity is a global feature. In addition, the adapter module is also used to obtain and encrypt data related to the user's identity features. Through the application of identity identification and the isolation between the user's identity feature related data and the specific business module, there is no need to directly transmit the user's identity feature related data in the information interaction process, which improves the security of the data. In addition, the authentication binding device, that is, the authentication module, performs the binding function or determines the binding status according to the identity features of the target user on the third-party business platform side and the target application side, as well as the global identity identification and other information.

[0128] In summary, when the various embodiments of the present application are combined and applied, at least the following beneficial effects can be achieved:

[0129] This application uses the user's ID number, mobile phone number and other information as the first identity feature, and compares it with the user's authenticated second identity feature in the target application. It supports the selection of the first identity feature by a third-party business platform, and supports binding only when the features are consistent.

[0130] This application uses an adapter device to verify and associate the third-party business platform account information with the application account, so that the user can verify with the third-party business platform account after authentication and enter the application while keeping the user's third-party business platform and application account consistent. At the same time, when the user characteristics are transmitted, the hash calculation is performed by splicing the user characteristics with random parameters, thereby avoiding data leakage when the user information jumps from the third-party business platform to the application.

[0131] When a user requests to re-enter an application on a third-party business platform, the third-party business platform transmits user information to the application on the server side and the application generates an authentication address. When the user enters the authentication address, it identifies whether the user's identity on the third-party business platform has been bound. If it has been bound, there is no need to log in again.

[0132] In terms of architectural design, the adapter device and the application authentication binding device are separated, so that the association relationship between the application account and multiple third-party business platforms exists independently. When a new binding process is needed in the future, the application authentication binding device and the adapter device can be reused to reduce the integrated R&D cost.

[0133] The embodiment of the present application also provides a user identity authentication device based on an integrated service platform, the device comprising:

[0134] An acquisition module, used to acquire the first account information of the target user through the first business module;

[0135] A processing module, configured to generate an authentication address through an adapter module according to the first account information, and redirect the target user to the authentication address through the first business module;

[0136] The processing module is further used to determine the user identity information through the adapter module, and determine the binding status of the target user on the second business module according to the user identity information through the authentication module;

[0137] The processing module is further used to perform identity authentication on the target user on the second business module according to the binding situation, and if the identity authentication passes, open the application authority of the second business module to the target user.

[0138] The method corresponding to the present embodiment is applied to an integrated business platform including a first business module and a second business module. A reusable adapter module and an authentication module decoupled from the business module are developed in the platform as a user identity authentication system of the integrated business platform. In the user identity authentication process, firstly, according to the first account information and identity authentication request input by the target user at the first business module end, an authentication address is generated through the adapter module and pushed to the target user, and then the user identity information is confirmed. Through the unique identification of the user identity on the integrated business platform, the binding status of the target user on the second business module is determined, and then the identity authentication is performed through the identity feature information encrypted by the target user on the first business module side and the second business module side respectively. After the identity authentication is passed, the application rights of the second business module are opened to the target user. As a result, the target user does not need to repeatedly perform identity authentication operations such as account login for each business module in the identity authentication process, which simplifies the authentication process, improves the user experience, and at the same time improves the security of data in the user identity authentication process, solving the problem that the identity authentication systems of various business modules are different and cannot trust each other in the integrated scenario. In addition, as mentioned above, since user authentication is based on a separately developed user authentication system, the system includes reusable adapter modules and authentication modules that are decoupled from business modules, which also improves the practicality and universality of such user authentication methods and corresponding systems.

[0139] As an optional implementation manner, the first account information includes a first identity feature of the target user in the first business module;

[0140] The specific manner in which the processing module generates the authentication address through the adapter module according to the first account information includes:

[0141] Performing an encryption operation on the first identity feature through the adapter module to obtain an encrypted first encryption feature and generate a session sequence number;

[0142] generating an authentication address according to the first encryption feature and the session sequence number, and transmitting the authentication address to the first service module;

[0143] Furthermore, the processing module determines the user identity information through the adapter module, and determines the specific manner in which the target user is bound to the second business module according to the user identity information through the authentication module, including:

[0144] When the target user accesses the authentication address, the adapter module obtains the identity of the target user according to the session serial number, and determines the binding status of the target user on the second business module according to the identity.

[0145] In this embodiment, there is provided an information encryption process on the first business module side, and a method for determining the binding status of the target user in the second business module according to the user identity information. Specifically, in the process of generating the authentication address, the first identity feature is first encrypted by the adapter module according to the preset encryption method, thereby generating a session serial number, and then the corresponding authentication address is generated according to the session serial number and the first encryption feature corresponding to the user, and redirected to the corresponding authentication address on the terminal corresponding to the target user to obtain the corresponding identity identification. After obtaining the identity identification of the user in the integrated platform, the binding status on other business modules, such as the second business module, can be determined to perform the next authentication process. In this method, the user information obtained by the first business module side is directly encrypted by the adapter module on the first business module side, and the corresponding first identity feature can be ensured not to be leaked to other business modules, thereby improving the security of data in the user identity authentication process, and solving the problem that the identity authentication systems of various business modules are different and cannot trust each other in the integrated scenario.

[0146] As an optional implementation manner, the binding status of the target user on the second service module is already bound;

[0147] The specific manner in which the processing module performs identity authentication on the target user on the second business module according to the binding condition includes:

[0148] Acquire the second account information of the target user on the second module;

[0149] Wherein, the second account information includes a second identity feature;

[0150] Performing an encryption operation on the second identity feature to obtain an encrypted second encryption feature;

[0151] It is determined whether the first encryption feature is consistent with the second encryption feature. If the first encryption feature is consistent with the second encryption feature, the identity authentication is passed.

[0152] In this embodiment, a specific scheme for authenticating the target user on the second business module side is provided. Under the condition that the target user identity has been bound to the second business module, the second identity feature corresponding to the target user on the second business module is also isolated from the identity feature information of different business modules through the adapter, thereby ensuring the security of the information. After the second identity feature is encrypted using the same encryption algorithm, its correlation with the first encryption feature is confirmed, and then the authentication result is obtained, thereby improving the security of data in the user authentication process and solving the problem that the identity authentication systems of various business modules are different and cannot trust each other in the integrated scenario.

[0153] As an optional implementation, the specific manner in which the processing module performs the encryption operation includes:

[0154] A hash operation is performed on the first account information or the second identity feature according to the first encryption parameter and the second encryption parameter.

[0155] This implementation method uses the preset first encryption parameter and the second encryption parameter to perform a hash operation on the corresponding account information during the encryption process, thereby improving the security and practicality of data during the user identity authentication process.

[0156] As an optional implementation manner, the first encryption parameter includes a random number generated by the first business module and configured on the second business module during the establishment of the integrated business platform;

[0157] The second encryption parameter includes a random number generated by the second business module according to the first business module during the establishment of the integrated business platform.

[0158] In this embodiment, a specific implementation method of the first encryption parameter and the second encryption parameter is given. When the integrated business platform is established, the first business module generates the corresponding first encryption parameter and configures it to the second business module. At the same time, the second business module generates personalized second encryption parameters according to each first business module. The value of the second encryption parameter is random, and the relevant permissions can be further verified during storage and call, thereby improving the effectiveness of data encryption operations, and further improving the security and practicality of data in the user authentication process.

[0159] As an optional implementation manner, the binding status of the target user on the second service module is unbound;

[0160] The processing module is also used for:

[0161] redirecting the target user to a login address through the adapter module;

[0162] According to the login address, determine the second account information of the target user on the second module, and determine whether the second account information of the target user is consistent with the first account information. If the second account information of the target user is consistent with the first account information, bind the target user to the second business module.

[0163] In this implementation, when the target user has not been bound to the second business module, the adapter is used to guide the target user to enter the corresponding second account information at the login address. When it is determined that the second account information of the target user is consistent with the first account information, the identity verification passes and the target user is bound to the second business module. After the binding, the relevant process of identity authentication can be directly performed in subsequent logins, which improves the practicality and universality of user identity authentication while ensuring data security.

[0164] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the processing module can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The implementation of other modules is similar. In addition, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0165] Indicatively, Figure 5 As shown, Figure 5 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. The computer device 300 may be provided as a server. Figure 5 The computer device 300 includes a processing component 302, which further includes one or more processors, and a memory resource represented by a memory 301 for storing instructions executable by the processing component 302, such as an application. The application stored in the memory 301 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 302 is configured to execute the instructions to perform the text recognition method of any of the above embodiments.

[0166] The computer device 300 may further include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate based on an operating system stored in the memory 301, such as Windows Server TM, Mac OS X TM, Unix TM, Linux TM, Free BSD TM, or the like.

[0167] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0168] An embodiment of the present application provides a storage medium, in which computer-readable instructions are stored. When the computer-readable instructions are executed by one or more processors, the one or more processors execute a method provided in any embodiment.

[0169] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0170] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can refer to each other.

[0171] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A user identity authentication system based on an integrated business platform, characterized in that: The system comprises: An adapter module, used to identify the binding status of the target user on the first business module or the second business module, generate a user authentication address according to the account information of the target user, and verify the user characteristics of the target user when the target user performs identity authentication; an authentication module, configured to obtain the binding status of the target user in the second business module through the first account information of the first business module, and to bind the first account information of the target user in the first business module with the second account information of the second business module; The adapter module is connected to the first business module and to the authentication module, the authentication module is connected to the second business module, and the first business module is used to perform identity authentication through the adapter module and the authentication module and access the second business module.

2. A user identity authentication method based on an integrated business platform, characterized in that: The method is applied to the system as claimed in claim 1, and the method comprises: Obtaining the first account information of the target user through the first business module; Generate an authentication address through an adapter module according to the first account information, and redirect the target user to the authentication address through the first business module; Determine the user identity information through the adapter module, and determine the binding status of the target user on the second business module according to the user identity information through the authentication module; According to the binding situation, identity authentication is performed on the target user in the second business module. If the identity authentication passes, the application authority of the second business module is opened to the target user.

3. The method according to claim 2, characterized in that The first account information includes a first identity feature of the target user in the first business module; The step of generating an authentication address through an adapter module according to the first account information includes: Performing an encryption operation on the first identity feature through the adapter module to obtain an encrypted first encryption feature and generate a session sequence number; generating an authentication address according to the first encryption feature and the session sequence number, and transmitting the authentication address to the first service module; And, determining the user identity information through the adapter module, and determining the binding status of the target user on the second business module according to the user identity information through the authentication module, includes: When the target user accesses the authentication address, the adapter module obtains the identity of the target user according to the session serial number, and determines the binding status of the target user on the second business module according to the identity.

4. The method according to claim 2, characterized in that: The binding status of the target user on the second service module is already bound; The performing identity authentication on the target user on the second service module according to the binding condition includes: Acquire the second account information of the target user on the second module; Wherein, the second account information includes a second identity feature; Performing an encryption operation on the second identity feature to obtain an encrypted second encryption feature; It is determined whether the first encryption feature is consistent with the second encryption feature. If the first encryption feature is consistent with the second encryption feature, the identity authentication is passed.

5. The method according to claim 3 or 4, characterized in that: The encryption operation includes: A hash operation is performed on the first account information or the second identity feature according to the first encryption parameter and the second encryption parameter.

6. The method according to claim 5, characterized in that The first encryption parameter includes a random number generated by the first service module and configured on the second service module during the establishment of the integrated service platform; The second encryption parameter includes a random number generated by the second business module according to the first business module during the establishment of the integrated business platform.

7. The method according to claim 4, characterized in that The binding status of the target user on the second service module is unbound; The method further comprises: Redirecting the target user to a login address via the adapter module; According to the login address, determine the second account information of the target user on the second module, and determine whether the second account information of the target user is consistent with the first account information. If the second account information of the target user is consistent with the first account information, bind the target user to the second business module.

8. A user identity authentication device based on an integrated business platform, characterized in that: The device comprises: An acquisition module, used to acquire the first account information of the target user through the first business module; A processing module, configured to generate an authentication address through an adapter module according to the first account information, and redirect the target user to the authentication address through the first business module; The processing module is further used to determine the user identity information through the adapter module, and determine the binding status of the target user on the second business module according to the user identity information through the authentication module; The processing module is further used to perform identity authentication on the target user on the second business module according to the binding situation, and if the identity authentication passes, open the application authority of the second business module to the target user.

9. A computer device, characterized in that: The method comprises one or more processors and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the method according to any one of claims 2 to 7 are performed.

10. A storage medium, characterized in that: The storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the method according to any one of claims 2 to 7.

Images