Mobile terminal single sign-on method and device, storage medium, equipment and product

Abstract

The invention relates to the technical field of single sign-on, and particularly provides a mobile terminal single sign-on method, a mobile terminal single sign-on device, a storage medium, equipment and a product, the method is applied to an identity authentication terminal, and the method comprises the following steps: receiving authorization application information sent by a client, the authorization application information comprises a login token ciphertext, a service identifier of a third-party service system and an interface input parameter signature value; after it is confirmed that the authorization application information passes verification, authorization information is generated, and the authorization information comprises an address and an authorization code of the third-party service system; and sending the authorization information to the client, so that the client accesses the third-party service system through the address and the authorization code, and the third-party service system obtains user information through the authorization code. According to the embodiment of the invention, the problem that a user needs to log in repeatedly when logging in a third-party service system in a single sign-on mode due to the fact that the mobile terminal does not have cache data is solved.

Description

Technical Field

[0001] The present application relates to the field of single sign-on technology, and more specifically, to a method, apparatus, storage medium, device and product for single sign-on on a mobile terminal. Background Art

[0002] Single Sign-On (SSO) is a user authentication and authorization solution that allows users to log in to multiple interrelated applications and websites using a set of credentials (such as username and password) without having to re-enter the credentials in each application and website.

[0003] Usually, the user's login session ID is written into the front-end page cache. Each time a single sign-on is performed, the unified identity authentication system obtains the user's login session ID from the cache, determines the current user login status, and generates an authorization code. However, there is no cache mechanism in the mobile app, and the user's login session ID cannot be stored, resulting in the need to re-login each time the user accesses a third-party business system, which reduces login efficiency.

[0004] Therefore, how to provide a technical solution for an efficient mobile terminal single sign-on method has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of some embodiments of the present application is to provide a method, apparatus, storage medium, equipment and product for single sign-on on a mobile terminal. The technical solution of the embodiments of the present application solves the problem that a user needs to log in again every time he accesses a third-party business system, thereby ensuring the security of single sign-on and improving the efficiency of single sign-on.

[0006] In the first aspect, some embodiments of the present application provide a method for single sign-on on a mobile terminal, which is applied to an identity authentication terminal, including: receiving authorization application information sent by a client, wherein the authorization application information includes: a login token ciphertext, a business identifier of a third-party business system, and an interface input parameter signature value; after confirming that the authorization application information has passed the verification, generating authorization information, wherein the authorization information includes: an address and an authorization code of the third-party business system; sending the authorization information to the client, so that the client can access the third-party business system through the address and the authorization code, and the third-party business system obtains user information through the authorization code.

[0007] Some embodiments of the present application generate authorization information and feed it back to the client after verifying the login token ciphertext and the interface input parameter signature value in the authorization application information sent by the client, so that the client can access the third-party business system through the authorization information, and the third-party business system can obtain user information through the authorization code. Some embodiments of the present application can use the authorization information to access the third-party business system through the client, and the third-party business system can obtain user information from the identity authentication end through the authorization code, which can solve the problem that the user needs to log in again every time to access the third-party business system, and improve the efficiency of single sign-on; the user's login status is determined by the login token ciphertext, and the security of data transmission can be improved through encryption and signing.

[0008] In some embodiments, confirming that the authorization application information has passed the verification includes: decrypting the login token ciphertext to determine the login status of the current user; confirming that the verification result of the interface input parameter signature value is passed, and confirming that the time corresponding to the timestamp in the interface input parameter signature value has passed the verification.

[0009] Some embodiments of the present application can timely learn the login status of the current user by decrypting the login token ciphertext and verifying the signature value of the interface input parameter to ensure the security of the login.

[0010] In some embodiments, generating the authorization information includes: generating the authorization code based on the business identifier and the login token decrypted from the login token ciphertext, and determining the address of the third-party business system through redirection.

[0011] Some embodiments of the present application generate an authorization code through a business identifier and a login token, and determine the address of a third-party business system, so that the client can correctly access the third-party business system.

[0012] In some embodiments, after sending the authorization information to the client, the method further includes: receiving the authorization code sent by the third-party business system; sending an access token to the third-party business system if the authorization code is verified; receiving the access token sent by the third-party business system; and generating user data and sending the user data to the third-party business system if it is confirmed that the access token is verified; wherein the user data includes: a user information ciphertext and a user information signature value, so that the third-party business system can decrypt and verify the user data to obtain the user information.

[0013] Some embodiments of the present application implement secure access and transmission of user information through interaction between an identity authentication terminal and a third-party business system, and user information during the interaction is transmitted in an encrypted manner.

[0014] In the second aspect, some embodiments of the present application provide a method for single sign-on on a mobile terminal, which is applied to an identity authentication terminal and a third-party business system, including: receiving an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by the identity authentication terminal after the authorization application information of the client is verified; the authorization application information includes: a login token ciphertext, a business identifier of the third-party business system, and an interface input parameter signature value; sending the authorization code to the identity authentication terminal so that the identity authentication terminal returns an access token; sending the access token to the identity authentication terminal so that the identity authentication terminal generates and sends user data after confirming that the access token has passed the verification; wherein the user data includes: a user information ciphertext and a user information signature value; receiving the user data, decrypting the user information ciphertext, and confirming that the user information signature value has passed the verification, thereby obtaining the user information.

[0015] Some embodiments of the present application implement secure access and transmission of user information through interaction between an identity authentication terminal and a third-party business system, and user information during the interaction is transmitted in an encrypted manner.

[0016] On the third aspect, some embodiments of the present application provide a mobile terminal single sign-on device, which is applied to the identity authentication terminal, including: an application receiving module, used to receive authorization application information sent by the client, wherein the authorization application information includes: a login token ciphertext, a business identifier of a third-party business system, and an interface input parameter signature value; a generation module, used to generate authorization information after confirming that the authorization application information has passed the verification, wherein the authorization information includes: an address and an authorization code of the third-party business system; a sending module, used to send the authorization information to the client, so that the client can access the third-party business system through the address and the authorization code, and the third-party business system obtains user information through the authorization code.

[0017] In a fourth aspect, some embodiments of the present application provide a mobile terminal single sign-on device, which is applied to a third-party business system, including: an access receiving module, used to receive an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by an identity authentication terminal after the authorization application information of the client is verified; the authorization application information includes: a login token ciphertext, a business identifier of the third-party business system, and an interface input parameter signature value; a first sending module, used to send the authorization code to the identity authentication terminal, so that the identity authentication terminal returns an access token; a second sending module, used to send the access token to the identity authentication terminal, so that the identity authentication terminal generates and sends user data after confirming that the access token has passed the verification; wherein the user data includes: a user information ciphertext and a user information signature value; a data receiving module, used to receive the user data, decrypt the user information ciphertext, and confirm that the user information signature value has passed the verification, and obtain the user information.

[0018] In a fifth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0019] In a sixth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement a method as described in any embodiment of the first aspect.

[0020] In a seventh aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A prior art single sign-on flow chart provided for some embodiments of the present application;

[0023] Figure 2 A system diagram of mobile terminal single sign-on provided for some embodiments of the present application;

[0024] Figure 3 One of the flow charts of the method of single sign-on on a mobile terminal provided in some embodiments of the present application;

[0025] Figure 4 A second flow chart of a method for single sign-on on a mobile terminal provided for some embodiments of the present application;

[0026] Figure 5 A third flow chart of a method for single sign-on on a mobile terminal provided for some embodiments of the present application;

[0027] Figure 6 One of the block diagrams of the apparatus for single sign-on on a mobile terminal provided in some embodiments of the present application;

[0028] Figure 7 The second block diagram of the device composition of the single sign-on on the mobile terminal provided in some embodiments of the present application;

[0029] Figure 8 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0030] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0031] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0032] In related technologies, the main process of single sign-on is as follows: Figure 1As shown, it includes a client, a unified identity authentication system and a third-party business system. When a user accesses a third-party business system through a client, after completing the identity authentication by opening the login page of the unified identity authentication system through the single-point address spliced ​​by the third-party business system, the unified identity authentication system redirects the address of the third-party business system and splices the authorization code generated by the unified identity authentication system. The third-party business system requests access_token from the unified identity authentication system through the authorization code, and uses the access_token to request user information from the unified identity authentication system. Among them, the user login information is cached in the unified identity authentication system server, and the current browser caches the user login session identifier. When the user accesses other third-party business systems, the browser will pass the session identifier to the unified identity authentication system server in a secure way. The unified identity authentication system generates an authorization code based on the current session identifier, and splices it behind the address of the third-party business system when redirecting the third-party business system. The third party obtains the current login user information according to the OAuth login process. It should be understood that token has two uses in actual applications: one is user identity authentication, confirming that the user has the right to access or use related services, and the other is permission control, that is, controlling the user's access rights to different resources, and the user can only access authorized resources.

[0033] However, since the user login session ID is written into the front-end page cache, the unified identity authentication system obtains the user login session ID from the cache each time a single sign-on is performed, and generates an authorization code after determining the current user login status. However, there is no cache mechanism in the mobile app, and the user login session ID cannot be stored, resulting in the need to re-login each time the user accesses a third-party business system, reducing the efficiency of single sign-on.

[0034] In view of this, some embodiments of the present application provide a method for single sign-on on a mobile terminal, in which the third-party business system uses the login token and other information of the current logged-in user during single sign-on. The client calls the unified identity authentication system through the back-end method to obtain the code, and then redirects to the third-party business system. When the client accesses the third-party business system, the code can be spliced ​​after the address. The third-party business system interacts with the unified identity authentication system through the code to obtain the access token, and obtains the user information through the token. Compared with the single sign-on method of the front end in the prior art, the unified identity authentication system reduces the loading time of the interaction with the third-party business system and the web page interaction in some embodiments of the present application. The user single sign-on to the third-party business system is smoother, and the efficiency of single sign-on is improved; the single sign-on is changed from the original front-end interaction to the back-end interface call of the client, which reduces the risk of data being intercepted and obtained during the interaction between the client, the unified identity authentication system and the third-party business system. In addition, since the mobile terminal applet has no caching mechanism, the standard OAuth single sign-on process cannot meet the user's single sign-on requirements for the third-party business system. Through this application, the problem of user single sign-on to the third-party business system is solved without the need to modify the third-party business system.

[0035] The following is combined with Figure 2 The overall composition structure of the mobile terminal single sign-on system provided by some embodiments of the present application is exemplified.

[0036] like Figure 2 As shown, some embodiments of the present application provide a mobile terminal single sign-on system, which may include: a client 100, an identity authentication terminal 200 (that is, a unified identity authentication system), and a third-party business system 300. Among them, the client 100 can interact with the identity authentication terminal 200 to obtain the address and authorization code code of the redirected third-party business system 300; then the client 100 can access the third-party business system 300 through the address and code. The third-party business system 300 requests an access token access_token from the identity authentication terminal 200 through the code, so that the third-party business system 300 can obtain the currently logged-in user information from the identity authentication terminal 200 through the access_token.

[0037] The following is combined with Figure 3 The implementation process of single sign-on on a mobile terminal performed by the identity authentication terminal 200 provided in some embodiments of the present application is exemplified.

[0038] Please see attached Figure 3 , Figure 3 A flow chart of a method for single sign-on on a mobile terminal is provided for some embodiments of the present application. The method for single sign-on on a mobile terminal may include:

[0039] S210, receiving authorization application information sent by the client, wherein the authorization application information includes: a login token ciphertext, a service identifier of a third-party service system, and an interface input parameter signature value.

[0040] For example, in some embodiments of the present application, the unified identity authentication system may receive authorization application information sent by the client 100. The authorization application information is obtained by the following method:

[0041] 1) The user opens a login page on a certain A business system (that is, a certain applet) of the client 100 and completes the user login on the login page.

[0042] 2) After confirming the user login, the unified identity authentication system generates a login token (as a specific example of a login token). The A business system can subsequently use the token to request the unified identity authentication system to obtain the currently logged-in user information and login status. The unified identity authentication system encrypts the login token with the pre-stored key corresponding to the user information, and returns the login token ciphertext to the A business system of the client 100.

[0043] 3) After the user clicks on the third-party business system 300 that needs to be accessed in business system A, business system A can request an authorization code code through the interface service provided by the unified identity authentication system.

[0044] When sending an authorization request, the client 100 generates authorization application information in the following manner: Business system A uses the pre-stored unified identity authentication system public key to encrypt the login token and obtain the ciphertext (as a specific example of the login token ciphertext). Business system A generates a timestamp as the interface input parameter content, and uses the local private key to sign the interface input parameter content to obtain the signature value (as a specific example of the interface input parameter signature value). The backend of business system A calls the authorization code code interface of the unified identity authentication system, and the input parameters (that is, the authorization application information) are the ciphertext of the login token, the third-party business system identifier ClientID (as a specific example of the business identifier) ​​and the signature value.

[0045] S220, after confirming that the authorization application information passes the verification, generate authorization information, wherein the authorization information includes: the address and authorization code of the third-party business system.

[0046] For example, in some embodiments of the present application, the unified identity authentication system first verifies the authorization application information and generates a code after the verification is passed.

[0047] Specifically, in some embodiments of the present application, S220 may include: decrypting the login token ciphertext to determine the login status of the current user; confirming that the verification result of the interface input parameter signature value is passed, and confirming that the time corresponding to the timestamp in the interface input parameter signature value has passed the verification.

[0048] For example, in some embodiments of the present application, the unified identity authentication system uses a pre-stored key to decrypt the request content (i.e., the authorization application information) and then verify whether the relevant content in the authorization application information has been verified. That is, after the unified identity authentication system obtains the timestamp, it confirms that the verification result of the signature value of the interface input parameter is passed, and then parses the timestamp in the interface input parameter to obtain the corresponding time, verifies the time, and confirms that the time difference between the time and the time on the unified identity authentication system is within the preset time (for example, the preset time is five minutes), then confirms that the timestamp has passed the verification; the unified identity authentication system uses the local private key to decrypt the ciphertext of the login token, obtains the login token plaintext, verifies the login token, obtains the login status of the current user, and confirms that it is in the logged-in state, so as to enter the next process in the logged-in state.

[0049] In some embodiments of the present application, S220 may include: generating the authorization code based on the business identifier and the login token decrypted from the login token ciphertext, and determining the address of the third-party business system through redirection.

[0050] For example, in some embodiments of the present application, the unified identity authentication system generates an authorization code code for accessing the third-party business system 300 according to the third-party business system identifier ClientID and the login token, and redirects the third-party business system address URL. The URL may include the code (that is, the code may be spliced ​​into the URL).

[0051] S230: Send the authorization information to the client so that the client can access the third-party business system through the address and the authorization code, and the third-party business system obtains user information through the authorization code.

[0052] For example, in some embodiments of the present application, the unified identity authentication system sends a URL (in this case, the URL is the result of concatenating the address of the third-party business system and the code) to the client 100. Alternatively, the unified identity authentication system may send a URL (in this case, the URL only refers to the address of the third-party business system) and a code to the client 100.

[0053] In some embodiments of the present application, after executing S230, the method for single sign-on on a mobile terminal further includes:

[0054] S231, receiving the authorization code sent by the third-party business system.

[0055] For example, in some embodiments of the present application, a user opens the URL of a third-party business system on the client 100 (the URL is the result of the concatenation of the address of the third-party business system and the code) to obtain an authorization code. The third-party business system 300 can send the code to the unified identity authentication system to apply for an access token access_token. The unified identity authentication system receives the code.

[0056] S232: Send an access token to the third-party business system if the authorization code passes the verification.

[0057] For example, in some embodiments of the present application, the unified identity authentication system verifies the authorization code code of the third-party business system 300, and confirms that the code is consistent with the local one, and the verification is successful; then the unified identity authentication system returns the access token access_token to the third-party business system 300.

[0058] S233: Receive the access token sent by the third-party business system.

[0059] For example, in some embodiments of the present application, after receiving the access token access_token, the third-party business system 300 sends the access token access_token to access the user information of the unified identity authentication system.

[0060] S234, when confirming that the access token has passed the verification, generates user data and sends the user data to the third-party business system; wherein the user data includes: user information ciphertext and user information signature value, so that the third-party business system can decrypt and verify the user data to obtain the user information.

[0061] For example, in some embodiments of the present application, the unified identity authentication system verifies the received access token access_token and confirms that it is consistent with the locally stored access token to confirm that the third-party business system 300 has the right to access the user information. Afterwards, the unified identity authentication system uses its own private key to electronically sign the returned user information to obtain the user information signature value. The unified identity authentication system uses the pre-stored system public key of the third-party business system 300 to encrypt the user information and the user information signature value to obtain the user information ciphertext. The unified identity authentication system returns the user information ciphertext and the user information signature value to the third-party business system 300. The third-party business system 300 first uses the local private key to decrypt the user information ciphertext to obtain the user information plaintext. Afterwards, based on the user information plaintext, the third-party business system 300 uses the pre-stored public key of the unified identity authentication system to verify the user information signature value, confirm that the verification is passed, and obtain the user information. Alternatively, in another embodiment, the user information can also be encrypted first and then signed, and the user information signature value and the user information original text can be encrypted and transmitted to the third-party business system 300 during transmission. The third-party service system 300 first decrypts and then verifies the signature to obtain the user information. It should be noted that the order of signing and encrypting the user information can be adjusted according to the actual scenario, and the embodiment of the present application is not limited thereto.

[0062] The following is combined with Figure 4 The specific process of single sign-on on a mobile terminal performed by a third-party business system 300 provided in some embodiments of the present application is exemplified.

[0063] Please see attached Figure 4 , Figure 4 A flow chart of a method for single sign-on on a mobile terminal is provided for some embodiments of the present application. The method for single sign-on on a mobile terminal may include: S310, receiving an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by an identity authentication terminal after the authorization application information of the client is verified; the authorization application information includes: a login token ciphertext, a business identifier of the third-party business system, and an interface input parameter signature value; S320, sending the authorization code to the identity authentication terminal so that the identity authentication terminal returns an access token; S330, sending the access token to the identity authentication terminal so that the identity authentication terminal generates and sends user data after confirming that the access token has passed the verification; wherein the user data includes: a user information ciphertext and a user information signature value; S340, receiving the user data, decrypting the user information ciphertext, and confirming that the user information signature value has passed the verification, to obtain the user information.

[0064] It should be noted that the specific implementation process of S310 to S340 can refer to the above Figure 3 To avoid repetition, detailed description of the method embodiments provided is appropriately omitted here.

[0065] The following is combined with Figure 5 The specific process of single sign-on on a mobile terminal provided by some embodiments of the present application is exemplified.

[0066] Please see attached Figure 5 , Figure 5 A flow chart of a method for single sign-on on a mobile terminal is provided for some embodiments of the present application.

[0067] The following is an example of the interaction process between the client, the unified identity authentication system and the third-party business system.

[0068] S401, the client requests to log in to the unified identity authentication system and opens the login page.

[0069] S402, the client completes login on the login page.

[0070] S403, the unified identity authentication system returns a login token to the client.

[0071] S404, the client requests the third-party business system authorization code code from the unified identity authentication system. The request includes the authentication token and the third-party business system identity identifier ClientID.

[0072] S405, the unified identity authentication system generates an authorization code code for the third-party business system, and redirects the third-party business system access address URL, which includes the authorization code code.

[0073] S406, the unified identity authentication system sends a URL to the client.

[0074] S407, the client sends an access request to the third-party business system, and the URL in the access request includes the code.

[0075] S408, the third-party business system sends a code to the unified identity authentication system.

[0076] S409, after the unified identity authentication system verifies the code, it returns an access token to the third-party business system.

[0077] S410, the third-party business system sends an access token to the unified identity authentication system.

[0078] S411, the unified identity authentication system sends the user information ciphertext and the user information signature value to the third-party business system.

[0079] S412, the third-party business system decrypts the ciphertext of the user information and confirms that the signature value of the user information passes the verification to obtain the plaintext of the user information.

[0080] It should be noted that the specific implementation process of the relevant data transmission, encryption, etc. of S401 to S412 can refer to the method embodiment provided above. To avoid repetition, the detailed description is appropriately omitted here.

[0081] Through some of the above-mentioned embodiments of the present application, it can be seen that the present application improves the common authorization access protocol, solves the problem that the mobile terminal lacks a cache and cannot verify the current user login status, and the user needs to log in every time to access the third-party business system. By encrypting and signing the data during the interaction process, the security problem of user identity being misused due to cache storage leakage is solved. In addition, sensitive information such as login tokens and user information is electronically signed and encrypted, which enhances the non-repudiation and confidentiality of data in the business. In addition, the authorization code can be set with a validity period (such as 5 seconds), and it will become invalid after a single use to prevent the information from being intercepted and misused.

[0082] Please refer to Figure 6 , Figure 6 The following is a block diagram of the composition of the mobile terminal single sign-on device provided by some embodiments of the present application. It should be understood that the mobile terminal single sign-on device corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the mobile terminal single sign-on device can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0083] Figure 6 The mobile terminal single sign-on device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the mobile terminal single sign-on device. The mobile terminal single sign-on device is applied to the identity authentication terminal, including: an application receiving module 510, used to receive authorization application information sent by the client, wherein the authorization application information includes: a login token ciphertext, a business identifier of a third-party business system, and an interface input parameter signature value; a generation module 520, used to generate authorization information after confirming that the authorization application information has passed the verification, wherein the authorization information includes: an address and an authorization code of the third-party business system; a sending module 530, used to send the authorization information to the client, so that the client can access the third-party business system through the address and the authorization code, and the third-party business system obtains user information through the authorization code.

[0084] Please refer to Figure 7 , Figure 7The following is a block diagram of the composition of the mobile terminal single sign-on device provided by some embodiments of the present application. It should be understood that the mobile terminal single sign-on device corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the mobile terminal single sign-on device can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0085] Figure 7 The mobile terminal single sign-on device includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the mobile terminal single sign-on device. The mobile terminal single sign-on device is applied to a third-party business system and includes: an access receiving module 610, which is used to receive an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by the identity authentication end after the authorization application information of the client is verified; the authorization application information includes: a login token ciphertext, a business identifier of the third-party business system, and an interface input parameter signature value; a first sending module 620, which is used to send the authorization code to the identity authentication end so that the identity authentication end returns an access token; a second sending module 630, which is used to send the access token to the identity authentication end so that the identity authentication end generates and sends user data after confirming that the access token has passed the verification; wherein the user data includes: a user information ciphertext and a user information signature value; a data receiving module 640, which is used to receive the user data, decrypt the user information ciphertext, and obtain the user information when confirming that the user information signature value has passed the verification.

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0087] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0088] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0089] like Figure 8As shown, some embodiments of the present application provide an electronic device 700, which includes: a memory 710, a processor 720, and a computer program stored in the memory 710 and executable on the processor 720, wherein the processor 720 can implement a method as described in any of the above embodiments when reading the program from the memory 710 through a bus 730 and executing the program.

[0090] Processor 720 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 720 can be a microprocessor.

[0091] The memory 710 may be used to store instructions executed by the processor 720 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 720 of the disclosed embodiment may be used to execute instructions in the memory 710 to implement the method shown above. The memory 710 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0092] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0093] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0094] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for single sign-on on a mobile terminal, characterized in that: Applied to the identity authentication end, including: Receive authorization application information sent by the client, wherein the authorization application information includes: login token ciphertext, service identifier of the third-party service system and interface input parameter signature value; After confirming that the authorization application information has passed the verification, generating authorization information, wherein the authorization information includes: the address and authorization code of the third-party business system; The authorization information is sent to the client so that the client can access the third-party business system through the address and the authorization code, and the third-party business system obtains user information through the authorization code.

2. The method according to claim 1, characterized in that The step of confirming that the authorization application information has passed the verification includes: Decrypting the login token ciphertext to determine the current user's login status; Confirm that the verification result of the interface input parameter signature value is passed, and confirm that the time corresponding to the timestamp in the interface input parameter signature value is verified.

3. The method according to claim 1 or 2, characterized in that The generating of authorization information includes: Based on the business identifier and the login token decrypted from the login token ciphertext, the authorization code is generated, and the address of the third-party business system is determined through redirection.

4. The method according to claim 1 or 2, characterized in that: After sending the authorization information to the client, the method further includes: Receiving the authorization code sent by the third-party business system; When the authorization code is verified, an access token is sent to the third-party business system; Receiving the access token sent by the third-party business system; When it is confirmed that the access token has passed the verification, user data is generated and sent to the third-party business system; wherein the user data includes: user information ciphertext and user information signature value, so that the third-party business system can decrypt and verify the user data to obtain the user information.

5. A method for single sign-on on a mobile terminal, characterized in that: Applied to third-party business systems, including: Receive an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by the identity authentication end after the authorization application information of the client is verified; the authorization application information includes: a login token ciphertext, a business identifier of the third-party business system, and an interface input parameter signature value; Sending the authorization code to the identity authentication end so that the identity authentication end returns an access token; Sending the access token to the identity authentication end, so that the identity authentication end generates and sends user data after confirming that the access token has passed the verification; wherein the user data includes: user information ciphertext and user information signature value; The user data is received, the user information ciphertext is decrypted, and the user information is obtained when it is confirmed that the user information signature value passes the verification.

6. A mobile terminal single sign-on device, characterized in that: Applied to the identity authentication end, including: The application receiving module is used to receive the authorization application information sent by the client, wherein the authorization application information includes: the login token ciphertext, the service identifier of the third-party service system and the interface input parameter signature value; A generating module, configured to generate authorization information after confirming that the authorization application information has passed the verification, wherein the authorization information includes: the address and authorization code of the third-party business system; The sending module is used to send the authorization information to the client, so that the client can access the third-party business system through the address and the authorization code, and the third-party business system obtains user information through the authorization code.

7. A mobile terminal single sign-on device, characterized in that: Applied to third-party business systems, including: The access receiving module is used to receive an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by the identity authentication end after the authorization application information of the client is verified; the authorization application information includes: a login token ciphertext, a business identifier of the third-party business system, and an interface input parameter signature value; A first sending module, used for sending the authorization code to the identity authentication end, so that the identity authentication end returns an access token; The second sending module is used to send the access token to the identity authentication end, so that the identity authentication end generates and sends user data after confirming that the access token has passed the verification; wherein the user data includes: user information ciphertext and user information signature value; The data receiving module is used to receive the user data, decrypt the user information ciphertext, and obtain the user information when confirming that the user information signature value passes the verification.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 5 when executed by a processor.

9. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 5 when being run by the processor.

10. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 5 when executed by a processor.

Images