A mobile terminal single sign-on method, device, storage medium, equipment and product

Abstract

The application relates to the technical field of single sign-on, and particularly provides a mobile terminal single sign-on method, device, storage medium, equipment and product. The method is applied to an identity authentication terminal and comprises the following steps: receiving authorization application information sent by a client, wherein the authorization application information comprises login token ciphertext, a business identifier of a third-party business system and an interface input parameter signature value; generating authorization information after confirming that the authorization application information passes verification, wherein the authorization information comprises an address of the third-party business system and an authorization code; and sending the authorization information to the client, so that the client accesses the third-party business system through the address and the authorization code, and the third-party business system acquires user information through the authorization code. The embodiment of the application solves the problem that a user needs to repeatedly log in when logging in to a third-party business system due to the fact that a mobile terminal does not have cached data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of single sign-on, in particular to a mobile terminal single sign-on method, device, storage medium, equipment and product. BACKGROUND

[0002] Single sign-on (SSO) is a user authentication and authorization solution that allows users to log in to multiple interconnected applications and websites using a set of credentials (such as a username and password) without having to re-enter the credentials in each application and website.

[0003] Usually, the session identifier of the user login is written into the front-end page cache. Each time the single sign-on is performed, the unified identity authentication system obtains the session identifier of the user login from the cache, generates an authorization code code after judging the current user login state. However, there is no cache mechanism in the mobile terminal applet, and the session identifier of the user login cannot be stored, resulting in the need for re-login each time the user accesses the third-party business system, which reduces the login efficiency.

[0004] Therefore, how to provide a technical solution of an efficient mobile terminal single sign-on method has become a technical problem to be solved. SUMMARY

[0005] Some embodiments of the present application aim to provide a mobile terminal single sign-on method, device, storage medium, equipment and product, which solves the problem of re-login each time the user accesses the third-party business system, and improves the efficiency of single sign-on while ensuring the security of single sign-on.

[0006] In a first aspect, some embodiments of the present application provide a mobile terminal single sign-on method applied to an identity authentication terminal, comprising: receiving authorization application information sent by a client, wherein the authorization application information comprises: login token ciphertext, business identifier of a third-party business system and interface input parameter signature value; generating authorization information after confirming that the authorization application information passes the verification, wherein the authorization information comprises: address of the third-party business system and authorization code; and sending the authorization information to the client, so that the client accesses the third-party business system through the address and the authorization code, and the third-party business system obtains user information through the authorization code.

[0007] Some embodiments of the present application generate authorization information and feed back to the client after verifying the login token ciphertext and interface parameter signature value in the authorization application information sent by the client, so that the client can access the third-party business system through the authorization information, and the third-party business system can obtain user information through the authorization code. Some embodiments of the present application can use the authorization information to access the third-party business system through the client, and the third-party business system can obtain user information from the identity authentication end through the authorization code, which can solve the problem that the user needs to log in again every time the user accesses the third-party business system, and improve the efficiency of single sign-on; the login state of the user is determined through the login token ciphertext, and the security of data transmission can be improved through encryption and signature.

[0008] In some embodiments, the verification of the authorization application information includes: decrypting the login token ciphertext to determine the login state of the current user; verifying that the signature result of the interface parameter signature value is passed, and verifying that the time corresponding to the timestamp in the interface parameter signature value is passed.

[0009] Some embodiments of the present application can learn the login state of the current user in time by decrypting the login token ciphertext, and can guarantee the security of login by verifying the signature of the interface parameter signature value.

[0010] In some embodiments, the generation of the authorization information includes: generating the authorization code based on the business identifier and the login token decrypted from the login token ciphertext, and determining the address of the third-party business system through redirection.

[0011] Some embodiments of the present application generate the authorization code based on the business identifier and the login token, and determine the address of the third-party business system, which can enable the client to correctly access the third-party business system.

[0012] In some embodiments, after the authorization information is sent to the client, the method further includes: receiving the authorization code sent by the third-party business system; sending an access token to the third-party business system if the authorization code is verified; receiving the access token sent by the third-party business system; generating user data and sending the user data to the third-party business system if the access token is verified, wherein the user data includes user information ciphertext and user information signature value, so that the third-party business system can decrypt and verify the user data to obtain the user information.

[0013] Some embodiments of the present application realize the secure access and transmission of user information through the interaction between the identity authentication end and the third-party business system, and the user information is transmitted in an encrypted manner in the interaction process.

[0014] In a second aspect, some embodiments of the present application provide a mobile end single sign-on method applied to an identity authentication end and a third-party business system, comprising: receiving an access request sent by a client, wherein the access request comprises an authorization code; the authorization code is generated by the identity authentication end after the identity authentication end verifies authorization application information of the client; the authorization application information comprises login token ciphertext, a business identifier of the third-party business system, and an interface input parameter signature value; sending the authorization code to the identity authentication end, so that the identity authentication end returns an access token; sending the access token to the identity authentication end, so that the identity authentication end generates and sends user data after confirming that the access token passes verification; wherein the user data comprises user information ciphertext and a user information signature value; receiving the user data, decrypting the user information ciphertext, and obtaining user information in the case that the user information signature value passes verification.

[0015] Some embodiments of the present application realize secure access and transmission of user information through interaction between the identity authentication end and the third-party business system, and encrypted transmission of user information in the interaction process.

[0016] In a third aspect, some embodiments of the present application provide a mobile end single sign-on device applied to an identity authentication end, comprising: an application receiving module configured to receive authorization application information sent by a client, wherein the authorization application information comprises login token ciphertext, a business identifier of a third-party business system, and an interface input parameter signature value; a generating module configured to generate authorization information after confirming that the authorization application information passes verification, wherein the authorization information comprises an address of the third-party business system and an authorization code; and a sending module configured to send the authorization information to the client, so that the client accesses the third-party business system through the address and the authorization code, and the third-party business system acquires user information through the authorization code.

[0017] In a fourth aspect, some embodiments of the present application provide a mobile terminal single sign-on apparatus applied to a third-party service system, comprising: an access receiving module configured to receive an access request sent by a client, wherein the access request comprises an authorization code; the authorization code is generated by an identity authentication terminal after verifying authorization application information of the client; the authorization application information comprises login token ciphertext, a service identifier of the third-party service system, and an interface input parameter signature value; a first sending module configured to send the authorization code to the identity authentication terminal, so that the identity authentication terminal returns an access token; a second sending module configured to send the access token to the identity authentication terminal, so that the identity authentication terminal generates and sends user data after verifying that the access token is valid; wherein the user data comprises user information ciphertext and a user information signature value; and a data receiving module configured to receive the user data, decrypt the user information ciphertext, and obtain user information under the condition that the user information signature value is verified to be valid.

[0018] In a fifth aspect, some embodiments of the present application provide a computer readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, can implement the method according to any one of the embodiments of the first aspect.

[0019] In a sixth aspect, some embodiments of the present application provide an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method according to any one of the embodiments of the first aspect.

[0020] In a seventh aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein the computer program, when executed by a processor, can implement the method according to any one of the embodiments of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the following will briefly introduce the drawings needed to be used in some embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0022] Figure 1 The prior art single sign-on flowchart provided by some embodiments of the present application;

[0023] Figure 2 The system diagram of the mobile terminal single sign-on provided by some embodiments of the present application;

[0024] Figure 3 One of the method flow charts of mobile single sign-on provided for some embodiments of the present application;

[0025] Figure 4 One of the method flow charts of mobile single sign-on provided for some embodiments of the present application;

[0026] Figure 5 One of the method flow charts of mobile single sign-on provided for some embodiments of the present application;

[0027] Figure 6 One of the device composition block diagrams of mobile single sign-on provided for some embodiments of the present application;

[0028] Figure 7 One of the device composition block diagrams of mobile single sign-on provided for some embodiments of the present application;

[0029] Figure 8 An electronic device schematic diagram provided for some embodiments of the present application. DETAILED DESCRIPTION

[0030] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0031] It should be noted that similar reference numbers and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms “first”, “second”, etc. are only used for distinguishing description, and cannot be understood as indicating or implying relative importance.

[0032] In the related art, the main flow of single sign-on is as follows Figure 1As shown, it includes a client, a unified identity authentication system and a third-party business system. When a user accesses the third-party business system through the client, the unified identity authentication system login page is opened through the single-point address spliced by the third-party business system to complete identity authentication, and then the unified identity authentication system redirects the third-party business system address and splices the authorization code code generated by the unified identity authentication system. The third-party business system requests access_token from the unified identity authentication system through the authorization code code, and requests user information from the unified identity authentication system using the access_token. Among them, the information of the user login is cached in the unified identity authentication system server, and the current browser caches the session identifier of the user login. When the user accesses other third-party business systems, the browser will pass the session identifier to the unified identity authentication system server in a secure manner, and the unified identity authentication system will generate an authorization code code according to the current session identifier, and then redirect the third-party business system, and splice it behind the address of the third-party business system. The third party obtains the current login user information according to the OAuth login process. It should be understood that the token has two uses in actual application: one is user identity authentication, confirming that the user has the right to access or use related services, and the other is permission control, that is, controlling the access permission of the user to different resources, and the user can only access the authorized resources.

[0033] However, since the user login session identifier is written into the front-end page cache, the unified identity authentication system obtains the user login session identifier from the cache every time the single sign-on is performed, judges the current user login state, and generates an authorization code code. However, there is no cache mechanism in the mobile terminal applet, and the user login session identifier cannot be stored, resulting in the need for re-login every time the user accesses the third-party business system, which reduces the efficiency of single sign-on.

[0034] In view of this, some embodiments of this application provide a method for mobile single sign-on (SSO). In this method, during SSO, the third-party business system uses the login token and other information of the currently logged-in user. The client obtains a code by calling the unified identity authentication system through a backend method, and then redirects to the third-party business system. When the client accesses the third-party business system, the code can be appended to the address. The third-party business system interacts with the unified identity authentication system using the code to obtain an access token, and then obtains user information through the token. Compared to the front-end SSO method in the prior art, some embodiments of this application reduce the loading time of interaction with the third-party business system and web page interaction, making user SSO smoother and improving efficiency. SSO is changed from front-end interaction to backend interface calls from the client, reducing the risk of data interception during interaction between the client, the unified identity authentication system, and the third-party business system. Furthermore, since mobile mini-programs lack a caching mechanism, the standard OAuth SSO process cannot meet the user's need for SSO in third-party business systems. This application solves the problem of user SSO in third-party business systems without requiring modification to the third-party business system.

[0035] The following is in conjunction with the appendix Figure 2 The overall structure of a mobile single sign-on system provided by some embodiments of this application is illustrated by way of example.

[0036] like Figure 2 As shown, some embodiments of this application provide a mobile single sign-on system, which may include: a client 100, an authentication terminal 200 (i.e., a unified identity authentication system), and a third-party business system 300. The client 100 can interact with the authentication terminal 200 to obtain the address and authorization code of the redirected third-party business system 300; then, the client 100 can access the third-party business system 300 using the address and code. The third-party business system 300 requests an access token (access_token) from the authentication terminal 200 using the code, so that the third-party business system 300 can obtain the currently logged-in user information from the authentication terminal 200 using the access_token.

[0037] The following is in conjunction with the appendix Figure 3 The present application provides an exemplary embodiment of the implementation process of mobile single sign-on performed by the authentication terminal 200.

[0038] Please see the appendix Figure 3 , Figure 3 A flowchart of a mobile single sign-on method is provided for some embodiments of this application. The mobile single sign-on method may include:

[0039] S210, receiving authorization application information sent by the client, wherein the authorization application information includes login token ciphertext, business identifier of the third-party business system and interface input parameter signature value.

[0040] For example, in some embodiments of the present application, the unified identity authentication system can receive the authorization application information sent by the client 100. The authorization application information is obtained by the following method:

[0041] 1) The user opens the login page on a certain A business system (that is, a certain applet) of the client 100, and completes user login on the login page.

[0042] 2) The unified identity authentication system generates a login token (as a specific example of a login token) after confirming the user login. The A business system can subsequently request the unified identity authentication system to obtain the current login user information and login state using the token. The unified identity authentication system encrypts the login token using the pre-stored key corresponding to the user information, and returns the login token ciphertext to the A business system of the client 100.

[0043] 3) After the user clicks the third-party business system 300 that needs to be accessed on the A business system, the A business system can request an authorization code code through the interface service provided by the unified identity authentication system.

[0044] When sending the authorization request, the client 100 generates the authorization application information in the following manner: the A business system encrypts the login token using the pre-stored public key of the unified identity authentication system to obtain the ciphertext (as a specific example of the login token ciphertext). The A business system generates a timestamp as the interface input parameter content, and signs the interface input parameter content using the local private key to obtain the signature value (as a specific example of the interface input parameter signature value). The backend of the A business system calls the code interface of the unified identity authentication system, and the input parameters (that is, the authorization application information) are the ciphertext of the login token, the third-party business system identifier ClientID (as a specific example of the business identifier) and the signature value.

[0045] S220, generating authorization information after confirming that the authorization application information passes the verification, wherein the authorization information includes the address of the third-party business system and the authorization code.

[0046] For example, in some embodiments of the present application, the unified identity authentication system first verifies the authorization application information, and generates the code after the verification passes.

[0047] Specifically, in some embodiments of the present application, S220 can include decrypting the login token ciphertext, determining the login state of the current user, confirming that the signature verification result of the interface input parameter signature value is passed, and confirming that the time corresponding to the timestamp in the interface input parameter signature value is verified.

[0048] For example, in some embodiments of the present application, the unified identity authentication system verifies the relevant content in the authorization application information after decrypting the request content (i.e., the authorization application information) using the pre-stored key. That is, after the unified identity authentication system obtains the timestamp, it confirms that the signature verification result of the interface input parameter signature value is passed, and then parses the timestamp in the interface input parameter to obtain the corresponding time. The time is verified to confirm that the time difference between the time and the time on the unified identity authentication system is within the preset time (e.g., the preset time is five minutes), and then the timestamp is verified. The unified identity authentication system decrypts the ciphertext of the login token using the local private key to obtain the plaintext of the login token, verifies the login token to obtain the login state of the current user, and confirms that it is in the logged-in state to enter the next process in the logged-in state.

[0049] In some embodiments of the present application, S220 can include generating the authorization code based on the business identifier and the decrypted login token of the login token ciphertext, and determining the address of the third-party business system through redirection.

[0050] For example, in some embodiments of the present application, the unified identity authentication system generates an authorization code code for accessing the third-party business system 300 according to the third-party business system identifier ClientID and the login token. And redirect the third-party business system address URL. The URL can include code (i.e., the code can be concatenated to the URL).

[0051] S230, sending the authorization information to the client, so that the client accesses the third-party business system through the address and the authorization code, and the third-party business system obtains user information through the authorization code.

[0052] For example, in some embodiments of the present application, the unified identity authentication system sends the URL (at this time the URL is the result of concatenating the address of the third-party business system and the code) to the client 100. Alternatively, the unified identity authentication system can send the URL (at this time the URL only refers to the address of the third-party business system) and the code to the client 100.

[0053] In some embodiments of the present application, after performing S230, the mobile single sign-on method further includes:

[0054] S231, receiving the authorization code sent by the third-party service system.

[0055] For example, in some embodiments of the present application, the user opens the URL of the third-party service system on the client 100 (at this time the URL is the result of splicing the address and code of the third-party service system), and can obtain the authorization code code. The third-party service system 300 can send the code to the unified identity authentication system to apply for an access token access_token. The unified identity authentication system receives the code.

[0056] S232, sending an access token to the third-party service system if the authorization code is verified.

[0057] For example, in some embodiments of the present application, the unified identity authentication system verifies the authorization code code of the third-party service system 300, confirms that the code is consistent with the local one, and then the verification is passed; then the unified identity authentication system returns the access token access_token to the third-party service system 300.

[0058] S233, receiving the access token sent by the third-party service system.

[0059] For example, in some embodiments of the present application, after the third-party service system 300 receives the access token access_token, it accesses the user information of the unified identity authentication system by sending the access token access_token.

[0060] S234, confirming that the access token is verified, generating user data, and sending the user data to the third-party service system; wherein the user data includes: user information ciphertext and user information signature value, so that the third-party service system decrypts and verifies the user data to obtain the user information.

[0061] For example, in some embodiments of the present application, the unified identity authentication system verifies the received access token access_token, confirms consistency with the locally stored access token, to confirm that the third-party business system 300 has the permission to access the user information. Then, the unified identity authentication system uses its own private key to electronically sign the returned user information, to obtain a user information signature value. The unified identity authentication system uses the pre-stored system public key of the third-party business system 300 to encrypt the user information and the user information signature value, to obtain user information ciphertext. The unified identity authentication system returns the user information ciphertext and the user information signature value to the third-party business system 300. The third-party business system 300 first decrypts the user information ciphertext using the local private key, to obtain user information plaintext. Then, based on the user information plaintext, the third-party business system 300 uses the pre-stored public key of the unified identity authentication system to verify the user information signature value, to confirm that the verification is passed, to obtain the user information. Alternatively, in another implementation, the user information can be encrypted and then signed, and the user information signature value and the user information plaintext can be encrypted and then transmitted to the third-party business system 300. The third-party business system 300 first decrypts and then verifies the signature, to obtain the user information. It should be noted that the order of signing and encrypting the user information described above can be adjusted according to the actual scene, and the embodiments of the present application are not limited thereto.

[0062] The specific process of the mobile end single sign-on performed by the third-party business system 300 provided by some embodiments of the present application will be described below in conjunction with the accompanying drawings. Figure 4 The specific process of the mobile end single sign-on performed by the third-party business system 300 provided by some embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0063] The specific process of the mobile end single sign-on performed by the third-party business system 300 provided by some embodiments of the present application will be described below in conjunction with the accompanying drawings. Figure 4 , Figure 4 A flowchart of a mobile end single sign-on method provided by some embodiments of the present application can include the following steps. S310, receiving an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by an identity authentication end after verifying authorization application information of the client; the authorization application information includes login token ciphertext, a business identifier of the third-party business system, and an interface input parameter signature value; S320, sending the authorization code to the identity authentication end, so that the identity authentication end returns an access token; S330, sending the access token to the identity authentication end, so that the identity authentication end generates and sends user data after confirming that the access token passes the verification; wherein the user data includes user information ciphertext and a user information signature value; S340, receiving the user data, decrypting the user information ciphertext, and obtaining user information under the condition that the user information signature value passes the verification.

[0064] It should be noted that the specific implementation process of S310-S340 can refer to the above description.Figure 3 The method embodiments provided are described in detail below.

[0065] The accompanying drawings are used to better understand the present application. Figure 5 The specific process of the mobile single sign-on provided by some embodiments of the present application is described by way of example.

[0066] Please refer to the accompanying drawings Figure 5 , Figure 5 A flow chart of a method of mobile single sign-on provided by some embodiments of the present application.

[0067] The interaction process of the client, the unified identity authentication system and the third-party business system is described by way of example below.

[0068] S401, the client requests login to the unified identity authentication system and opens a login page.

[0069] S402, the client completes login on the login page.

[0070] S403, the unified identity authentication system returns a login token to the client.

[0071] S404, the client requests an authorization code code of the third-party business system from the unified identity authentication system. The request includes the authentication token and the identity ClientID of the third-party business system.

[0072] S405, the unified identity authentication system generates the authorization code code of the third-party business system and redirects the access address URL of the third-party business system, which includes the authorization code code.

[0073] S406, the unified identity authentication system sends the URL to the client.

[0074] S407, the client sends an access request to the third-party business system, and the URL in the access request includes the code.

[0075] S408, the third-party business system sends the code to the unified identity authentication system.

[0076] S409, after verifying the code, the unified identity authentication system returns an access token to the third-party business system.

[0077] S410, the third-party business system sends the access token to the unified identity authentication system.

[0078] S411, the unified identity authentication system sends the user information ciphertext and the user information signature value to the third-party business system.

[0079] S412, the third-party service system decrypts the user information ciphertext and confirms that the user information signature value is verified, and obtains the user information plaintext.

[0080] It should be noted that the specific related data transmission, encryption and other detailed implementation processes of S401-S412 can refer to the method embodiments provided in the foregoing, and the detailed description is appropriately omitted here to avoid repetition.

[0081] As can be seen from the above some embodiments of the application, the common authorized access protocol is improved, and the problem that the mobile terminal lacks cache and cannot verify the current user login state is solved, and the user needs to log in every time the user accesses the third-party service system. Through the encryption and signature of the data in the interaction process, the security problem of user identity being used by others due to cache storage leakage is solved. Moreover, the login token, user information and other sensitive information are electronically signed and data encrypted, which enhances the anti-repudiation and confidentiality of the data in the business. In addition, the authorization code code can be set to have a valid period (such as 5 seconds), and is invalid after single use, preventing information from being intercepted and used by others.

[0082] Please refer to Figure 6 , Figure 6 The composition block diagram of the mobile end single sign-on device provided by some embodiments of the application is shown. It should be understood that the mobile end single sign-on device corresponds to the method embodiments described above, and can perform each step involved in the method embodiments described above. The specific functions of the mobile end single sign-on device can be referred to the description in the foregoing, and the detailed description is appropriately omitted here to avoid repetition.

[0083] Figure 6 The mobile end single sign-on device includes at least one software function module stored in the memory in the form of software or firmware or solidified in the mobile end single sign-on device. The mobile end single sign-on device applied to an identity authentication end includes an application receiving module 510 configured to receive authorization application information sent by a client, wherein the authorization application information includes login token ciphertext, a business identifier of a third-party service system and an interface input parameter signature value; a generating module 520 configured to generate authorization information after confirming that the authorization application information is verified, wherein the authorization information includes an address of the third-party service system and an authorization code; and a sending module 530 configured to send the authorization information to the client, so that the client accesses the third-party service system through the address and the authorization code, and the third-party service system obtains user information through the authorization code.

[0084] Please refer to Figure 7 , Figure 7A component block diagram of the mobile single sign-on apparatus provided by some embodiments of the present application is shown. It should be understood that the mobile single sign-on apparatus corresponds to the method embodiments described above, and can perform each step involved in the method embodiments described above. The specific functions of the mobile single sign-on apparatus can be found in the description above, and detailed description is omitted here to avoid repetition.

[0085] Figure 7 The mobile single sign-on apparatus includes at least one software function module that can be stored in the form of software or firmware in the memory or solidified in the mobile single sign-on apparatus. The mobile single sign-on apparatus applied to a third-party service system includes: an access receiving module 610 configured to receive an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by an identity authentication end after the identity authentication end verifies authorization application information of the client; the authorization application information includes login token ciphertext, a business identifier of the third-party service system, and an interface input parameter signature value; a first sending module 620 configured to send the authorization code to the identity authentication end, so that the identity authentication end returns an access token; a second sending module 630 configured to send the access token to the identity authentication end, so that the identity authentication end generates and sends user data after confirming that the access token passes the verification; wherein the user data includes user information ciphertext and a user information signature value; and a data receiving module 640 configured to receive the user data, decrypt the user information ciphertext, and obtain user information in the case that the user information signature value passes the verification.

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the apparatus described above can refer to the corresponding process in the foregoing method, and will not be described in more detail here.

[0087] Some embodiments of the present application also provide a computer readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the operations of the method corresponding to any of the above method embodiments provided by the above embodiments.

[0088] Some embodiments of the present application also provide a computer program product, which includes a computer program, wherein the computer program is executed by a processor to implement the operations of the method corresponding to any of the above method embodiments provided by the above embodiments.

[0089] As Figure 8As shown, some embodiments of the present application provide an electronic device 700, comprising a memory 710, a processor 720, and a computer program stored in the memory 710 and capable of running on the processor 720, wherein the processor 720 reads the program from the memory 710 through a bus 730 and implements the method of any of the above embodiments when executing the program.

[0090] The processor 720 can process digital signals and can include various computing structures. For example, a complex instruction set computer structure, a reduced instruction set computer structure, or a structure implementing a combination of multiple instruction sets. In some examples, the processor 720 can be a microprocessor.

[0091] The memory 710 can be used to store instructions executed by the processor 720 or data related to the execution of the instructions. These instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the present application. The processor 720 of the embodiments of the present disclosure can be used to execute the instructions in the memory 710 to implement the above-described method. The memory 710 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memory well known to those skilled in the art.

[0092] The above only describes the embodiments of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0093] The above only describes the embodiments of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0094] It is to be noted that, as used in this specification and the appended claims, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to "a component" can include a combination of two or more components. Additionally, the terms "comprise," "comprises," and "comprising," or any variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements is not necessarily limited to those elements, but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Furthermore, unless otherwise indicated herein, the terms "first," "second," "third," etc., are used herein merely as labels, and are not intended to impose ordinal import.

Claims

1. A method for mobile end single sign-on, characterized in that, The method is applied to an identity authentication end, and includes: receiving authorization application information sent by a client, wherein the authorization application information includes login token ciphertext, a business identifier of a third-party business system, and an interface parameter signature value; the authorization application information is generated after the client completes login; the login token ciphertext is obtained by encrypting a login token generated after login; and the interface parameter signature value is obtained by signing a timestamp; generating authorization information after confirming that the authorization application information passes verification, wherein the authorization information includes an address of the third-party business system and an authorization code; and the authorization code is valid within a set time; the confirming that the authorization application information passes verification includes decrypting the login token ciphertext to determine the login state of a current user, confirming that the signature verification result of the interface parameter signature value is passed, and confirming that the time difference between the timestamp in the interface parameter signature value and the time of the identity authentication end is within a preset time; sending the authorization information to the client, so that the client accesses the third-party business system through the address and the authorization code; and the third-party business system further obtains user information by using the login token obtained through the authorization code.

2. The method of claim 1, wherein, The generating authorization information includes: generating the authorization code based on the business identifier and the login token decrypted from the login token ciphertext, and determining the address of the third-party business system through redirection.

3. The method of claim 1, wherein, After the sending the authorization information to the client, the method further includes: receiving the authorization code sent by the third-party business system; sending an access token to the third-party business system in the case that the authorization code passes verification; receiving the access token sent by the third-party business system; generating user data and sending the user data to the third-party business system in the case that the access token passes verification; wherein the user data includes user information ciphertext and user information signature value, so that the third-party business system decrypts and verifies the user data to obtain the user information.

4. A method for mobile end single sign-on, characterized in that, The method is applied to a third-party business system, and includes: receiving an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by an identity authentication end after the identity authentication end verifies authorization application information of the client; the authorization code is valid within a set time; the authorization application information includes login token ciphertext, a business identifier of the third-party business system, and an interface parameter signature value; the interface parameter signature value is obtained by signing a timestamp; the authorization application information is generated by the identity authentication end after the client completes login; and the login token ciphertext is obtained by encrypting a login token generated after login; The method for confirming that the authorization application information is verified is as follows: the login token ciphertext is decrypted, the login state of the current user is determined, it is confirmed that the signature verification result of the interface input parameter signature value is passed, and it is confirmed that the time difference between the time corresponding to the timestamp in the interface input parameter signature value and the time of the identity authentication end is within a preset time; The authorization code is sent to the identity authentication end, so that the identity authentication end returns an access token; The access token is sent to the identity authentication end, so that the identity authentication end generates and sends user data after confirming that the access token is verified; wherein the user data includes: user information ciphertext and user information signature value; The user data is received, the user information ciphertext is decrypted, and the user information is obtained under the condition that the user information signature value is verified.

5. A device for mobile single sign-on, characterized in that, The device is used to execute the method of claim 1, and the device is applied to an identity authentication end and includes: An application receiving module is configured to receive authorization application information sent by a client, wherein the authorization application information includes: login token ciphertext, a business identifier of a third-party business system, and an interface input parameter signature value; A generating module is configured to generate authorization information after confirming that the authorization application information is verified, wherein the authorization information includes: an address of the third-party business system and an authorization code; A sending module is configured to send the authorization information to the client, so that the client accesses the third-party business system through the address and the authorization code, and the third-party business system acquires user information through the authorization code.

6. An apparatus for mobile end single sign-on, characterized in that, The device is used to execute the method of claim 4, and the device is applied to a third-party business system and includes: An access receiving module is configured to receive an access request sent by a client, wherein the access request includes an authorization code; the authorization code is generated by an identity authentication end after verifying authorization application information of the client; the authorization application information includes: login token ciphertext, a business identifier of the third-party business system, and an interface input parameter signature value; A first sending module is configured to send the authorization code to the identity authentication end, so that the identity authentication end returns an access token; A second sending module is configured to send the access token to the identity authentication end, so that the identity authentication end generates and sends user data after confirming that the access token is verified; wherein the user data includes: user information ciphertext and user information signature value; A data receiving module is configured to receive the user data, decrypt the user information ciphertext, and obtain user information under the condition that the user information signature value is verified.

7. A computer readable storage medium characterized in that, The computer readable storage medium stores a computer program, wherein the computer program is run by the processor to execute the method of any one of claims 1-4.

8. An electronic device, comprising: The computer readable storage medium stores a computer program, wherein the computer program is run by the processor to execute the method of any one of claims 1-4.

9. A computer program product, characterised in that, The computer program product comprises a computer program, wherein the computer program, when executed by a processor, performs the method according to any one of claims 1-4.

Images