Application running method and device, medium, equipment and computer program product

Abstract

The invention relates to an application operation method and device, a medium, equipment and a computer program product, and the method applied to client equipment comprises the steps: responding to the operation of a target business of a target application, obtaining a target equipment certificate corresponding to the current equipment, the target business being used for representing the business configured with an equipment login condition in the target application, the target device certificate is used for verifying a target service operated by the current device, and the target device certificate is used for representing a device certificate associated with a target account logged in the target application under the target service; sending a device verification request to a server based on the target device certificate, so that the server determines whether the current device is a target login device operating the target service based on the device verification request and a device login condition corresponding to the target service; and running the target service of the target application based on the target device certificate in response to the received verification result returned by the server side that verification is passed.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular, to an application running method, apparatus, medium, device, and computer program product. Background Art

[0002] With the development of computer technology, in order to ensure the security of application operation, some applications will limit single-device login, that is, the same account can only be logged in and used on one device at the same time. If you log in on other devices at the same time, the previously logged-in device will be reminded or removed from the login state, such as prompting "Account logged in on other devices", and will be logged out at the same time. If the user has multiple devices and wants to log in on multiple devices, he needs to switch logins frequently. Summary of the invention

[0003] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] In a first aspect, the present disclosure provides an application running method, applied to a client device, the method comprising: In response to the target service of the target application running, obtaining a target device certificate corresponding to the current device, wherein the target service is used to represent the service for which the device login condition is configured in the target application, the target device certificate is used to verify that the current device runs the target service, and the target device certificate is used to represent the device certificate associated with the target account logged in in the target application under the target service; Sending a device verification request to the server based on the target device certificate, so that the server determines whether the current device is a target login device running the target service based on the device verification request and the device login condition corresponding to the target service; In response to receiving a verification result returned by the server indicating that the verification is passed, the target service of the target application is run based on the target device certificate.

[0005] In a second aspect, the present disclosure provides an application running method, which is applied to a server, and the method includes: Receive a device verification request sent by a target device, the device verification request including a certificate identifier of a target device certificate corresponding to the target device, the target device certificate being used to verify a target service of a target application running on the target device, the target device certificate being used to represent a device certificate associated with a target account logged in to the target application; Based on the certificate identifier and the device login condition corresponding to the target service, a verification result is determined and sent to the target device, wherein the verification result is used to indicate whether the target device is a login device running the target service.

[0006] In a third aspect, the present disclosure provides an application running device, applied to a client device, the device comprising: A first acquisition module is used to obtain a target device certificate corresponding to the current device in response to the target service of the target application running, wherein the target service is used to represent the service configured with the device login condition in the target application, the target device certificate is used to verify that the current device runs the target service, and the target device certificate is used to represent the device certificate associated with the target account logged in in the target application under the target service; A first sending module, configured to send a device verification request to a server based on the target device certificate, so that the server determines whether the current device is a target login device running the target service based on the device verification request and the device login condition corresponding to the target service; The running module is used for running the target service of the target application based on the target device certificate in response to receiving a verification result returned by the server that the verification is passed.

[0007] In a fourth aspect, the present disclosure provides an application running device, applied to a server, the device comprising: A receiving module, configured to receive a device verification request sent by a target device, wherein the device verification request includes a certificate identifier of a target device certificate corresponding to the target device, wherein the target device certificate is used to verify the target service of the target application running on the target device, and wherein the target device certificate is used to represent a device certificate associated with a target account logged in to the target application; The third determination module is used to determine the verification result based on the certificate identifier and the device login condition corresponding to the target service and send it to the target device, wherein the verification result is used to indicate whether the target device is a login device running the target service.

[0008] In a fifth aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which implements the steps of the method described in the first aspect or the second aspect when the computer program is executed by a processing device.

[0009] In a sixth aspect, the present disclosure provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the method described in the first aspect or the second aspect.

[0010] In a seventh aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect or the second aspect.

[0011] In the above technical solution, device login restrictions can be made from the business dimension of the application, and device verification can be performed in combination with the target device certificate when the target business is running, and the target business can be run based on the verification result of the server. Therefore, device login conditions can be set for different businesses in the same application, that is, some businesses can restrict device login, and some businesses can not restrict devices, so that multiple devices logged in to the same account can run some businesses at the same time, and device login restrictions can also be made for the target business, so that the target application can support multi-device login and meet the restrictions on single device login in some businesses, meet the security requirements of the target business operation, and avoid affecting the operation of other businesses, to a certain extent reduce the frequent device login switching process of users logging in to the same account on multiple devices, and improve the user experience.

[0012] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 It is a flowchart of an application running method provided according to an embodiment of the present disclosure.

[0014] Figure 2 It is a schematic diagram of ciphertext data and signature information provided according to an embodiment of the present disclosure.

[0015] Figure 3 It is a flowchart of an application running method provided according to an embodiment of the present disclosure.

[0016] Figure 4 It is a block diagram of an application running device provided according to an embodiment of the present disclosure.

[0017] Figure 5 It is a block diagram of an application running device provided according to an embodiment of the present disclosure.

[0018] Figure 6 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0019] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0020] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0021] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0022] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0023] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0024] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0025] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0026] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0027] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0028] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0029] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0030] Figure 1 As shown, it is a flowchart of an application running method provided according to an embodiment of the present disclosure, such as Figure 1 As shown, the method may include: In step 11, in response to the target service of the target application running, the target device certificate corresponding to the current device is obtained, wherein the target service is used to represent the service in the target application that has device login conditions configured, and the target device certificate is used to verify that the current device is running the target service, and the target device certificate is used to represent the device certificate associated with the target account logged in in the target application under the target service.

[0031] In actual application scenarios, the security requirements of different services in the same application may be different. For example, in short video applications, video browsing services can support multiple devices to log in at the same time, while sharing chat services usually need to limit single device login to avoid timing errors of chat messages. Based on this, in an embodiment of the present disclosure, the corresponding device login conditions can be pre-set for services in applications that need to limit device login. For example, the target application A contains 7 services such as Y1-Y7, among which services Y1 and Y2 need to limit single device login and use, and Y3 needs to limit login and use in Android system devices. Y4-Y7 have no restrictions on devices, that is, they can be logged in and used in multiple devices at the same time, and there are no restrictions on devices. In this embodiment, the target service in the target application can be determined based on the configuration information of the target application, so that the current device can be verified when the target service is determined to be running.

[0032] As an example, for each application, multiple accounts can be logged in for the application in one device. In order to solve the effective verification of the same account when logging in to multiple devices, the present disclosure can independently store the corresponding device certificates for each account under different target services in the current device, that is, the current device can contain the device certificate ZY11 of Y1 corresponding to account Z1, the device certificate ZY12 of Y2 corresponding to account Z1, and Y4-Y7 do not need to limit the login device, so there is no need to apply for the corresponding device certificate, which can be directly processed based on the general processing logic preset in the application. In addition, the current device can also contain the device certificate ZY21 of Y1 corresponding to account Z2. If the target account logged in to the current device is Z1 and the target service is Y2, the device certificate ZY12 can be used as the target device certificate based on the target account and target service.

[0033] In step 12, a device verification request is sent to the server based on the target device certificate, so that the server determines whether the current device is the target login device for running the target service based on the device verification request and the device login condition corresponding to the target service. The target device certificate can be used to indicate the credential information of the current device for running the target service.

[0034] As an example, the certificate identifier of the target device certificate can be added to the device verification request to be sent to the server. The server can then obtain the target device certificate based on the certificate identifier and verify it to determine whether the current device can log in to use the target service, thereby implementing device restrictions on the login use of a single service in the target application.

[0035] In step 13, in response to receiving a verification result returned by the server indicating that the verification is passed, the target service of the target application is executed based on the target device certificate.

[0036] After the server passes the verification, it means that the current device can run the target service. At this time, the target service can be run based on the target device certificate.

[0037] As an example, the certificate identifier of the target device certificate can be carried in the service request during the operation of the target service, so that the server can first determine whether the current device can run the target service based on the certificate identifier when processing the service request, thereby avoiding errors in device login restrictions caused by untimely device certificate updates, and ensuring the accuracy and effectiveness of device restrictions during the operation of the target service.

[0038] In the above technical solution, device login restrictions can be made from the business dimension of the application, and device verification can be performed in combination with the target device certificate when the target business is running, and the target business can be run based on the verification result of the server. Therefore, device login conditions can be set for different businesses in the same application, that is, some businesses can restrict device login, and some businesses can not restrict devices, so that multiple devices logged in to the same account can run some businesses at the same time, and device login restrictions can also be made for the target business, so that the target application can support multi-device login and meet the restrictions on single device login in some businesses, meet the security requirements of the target business operation, and avoid affecting the operation of other businesses, to a certain extent reduce the frequent device login switching process of users logging in to the same account on multiple devices, and improve the user experience.

[0039] In a possible embodiment, obtaining a target device certificate corresponding to the current device may include: The account identifier of the target account is obtained. The target account logged in can be determined in the target application, and then its account identifier is obtained.

[0040] Afterwards, it is possible to query from the current device whether the device certificate associated with the account identifier under the target service is stored. For example, the query can be performed based on the account identifier and the service identifier of the target service. If the device certificate associated with the account identifier under the target service is not found in the current device, an identity authentication message is output, wherein the identity authentication message is used to prompt the user to perform identity authentication.

[0041] If the device certificate associated with the target service by the account identifier is not found in the current device, it may be that the current device has not requested the device certificate, or the device certificate has been deleted after the current device requested the device certificate, which means that the device does not have the credentials to run the target service in the current scenario. At this time, the user can be guided to perform identity authentication in order to request the device certificate to run the target service.

[0042] As an example, the authentication method can be selected based on the actual application scenario. The authentication method can be selected from the commonly used methods in the field. For example, the output of the authentication message can be output from multiple authentication methods, such as verification code recognition, face recognition, fingerprint recognition, etc. The user can make a selection based on his / her usage habits. For example, the user can select face recognition, and then can collect the face image according to the instructions and send it to the server for verification based on the face image. The verification method can be based on the face recognition verification method in the field, and the present disclosure does not limit this.

[0043] In response to determining that the identity authentication is passed, a certificate request corresponding to the current device is generated, and the certificate request is sent to the server to obtain a device certificate returned by the server based on the certificate request, and the returned device certificate is used as the target device certificate.

[0044] Among them, after the identity authentication is passed, the server can send an authentication success message to the current device. In response to receiving the authentication success message, it is determined that the identity authentication is passed, indicating that the user corresponding to the current device is a legal user, and then the device certificate can be requested from the server to run the target service on the current device.

[0045] After obtaining the device certificate returned by the server based on the certificate request, the device certificate can be associated with the target service and the target account and stored to facilitate subsequent quick query of the device certificate. As another example, if the device certificate associated with the account identifier under the target service is queried in the current device, the queried device certificate can be used as the target device certificate.

[0046] Therefore, through the above technical solution, it is possible to first query whether there is a target device certificate locally on the current device. When the target device certificate is not found, the user can be guided to perform identity authentication and request the target device certificate from the server after the identity authentication is passed, thereby ensuring the validity and security of the target device certificate, while ensuring the security of subsequent operation of the target business based on the target device certificate.

[0047] In a possible embodiment, generating a certificate request corresponding to the current device may include: Each verification information of the current device is encrypted respectively to obtain ciphertext data corresponding to each verification information, wherein the verification information includes device information of the current device, business information of the target business and target key information, and the target key information is used to encrypt the business information.

[0048] The verification information is used by the server to identify and verify the current device. In order to ensure the security of the verification information, the verification information can be encrypted during the communication process, so that the verification information is transmitted in ciphertext to avoid leakage of the verification information.

[0049] As an example, encrypting each verification information of the current device respectively to obtain ciphertext data corresponding to each verification information may include: Encrypting the target key information based on the public key in the first key pair used by the current device to obtain ciphertext data corresponding to the target key information; The device information and the service information are encrypted based on the target key information to obtain ciphertext data corresponding to the device information and the service information.

[0050] As an example, the first key pair may be an RSA asymmetric encryption key pair, the RSA public key of the first key pair is pre-installed in the current device, and the RSA private key of the first key pair is stored in the server. The target key information may be an AES symmetric encryption key and an AES initialization vector. The AES initialization vector IV (Initialization Vector) is a random number of a fixed length, which is used to encrypt with plaintext data so that the same plaintext uses a different initial vector each time it is encrypted to obtain a different ciphertext. The target key information may be generated by the current device before the certificate request occurs.

[0051] As an example, in order to unify the representation of each ciphertext data, the obtained ciphertext data can be converted into a string represented in hexadecimal. Figure 2 As shown, the device information can be encrypted based on the AES key and the AES initial vector to obtain its ciphertext data DeviceInfo, the business information can be encrypted based on the AES key and the AES initial vector to obtain its ciphertext data DataEnc, and the AES key can be encrypted based on the RSA public key to obtain its ciphertext data KeyEnc, and the AES initial vector can be encrypted based on the RSA public key to obtain its ciphertext data Keyiv.

[0052] Therefore, by encrypting device information and business information through AES key information, the security of device information and business information can be improved. By encrypting the target key information based on the RSA key pair, the security of the AES key information can be improved while the server can obtain the AES key information, further ensuring the communication security during the certificate request process, thereby improving the validity of the device certificate.

[0053] Based on each of the ciphertext data, signature information is generated.

[0054] As an example, each of the ciphertext data may be concatenated to obtain a concatenated ciphertext, and a concatenation order of different ciphertext data may be preset to concatenate the ciphertext data. For example, the ciphertext data may be arranged in a lexicographic order based on its identifier, such as Figure 2 As shown, the ciphertext data can be concatenated in the order shown to obtain the concatenated ciphertext. Then, the concatenated ciphertext can be signed using a hash function to obtain signature information. As an example, the hash function can be calculated using a SHA-1 function.

[0055] As another example, the verification information may also include a signed salt value randomly generated by the current device, and the signed salt value may be encrypted based on the RSA public key to obtain its ciphertext data SaltEnc.

[0056] Accordingly, generating signature information based on each of the ciphertext data may include: Each of the ciphertext data is concatenated to obtain a concatenated ciphertext, and the concatenated ciphertext is concatenated with the signed salt value to obtain a verification ciphertext. As an example, the concatenation order of different ciphertext data can be pre-set to concatenate the ciphertext data, such as the ciphertext data can be arranged in lexicographic order based on its identifier, such as Figure 2 As shown, the ciphertext data can be concatenated in the order shown to obtain the concatenated ciphertext, and the signed salt value can be concatenated at the end of the concatenated ciphertext to obtain the verification ciphertext.

[0057] The signature information is generated based on the verification ciphertext.

[0058] Afterwards, a hash function can be used to sign to obtain signature information. For example, the hash function can use the SHA-1 function to calculate and verify the signature of the ciphertext to obtain the signature information Sign. Thus, the randomness of the ciphertext data can be further improved by adding a signature salt value, the validity of the signature information can be improved, malicious tampering of the transmitted data during data transmission can be avoided, and the security of communication can be improved.

[0059] The certificate request is generated based on each of the ciphertext data and the signature information.

[0060] like Figure 2 As shown, the above ciphertext data and signature information can be added to the information body of the certificate request to generate the certificate request. As an example, the information body can add other required parameters based on the actual scenario, which is not limited in this disclosure.

[0061] Therefore, through the above technical solution, corresponding ciphertext data and signature information can be generated based on the verification information and key associated with the current device to generate a certificate request, so that the server can obtain the verification information of the current device based on the signature information and ciphertext data and then generate a corresponding device certificate, thereby ensuring the data security during the communication process while ensuring the accuracy of the generated device certificate.

[0062] As another example, the current device is associated with multiple key pairs, and generating a certificate request corresponding to the current device may also include: Determine a key identifier corresponding to a first key pair currently used by the device.

[0063] For example, N groups of RSA key pairs may be pre-set in the current device. When in use, one may be randomly selected as the first key pair and recorded through the key identifier SvrKeyIdx to clearly identify which key pair among the N RSA key pairs is used.

[0064] Accordingly, generating the certificate request based on each of the ciphertext data and the signature information may include: The certificate request is generated based on each of the ciphertext data, the signature information and the key identifier.

[0065] As an example, the above ciphertext data, signature information and key identifier can be added to the information body of the certificate request to generate the certificate request, so that when the server receives the certificate request, it can determine the key pair to be used based on the key identifier and then perform decryption processing.

[0066] Therefore, through the above technical solution, the diversity of keys in the communication process can be further improved, so that when there is a risk of leakage of some keys, key pairs can be selected through key identifiers, thereby improving the effectiveness and security of data encryption.

[0067] As another example, the signature calculation method SignType may be added to the information body of the certificate request so that the server can calculate in the same way to obtain signature information for verification.

[0068] In a possible embodiment, when the application running method is applied to a server, the server receives a certificate request sent by a target device and verifies signature information in the certificate request.

[0069] As an example, the server may obtain the corresponding ciphertext data from the certificate request, and perform concatenation based on the same concatenation order as the client device, and perform calculation based on the same signature calculation method as the client device to obtain the signature verification information.

[0070] As another example, if the ciphertext data contains SaltEnc, SaltEnc can be decrypted based on the RSA private key in the first key pair to obtain the signed salt value, and the signed salt value can be obtained by splicing and decrypting based on the same splicing order as the client device, and the signature verification information can be obtained by calculating based on the same signature calculation method as the client device.

[0071] If the certificate request contains SignType, the calculation is performed based on the signature calculation method indicated by SignType. If SignType is not included, the calculation is performed based on the signature calculation method agreed upon by default. If the signature verification information is the same as the signature information in the certificate request, it means that the signature information verification has passed. If the signature verification information is different from the signature information in the certificate request, it means that the signature information verification has failed, and a notification message of verification exception is sent to the target device.

[0072] After the signature information is verified, the ciphertext data in the certificate request is decrypted to obtain the device information of the target device and the service information of the target service.

[0073] If the certificate request contains SvrKeyIdx, the key pair indicated by SvrKeyIdx is used as the first key pair. If SvrKeyIdx is not included, the key pair based on the default agreement is used as the first key pair.

[0074] In this step, KeyEnc and Keyiv can be decrypted based on the RSA private key in the first key pair to obtain the key and initial vector of the target key information. Further, DataEnc can be decrypted based on the key and initial vector of the target key information to obtain business information, and DeviceInfo can be decrypted based on the key and initial vector of the target key information to obtain device information.

[0075] Generate a second key pair and a certificate identifier, and generate a target device certificate corresponding to the target device based on the device information of the target device, the account identifier of the target account logged in to the target application, the certificate identifier and the private key of the second key pair.

[0076] The second key pair can be an RSA key pair, which is used to encrypt data during the communication process between the target device and the server. The server can randomly generate a certificate identifier. The certificate identifier and the device certificate correspond one to one. It can be generated based on the common coding method in this field to ensure the uniqueness of different certificate identifiers.

[0077] As an example, the target device certificate may include the following: The account ID of the target account logged in in the target application, which is used to identify the currently logged in user account; The device identifier of the target device, which can be obtained by encoding by the server based on the device information of the target device, and can be guaranteed to uniquely identify a device; The private key of the second key pair is sent to the target device to sign the data during the operation of the target service.

[0078] Afterwards, the certificate identifier and the target device certificate are associated and stored, and the target device certificate is sent to the target device.

[0079] Therefore, the above technical solution can be used to perform verification based on the certificate request sent by the target device, so as to issue a device certificate to the target device, improve the security of the device certificate, and provide data support for the subsequent determination of the target login device for the target business operation.

[0080] As an example, the target device certificate may also include an expiration date, and the target device certificate may be automatically deleted when the expiration date is reached, thereby ensuring the effective application of the target device certificate. As another example, the target device certificate may also include an application identifier to identify the currently logged in target application.

[0081] In a possible embodiment, the present disclosure further provides an application running method, which is applied to a server, such as Figure 3 As shown, the method may include: In step 31, a device verification request sent by the target device is received, wherein the device verification request includes a certificate identifier of a target device certificate corresponding to the target device, wherein the target device certificate is used to verify the target service of the target application running on the target device, and wherein the target device certificate is used to represent a device certificate associated with a target account logged in in the target application under the target service.

[0082] When the target device runs the target service, it may carry the certificate identifier of the corresponding target device certificate, so that the server can obtain the target device certificate based on the certificate identifier.

[0083] In step 32, based on the certificate identification and the device login condition corresponding to the target service, a verification result is determined and sent to the target device, wherein the verification result is used to indicate whether the target device is a target login device running the target service.

[0084] Among them, the target device certificate can be queried from the server based on the certificate identifier, and then matched with the target device certificate and the device login condition to determine whether the target device meets the device login condition, and then determine whether it is the target login device.

[0085] Therefore, through the above technical solution, device login restrictions can be made for applications from the business dimension, so that the target device can be verified in combination with the target device certificate and the device login conditions to obtain the verification result corresponding to the target device, so that the client device can run the target business based on the verification result. Therefore, device login conditions can be set for different businesses in the same application, that is, some businesses can restrict device login, and some businesses can not restrict devices, so that multiple devices logged in to the same account can run some businesses at the same time, and device login restrictions can also be made for the target business, so that the target application can support multi-device login and meet the restrictions on single device login in some businesses, meet the security requirements of the target business operation, and avoid affecting the operation of other businesses, to a certain extent, reduce the frequent device login switching process of users logging in to the same account on multiple devices, and improve the user experience.

[0086] In a possible embodiment, the device login condition is single device login, that is, the target service can only have one login device at the same time. Accordingly, determining the verification result based on the certificate identifier and the device login condition corresponding to the target service may include: The server is queried for a target device certificate corresponding to the certificate identifier.

[0087] Based on the account identifier in the target device certificate, determine the logout device corresponding to the account identifier.

[0088] As an example, a query can be made from the device certificates stored on the server based on the certificate identifier. If the target device certificate is not found, the verification result is determined to be a verification exception, and the verification result is fed back to the target device. If the target device certificate is found and the target device certificate is valid, it means that the certificate identifier carried by the target device is a valid identifier. At this time, it can be further determined whether the target account is logged in on other devices. Since the device login condition is single device login, only one current device is allowed to log in. In addition to the target device, other devices that log in to the target account corresponding to the account identifier can be used as kick-out devices.

[0089] The device certificate of the kick-login device associated with the account identifier under the target service is invalidated, and a kick-login message is sent to the kick-login device.

[0090] As an example, you can query with the account ID, the business ID of the target business, and the device ID of the login device, and set the queried device certificate to invalid. For example, you can set the device certificate to invalid by deleting it, that is, keep the device certificate corresponding to the most recently logged-in device as a valid certificate.

[0091] For example, if the certificate identifier of the target device certificate is B1, and the account identifier is U1, then the device logged in with the target account can be further queried from the server as a kick-login device. For example, if the device identifiers of the determined kick-login devices are X1 and X2, and the account identifier is U1. Then, the device certificate corresponding to U1 and associated with X1 under the target service can be deleted, and the device certificate corresponding to U1 and associated with X2 under the target service can be deleted. At the same time, a kick-login message can be sent to the kick-login devices X1 and X2 respectively. The kick-login message indicates the following: "There are other devices logged in currently, and verification is required before continuing to use them." The user corresponding to the kick-login device can perform corresponding operations based on the kick-login message to determine whether to perform the kick-login.

[0092] If the identity authentication information of the Kick Login Device for the Kick Login message is not received within a preset time period, it is determined that the verification result is passed.

[0093] As an example, the preset time period can be set based on the actual application scenario, and the present disclosure does not limit this. As an example, if the identity authentication information of the Kick Login device for the Kick Login message is not received within the preset time period, it means that no other device is currently using the target service, then the target device can be used as the target login device to run the target service, that is, the verification result corresponding to the target device is verification passed.

[0094] Therefore, in this scenario, if there is a new target device to run the target service, the server can notify all other devices logged in to the same account by pushing a login message based on the device verification request, so as to determine whether the target device can run the target service based on the feedback from other devices, ensure the target service's requirement for single-device login verification, and ensure the security and stability of the target service's operation.

[0095] In a possible embodiment, determining the verification result based on the certificate identifier and the device login condition corresponding to the target service may also include: If the identity authentication information of the kick log device for the kick log message is received within the preset time period, the kick log device is authenticated based on the identity authentication information.

[0096] In response to determining that the identity authentication of the login device is passed, the target device certificate is invalidated, and the verification result is determined to be a verification exception.

[0097] For example, the user corresponding to the Tideng device needs to continue the target business in the Tideng device. At this time, he can choose to perform identity authentication, wherein the implementation method of identity authentication has been described in detail above and will not be repeated here. Determining that the identity authentication of the Tideng device is passed indicates that the Tideng device is the latest login device, that is, the Tideng device is a single device running the target business. At this time, the target device certificate can be invalidated and the verification result can be fed back to the target device.

[0098] Therefore, during the operation of a service that limits single-device login, the running device can be verified to ensure the safe operation of the target service. At the same time, the impact on the operation of other services can be avoided. Devices running other services do not need to log in frequently, saving user operations and improving user experience.

[0099] In a possible embodiment, the device verification request includes device auxiliary information, the device login conditions include conditions corresponding to the device auxiliary information, the device auxiliary information includes login area information and / or device system information, wherein the device auxiliary information can be added to the device verification request as a parameter in the information body in the device verification request.

[0100] Accordingly, determining the verification result based on the certificate identifier and the device login condition corresponding to the target service includes: Querying the target device certificate corresponding to the certificate identifier on the server; Based on the account identifier in the target device certificate, a logged-in device corresponding to the account identifier is determined.

[0101] Among them, the specific implementation methods of the above steps have been described in detail above and will not be repeated here.

[0102] Based on the device auxiliary information and the device login condition, the logout device corresponding to the account identifier is determined from the logged-in devices.

[0103] As an example, the device login condition is that each login area contains only one device. Then the login area information of the target device can be determined based on the device auxiliary information, such as area A. Furthermore, based on the device login condition, the logged-in device corresponding to area A is used as the kick-out device corresponding to the account identifier, and the logged-in devices in other areas are not considered.

[0104] As an example, if the device login condition is that multiple devices under the same operating system can run, the operating system of the target device can be determined based on the device auxiliary information, such as the Android system. Furthermore, based on the device login condition, the logged-in device of the non-Android system can be used as the kick-out device corresponding to the account identifier.

[0105] Therefore, the kicked-out devices can be screened based on the device login conditions and device auxiliary information to expand the scope of the restrictions and constraints on login devices disclosed in the present invention.

[0106] Afterwards, the device certificate of the login device associated with the account identifier under the target business is invalidated, and a login message is sent to the login device. If the identity authentication information of the login device for the login message is not received within a preset period of time, the verification result is determined to be a successful verification. The specific implementation method of the above steps has been described in detail above and will not be repeated here.

[0107] Therefore, through the above technical solution, it is possible to support the setting of corresponding device login conditions based on actual application scenarios, thereby further improving the diversity of device restrictions between different services in the same application, so that different device restrictions can be performed for different services in the same application, thereby improving the accuracy of application operation and ensuring the stability of business operation in the application.

[0108] In a possible embodiment, when the application running method is applied to a client device, the method may further include: In response to receiving the logout message sent by the server, determining the currently running service in the target application; If the currently running service is an associated service of the log-off message, an identity authentication message is output, wherein the identity authentication message is used to prompt the user to perform identity authentication; In response to determining that the identity authentication is successful, a certificate request corresponding to the current device is generated, and the certificate request is sent to the server to obtain a new device certificate returned by the server based on the certificate request, and the step of sending a device verification request to the server based on the target device certificate is returned.

[0109] Among them, the kick login message may include the business identifier of the business associated with the kick login message. For example, as in the example above, when the target device is running the target business Y1, it sends a device verification request to the server. Then, the server queries the device currently logged in by the target account as the kick login device. If the device identifiers of the kick login devices determined are X1 and X2, the kick login messages can be sent to the kick login devices X1 and X2 respectively. The kick login device X1 receives the kick login message, which includes the business identifier Y1 of its associated business, and the kick login device determines the currently running business in the target application. If the currently running business is Y1, it means that the business Y1 already has a device running. Since the device certificate of the kick login device running the business Y1 with the account identifier is invalid, the kick login device X1 can be prompted to perform identity authentication to obtain a new device certificate and perform device verification. Among them, the method of identity authentication and the method of generating a certificate request have been described in detail above and will not be repeated here.

[0110] Therefore, through the above technical solution, when a kick-out message is received, the response to the kick-out message can be determined in combination with the services currently running on the device, thereby meeting the user's usage needs while improving the service restrictions on single-device login and ensuring the security of service operations.

[0111] As another example, the method may further include: In response to receiving the logout message sent by the server, determining the currently running service in the target application; If the currently running service is not an associated service of the logout message, and the target device stores a device certificate of the target account under the associated service, the device certificate is deleted.

[0112] If the currently running service is not an associated service of the Kick Login message, it means that there is no conflict between the currently running service of the current device and the associated service of the Kick Login message, and the currently running service can continue to run. In this scenario, it is possible to further determine whether the target device stores the device certificate of the target account under the associated service. If yes, the device certificate is deleted, so that when the associated service is subsequently run in the Kick Login device, the device certificate is re-obtained and the device is verified, thereby avoiding conflicts in the process of a device running an associated service, in which the Kick Login device directly runs the associated service based on the stored device certificate, and further improving the security and stability of service operations.

[0113] In a possible embodiment, the target device certificate includes a private key of the second key pair, that is, the RSA private key generated by the server as described above; The target service of running the target application based on the target device certificate may include: The operation data corresponding to the target service is signed based on the private key in the target device certificate to obtain the signed operation data; and the signed operation data is sent to the server.

[0114] Among them, the operation data can be signed based on the private key in the target device certificate, and the server can verify the signature based on the public key of the second key pair, so that the server can verify the legal identity of the target device and verify the authenticity of the sent operation data, thereby ensuring the data security during the operation of the target business and avoiding the risk of data being maliciously tampered with.

[0115] In a possible embodiment, the method may further include: In response to receiving a verification result returned by the server that is a verification exception, outputting an identity authentication message, wherein the identity authentication message is used to prompt the user to perform identity authentication; In response to determining that the identity authentication is successful, a certificate request corresponding to the current device is generated, and the certificate request is sent to the server to obtain a new device certificate returned by the server based on the certificate request, and the step of sending a device verification request to the server based on the target device certificate is returned.

[0116] Among them, the verification result returned by the server is a verification exception. At this time, it may be determined based on the target device certificate that the target service is currently running on other devices, or the target device certificate corresponding to the current device may be invalid. At this time, the user corresponding to the current device is prompted to facilitate the user to perform identity authentication, so as to re-obtain a new device certificate for the server to perform device verification. Among them, the application process for identity authentication and device certificates has been described in detail above and will not be repeated here. Therefore, the verification result of the server can be fed back in time during the process of the current device running the target service, so that the current user can perceive the usage status of the target account under the target service, so as to facilitate the user's use of the target service and improve the user experience.

[0117] Based on the same inventive concept, the present disclosure also provides an application running device, such as Figure 4 As shown, applied to a client device, the device 10 includes: The first acquisition module 101 is used to obtain a target device certificate corresponding to the current device in response to the target service of the target application running, wherein the target service is used to represent the service configured with the device login condition in the target application, the target device certificate is used to verify that the current device runs the target service, and the target device certificate is used to represent the device certificate associated with the target account logged in in the target application under the target service; A first sending module 102 is used to send a device verification request to a server based on the target device certificate, so that the server determines whether the current device is a target login device running the target service based on the device verification request and the device login condition corresponding to the target service; The running module 103 is configured to run the target service of the target application based on the target device certificate in response to receiving a verification result returned by the server indicating that the verification is passed.

[0118] Optionally, the first acquisition module includes: An acquisition submodule, used to acquire the account identifier of the target account; an output submodule, configured to output an identity authentication message if the device certificate associated with the account identifier under the target service is not found in the current device, wherein the identity authentication message is used to prompt the user to perform identity authentication; The first processing submodule is used to generate a certificate request corresponding to the current device in response to determining that the identity authentication is passed, and send the certificate request to the server to obtain the device certificate returned by the server based on the certificate request, and use the returned device certificate as the target device certificate.

[0119] Optionally, the first processing submodule includes: A first encryption submodule is used to encrypt each verification information of the current device respectively to obtain ciphertext data corresponding to each verification information, wherein the verification information includes device information of the current device, service information of the target service and target key information, and the target key information is used to encrypt the service information; A first generating submodule, used for generating signature information based on each of the ciphertext data; The second generating submodule is used to generate the certificate request based on each of the ciphertext data and the signature information.

[0120] Optionally, the first encryption submodule includes: A second encryption submodule, used to encrypt the target key information based on the public key in the first key pair used by the current device to obtain ciphertext data corresponding to the target key information; The third encryption submodule is used to encrypt the device information and the service information based on the target key information to obtain ciphertext data corresponding to the device information and the service information.

[0121] Optionally, the current device is associated with multiple key pairs, and the first processing submodule further includes: A first determining submodule, used to determine a key identifier corresponding to a first key pair currently used by the device; The second generation submodule is further used for: The certificate request is generated based on each of the ciphertext data, the signature information and the key identifier.

[0122] Optionally, the verification information also includes a signed salt value randomly generated by the current device; The first generation submodule comprises: A splicing submodule, used for splicing each of the ciphertext data to obtain a spliced ​​ciphertext, and splicing the signed salt value to the spliced ​​ciphertext to obtain a verification ciphertext; The third generating submodule is used to generate the signature information based on the verification ciphertext.

[0123] Optionally, the device further comprises: A first determination module, configured to determine a currently running service in the target application in response to receiving a logout message sent by the server; A first output module, configured to output an identity authentication message if the currently running service is an associated service of the logout message, wherein the identity authentication message is used to prompt the user to perform identity authentication; A processing module is used to generate a certificate request corresponding to the current device in response to determining that the identity authentication is passed, and send the certificate request to the server to obtain a new device certificate returned by the server based on the certificate request, triggering the first sending module to send a device verification request to the server based on the target device certificate.

[0124] Optionally, the device further comprises: A second determination module, configured to determine a currently running service in the target application in response to receiving a logout message sent by the server; A deletion module is used to delete the device certificate if the currently running service is not the associated service of the logout message and the target device stores the device certificate of the target account under the associated service.

[0125] Optionally, the target device certificate includes a private key of the second key pair; The operation module includes: A fourth encryption submodule, used to sign the operation data corresponding to the target business based on the private key in the target device certificate to obtain signed operation data; The sending submodule is used to send the signature operation data to the server.

[0126] Optionally, the device further comprises: A second output module, configured to output an identity authentication message in response to receiving a verification result returned by the server that is a verification exception, wherein the identity authentication message is used to prompt the user to perform identity authentication; A processing module is used to generate a certificate request corresponding to the current device in response to determining that the identity authentication is passed, and send the certificate request to the server to obtain a new device certificate returned by the server based on the certificate request, triggering the first sending module to send a device verification request to the server based on the target device certificate.

[0127] The present disclosure also provides an application running device, which is applied to a server, such as Figure 5 As shown, the device 20 comprises: A receiving module 201 is used to receive a device verification request sent by a target device, wherein the device verification request includes a certificate identifier of a target device certificate corresponding to the target device, wherein the target device certificate is used to verify the target service of the target application running on the target device, and wherein the target device certificate is used to represent a device certificate associated with a target account logged in to the target application; The third determination module 202 is used to determine the verification result based on the certificate identification and the device login condition corresponding to the target service and send it to the target device, wherein the verification result is used to indicate whether the target device is a login device running the target service.

[0128] Optionally, the device login condition is single device login, and the third determination module includes: A query submodule, used to query the target device certificate corresponding to the certificate identifier on the server side; A second determination submodule is used to determine the log-off device corresponding to the account identifier based on the account identifier in the target device certificate and the device login condition; A second processing submodule is used to invalidate the device certificate of the kick-login device associated with the account identifier under the target service, and send a kick-login message to the kick-login device; The third determination submodule is used to determine that the verification result is a passed verification if the identity authentication information of the kick-login device for the kick-login message is not received within a preset time period.

[0129] Optionally, the third determining module further includes: An authentication submodule is used to authenticate the kick-login device based on the identity authentication information if the identity authentication information of the kick-login device for the kick-login message is received within the preset time period; The fourth determination submodule is used to invalidate the target device certificate in response to determining that the identity authentication of the login device has passed, and determine that the verification result is a verification exception.

[0130] Optionally, the device 20 further includes: A verification module, used to receive a certificate request sent by a target device and verify the signature information in the certificate request; A decryption module, used to decrypt the ciphertext data in the certificate request after the signature information is verified, to obtain the device information of the target device and the service information of the target service; a generating module, configured to generate a second key pair and a certificate identifier, and generate a target device certificate corresponding to the target device based on the device information of the target device, the account identifier of the target account logged in in the target application, the certificate identifier, and the private key of the second key pair; The second sending module is used to associate and store the certificate identifier with the target device certificate, and send the target device certificate to the target device.

[0131] Optionally, the device verification request includes device auxiliary information, the device login condition includes a condition corresponding to the device auxiliary information, and the device auxiliary information includes login area information and / or device system information; The third determination module comprises: A query submodule, used to query the target device certificate corresponding to the certificate identifier on the server side; A fifth determination submodule, configured to determine, based on the account identifier in the target device certificate, a logged-in device corresponding to the account identifier; A sixth determination submodule, configured to determine, from the logged-in devices, a kick-off device corresponding to the account identifier based on the device auxiliary information and the device login condition; A second processing submodule is used to invalidate the device certificate of the kick-login device associated with the account identifier under the target service, and send a kick-login message to the kick-login device; The third determination submodule is used to determine that the verification result is a passed verification if the identity authentication information of the kick-login device for the kick-login message is not received within a preset time period.

[0132] Reference below Figure 6 , which shows a schematic diagram of the structure of an electronic device (such as a terminal device or a server) 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0133] like Figure 6As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0134] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0135] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0136] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0137] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0138] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0139] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: in response to the target business of the target application running, obtains the target device certificate corresponding to the current device, wherein the target business is used to represent the business with device login conditions configured in the target application, and the target device certificate is used to verify that the current device runs the target business, and the target device certificate is used to represent the device certificate associated with the target account logged in to the target application under the target business; based on the target device certificate, sends a device verification request to the server, so that the server determines whether the current device is the target login device running the target business based on the device verification request and the device login conditions corresponding to the target business; in response to receiving the verification result returned by the server that the verification is passed, runs the target business of the target application based on the target device certificate.

[0140] Alternatively, the computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device: receives a device verification request sent by a target device, the device verification request includes a certificate identifier of a target device certificate corresponding to the target device, the target device certificate is used to verify the target service of the target application running on the target device, and the target device certificate is used to represent the device certificate associated with a target account logged in to the target application; based on the certificate identifier and the device login condition corresponding to the target service, determines a verification result and sends it to the target device, and the verification result is used to indicate whether the target device is a logged-in device running the target service.

[0141] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0142] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0143] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the first acquisition module may also be described as "a module for acquiring a target device certificate corresponding to the current device in response to the target service operation of the target application".

[0144] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0145] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0146] According to one or more embodiments of the present disclosure, Example 1 provides an application running method, which is applied to a client device, and the method includes: In response to the target service of the target application running, obtaining a target device certificate corresponding to the current device, wherein the target service is used to represent the service for which the device login condition is configured in the target application, the target device certificate is used to verify that the current device runs the target service, and the target device certificate is used to represent the device certificate associated with the target account logged in in the target application under the target service; Sending a device verification request to the server based on the target device certificate, so that the server determines whether the current device is a target login device running the target service based on the device verification request and the device login condition corresponding to the target service; In response to receiving a verification result returned by the server indicating that the verification is passed, the target service of the target application is run based on the target device certificate.

[0147] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein obtaining a target device certificate corresponding to the current device includes: Obtaining the account ID of the target account; If the device certificate associated with the account identifier under the target service is not found in the current device, an identity authentication message is output, wherein the identity authentication message is used to prompt the user to perform identity authentication; In response to determining that the identity authentication is passed, a certificate request corresponding to the current device is generated, and the certificate request is sent to the server to obtain a device certificate returned by the server based on the certificate request, and the returned device certificate is used as the target device certificate.

[0148] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 2, wherein generating a certificate request corresponding to the current device includes: Encrypt each verification information of the current device respectively to obtain ciphertext data corresponding to each verification information, wherein the verification information includes device information of the current device, service information of the target service and target key information, and the target key information is used to encrypt the service information; Generate signature information based on each of the ciphertext data; The certificate request is generated based on each of the ciphertext data and the signature information.

[0149] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 3, wherein the encrypting each verification information of the current device to obtain ciphertext data corresponding to each verification information includes: Encrypting the target key information based on the public key in the first key pair used by the current device to obtain ciphertext data corresponding to the target key information; The device information and the service information are encrypted based on the target key information to obtain ciphertext data corresponding to the device information and the service information.

[0150] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 3, wherein the current device is associated with multiple key pairs, and generating a certificate request corresponding to the current device further includes: Determine a key identifier corresponding to a first key pair currently used by the device; The generating the certificate request based on each of the ciphertext data and the signature information comprises: The certificate request is generated based on each of the ciphertext data, the signature information and the key identifier.

[0151] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 3, wherein the verification information further includes a signed salt value randomly generated by the current device; The generating of signature information based on each of the ciphertext data comprises: Concatenate each of the ciphertext data to obtain a concatenated ciphertext, and concatenate the signed salt value to the concatenated ciphertext to obtain a verification ciphertext; The signature information is generated based on the verification ciphertext.

[0152] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 1, wherein the method further includes: In response to receiving the logout message sent by the server, determining the currently running service in the target application; If the currently running service is an associated service of the log-off message, an identity authentication message is output, wherein the identity authentication message is used to prompt the user to perform identity authentication; In response to determining that the identity authentication is successful, a certificate request corresponding to the current device is generated, and the certificate request is sent to the server to obtain a new device certificate returned by the server based on the certificate request, and the step of sending a device verification request to the server based on the target device certificate is returned.

[0153] According to one or more embodiments of the present disclosure, Example 8 provides the method of Example 1, wherein the method further includes: In response to receiving the logout message sent by the server, determining the currently running service in the target application; If the currently running service is not an associated service of the logout message, and the target device stores a device certificate of the target account under the associated service, the device certificate is deleted.

[0154] According to one or more embodiments of the present disclosure, Example 9 provides the method of Example 1, wherein the target device certificate includes a private key of a second key pair; The target service of running the target application based on the target device certificate includes: Signing the operation data corresponding to the target service based on the private key in the target device certificate to obtain signed operation data; Send the signature operation data to the server.

[0155] According to one or more embodiments of the present disclosure, Example 10 provides the method of Example 1, wherein the method further includes: In response to receiving a verification result returned by the server that is a verification exception, outputting an identity authentication message, wherein the identity authentication message is used to prompt the user to perform identity authentication; In response to determining that the identity authentication is successful, a certificate request corresponding to the current device is generated, and the certificate request is sent to the server to obtain a new device certificate returned by the server based on the certificate request, and the step of sending a device verification request to the server based on the target device certificate is returned.

[0156] According to one or more embodiments of the present disclosure, Example 11 provides an application running method, which is applied to a server, and the method includes: Receive a device verification request sent by a target device, the device verification request including a certificate identifier of a target device certificate corresponding to the target device, the target device certificate being used to verify a target service of a target application running on the target device, the target device certificate being used to represent a device certificate associated with a target account logged in to the target application; Based on the certificate identifier and the device login condition corresponding to the target service, a verification result is determined and sent to the target device, wherein the verification result is used to indicate whether the target device is a login device running the target service.

[0157] According to one or more embodiments of the present disclosure, Example 12 provides the method of Example 11, wherein the device login condition is single device login, and the determining of the verification result based on the certificate identifier and the device login condition corresponding to the target service includes: Querying the target device certificate corresponding to the certificate identifier on the server; Based on the account identifier in the target device certificate and the device login condition, determining the kick-out device corresponding to the account identifier; invalidating the device certificate of the kick-login device associated with the account identifier under the target service, and sending a kick-login message to the kick-login device; If the identity authentication information of the Kick Login Device for the Kick Login message is not received within a preset time period, it is determined that the verification result is passed.

[0158] According to one or more embodiments of the present disclosure, Example 13 provides the method of Example 12, wherein the determining the verification result based on the certificate identifier and the device login condition corresponding to the target service further includes: If the identity authentication information of the kick-logging device for the kick-logging message is received within the preset time period, the kick-logging device is authenticated based on the identity authentication information; In response to determining that the identity authentication of the login device is passed, the target device certificate is invalidated, and the verification result is determined to be a verification exception.

[0159] According to one or more embodiments of the present disclosure, Example 14 provides the method of Example 11, wherein the method further includes: Receive a certificate request sent by a target device, and verify signature information in the certificate request; After the signature information is verified, the ciphertext data in the certificate request is decrypted to obtain the device information of the target device and the service information of the target service; Generate a second key pair and a certificate identifier, and generate a target device certificate corresponding to the target device based on the device information of the target device, the account identifier of the target account logged in in the target application, the certificate identifier and the private key of the second key pair; The certificate identifier and the target device certificate are associated and stored, and the target device certificate is sent to the target device.

[0160] According to one or more embodiments of the present disclosure, Example 15 provides the method of Example 11, wherein the device verification request includes device auxiliary information, the device login condition includes a condition corresponding to the device auxiliary information, and the device auxiliary information includes login area information and / or device system information; The determining of the verification result based on the certificate identifier and the device login condition corresponding to the target service includes: Querying the target device certificate corresponding to the certificate identifier on the server; Based on the account identifier in the target device certificate, determining a logged-in device corresponding to the account identifier; Based on the device auxiliary information and the device login condition, determining the logout device corresponding to the account identifier from the logged-in devices; invalidating the device certificate of the kick-login device associated with the account identifier under the target service, and sending a kick-login message to the kick-login device; If the identity authentication information of the Kick Login Device for the Kick Login message is not received within a preset time period, it is determined that the verification result is passed.

[0161] According to one or more embodiments of the present disclosure, Example 16 provides an application running device, applied to a client device, the device comprising: A first acquisition module is used to obtain a target device certificate corresponding to the current device in response to the target service of the target application running, wherein the target service is used to represent the service configured with the device login condition in the target application, the target device certificate is used to verify that the current device runs the target service, and the target device certificate is used to represent the device certificate associated with the target account logged in in the target application under the target service; A first sending module, configured to send a device verification request to a server based on the target device certificate, so that the server determines whether the current device is a target login device running the target service based on the device verification request and the device login condition corresponding to the target service; The running module is used for running the target service of the target application based on the target device certificate in response to receiving a verification result returned by the server that the verification is passed.

[0162] According to one or more embodiments of the present disclosure, Example 17 provides an application running device, which is applied to a server, and the device includes: A receiving module, configured to receive a device verification request sent by a target device, wherein the device verification request includes a certificate identifier of a target device certificate corresponding to the target device, wherein the target device certificate is used to verify the target service of the target application running on the target device, and wherein the target device certificate is used to represent a device certificate associated with a target account logged in to the target application; The third determination module is used to determine the verification result based on the certificate identifier and the device login condition corresponding to the target service and send it to the target device, wherein the verification result is used to indicate whether the target device is a login device running the target service.

[0163] According to one or more embodiments of the present disclosure, Example 18 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-15 when executed by a processing device.

[0164] According to one or more embodiments of the present disclosure, Example 19 provides an electronic device, comprising: a storage device on which a computer program is stored; and a processing device for executing the computer program in the storage device to implement the steps of any one of the methods described in Examples 1-15.

[0165] According to one or more embodiments of the present disclosure, Example 20 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-15 when executed by a processor.

[0166] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0167] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0168] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. An application running method, characterized in that: Applied to a client device, the method comprises: In response to the target service of the target application running, obtaining a target device certificate corresponding to the current device, wherein the target service is used to represent the service configured with the device login condition in the target application, the target device certificate is used to verify that the current device runs the target service, and the target device certificate is used to represent the device certificate associated with the target account logged in in the target application under the target service; Sending a device verification request to the server based on the target device certificate, so that the server determines whether the current device is a target login device running the target service based on the device verification request and the device login condition corresponding to the target service; In response to receiving a verification result returned by the server indicating that the verification is passed, the target service of the target application is run based on the target device certificate.

2. The method according to claim 1, characterized in that The step of obtaining the target device certificate corresponding to the current device includes: Obtaining the account ID of the target account; If the device certificate associated with the account identifier under the target service is not found in the current device, an identity authentication message is output, wherein the identity authentication message is used to prompt the user to perform identity authentication; In response to determining that the identity authentication is passed, a certificate request corresponding to the current device is generated, and the certificate request is sent to the server to obtain a device certificate returned by the server based on the certificate request, and the returned device certificate is used as the target device certificate.

3. The method according to claim 2, characterized in that The generating a certificate request corresponding to the current device includes: Encrypt each verification information of the current device respectively to obtain ciphertext data corresponding to each verification information, wherein the verification information includes device information of the current device, service information of the target service and target key information, and the target key information is used to encrypt the service information; Generate signature information based on each of the ciphertext data; The certificate request is generated based on each of the ciphertext data and the signature information.

4. The method according to claim 3, characterized in that The step of encrypting each verification information of the current device to obtain ciphertext data corresponding to each verification information includes: Encrypting the target key information based on the public key in the first key pair used by the current device to obtain ciphertext data corresponding to the target key information; The device information and the service information are encrypted based on the target key information to obtain ciphertext data corresponding to the device information and the service information.

5. The method according to claim 3, characterized in that: The current device is associated with multiple key pairs, and the generating a certificate request corresponding to the current device further includes: Determine a key identifier corresponding to a first key pair currently used by the device; The generating the certificate request based on each of the ciphertext data and the signature information comprises: The certificate request is generated based on each of the ciphertext data, the signature information and the key identifier.

6. The method according to claim 3, characterized in that The verification information also includes a signed salt value randomly generated by the current device; The generating of signature information based on each of the ciphertext data comprises: Concatenate each of the ciphertext data to obtain a concatenated ciphertext, and concatenate the signed salt value to the concatenated ciphertext to obtain a verification ciphertext; The signature information is generated based on the verification ciphertext.

7. The method according to claim 1, characterized in that The method further comprises: In response to receiving the logout message sent by the server, determining the currently running service in the target application; If the currently running service is an associated service of the log-off message, an identity authentication message is output, wherein the identity authentication message is used to prompt the user to perform identity authentication; In response to determining that the identity authentication is successful, a certificate request corresponding to the current device is generated, and the certificate request is sent to the server to obtain a new device certificate returned by the server based on the certificate request, and the step of sending a device verification request to the server based on the target device certificate is returned.

8. The method according to claim 1, characterized in that The method further comprises: In response to receiving the logout message sent by the server, determining the currently running service in the target application; If the currently running service is not an associated service of the logout message, and the target device stores a device certificate of the target account under the associated service, the device certificate is deleted.

9. The method according to claim 1, characterized in that: The target device certificate includes a private key of a second key pair; The target service of running the target application based on the target device certificate includes: Signing the operation data corresponding to the target service based on the private key in the target device certificate to obtain signed operation data; Send the signature operation data to the server.

10. The method according to claim 1, characterized in that The method further comprises: In response to receiving a verification result returned by the server that is a verification exception, outputting an identity authentication message, wherein the identity authentication message is used to prompt the user to perform identity authentication; In response to determining that the identity authentication is successful, a certificate request corresponding to the current device is generated, and the certificate request is sent to the server to obtain a new device certificate returned by the server based on the certificate request, and the step of sending a device verification request to the server based on the target device certificate is returned.

11. A method for running an application, characterized in that: Applied to the server, the method includes: Receive a device verification request sent by a target device, the device verification request including a certificate identifier of a target device certificate corresponding to the target device, the target device certificate being used to verify a target service of a target application running on the target device, the target device certificate being used to represent a device certificate associated with a target account logged in to the target application; Based on the certificate identifier and the device login condition corresponding to the target service, a verification result is determined and sent to the target device, wherein the verification result is used to indicate whether the target device is a login device running the target service.

12. The method according to claim 11, characterized in that The device login condition is a single device login, and the determining of the verification result based on the certificate identifier and the device login condition corresponding to the target service includes: Querying the target device certificate corresponding to the certificate identifier on the server; Based on the account identifier in the target device certificate and the device login condition, determining the kick-out device corresponding to the account identifier; invalidating the device certificate of the kick-login device associated with the account identifier under the target service, and sending a kick-login message to the kick-login device; If the identity authentication information of the Kick Login Device for the Kick Login message is not received within a preset time period, it is determined that the verification result is passed.

13. The method according to claim 12, characterized in that The determining of the verification result based on the certificate identifier and the device login condition corresponding to the target service also includes: If the identity authentication information of the kick-logging device for the kick-logging message is received within the preset time period, the kick-logging device is authenticated based on the identity authentication information; In response to determining that the identity authentication of the login device is passed, the target device certificate is invalidated, and the verification result is determined to be a verification exception.

14. The method according to claim 11, characterized in that The method further comprises: Receive a certificate request sent by a target device, and verify signature information in the certificate request; After the signature information is verified, the ciphertext data in the certificate request is decrypted to obtain the device information of the target device and the service information of the target service; Generate a second key pair and a certificate identifier, and generate a target device certificate corresponding to the target device based on the device information of the target device, the account identifier of the target account logged in in the target application, the certificate identifier and the private key of the second key pair; The certificate identifier and the target device certificate are associated and stored, and the target device certificate is sent to the target device.

15. The method according to claim 11, characterized in that The device verification request includes device auxiliary information, the device login condition includes a condition corresponding to the device auxiliary information, and the device auxiliary information includes login area information and / or device system information; The determining of the verification result based on the certificate identifier and the device login condition corresponding to the target service includes: Querying the target device certificate corresponding to the certificate identifier on the server; Based on the account identifier in the target device certificate, determining a logged-in device corresponding to the account identifier; Based on the device auxiliary information and the device login condition, determining the logout device corresponding to the account identifier from the logged-in devices; invalidating the device certificate of the kick-login device associated with the account identifier under the target service, and sending a kick-login message to the kick-login device; If the identity authentication information of the Kick Login Device for the Kick Login message is not received within a preset time period, it is determined that the verification result is passed.

16. An application running device, characterized in that: Applied to a client device, the device comprises: A first acquisition module is used to obtain a target device certificate corresponding to the current device in response to the target service of the target application running, wherein the target service is used to represent the service configured with the device login condition in the target application, the target device certificate is used to verify that the current device runs the target service, and the target device certificate is used to represent the device certificate associated with the target account logged in in the target application under the target service; A first sending module, configured to send a device verification request to a server based on the target device certificate, so that the server determines whether the current device is a target login device running the target service based on the device verification request and the device login condition corresponding to the target service; The running module is used for running the target service of the target application based on the target device certificate in response to receiving a verification result returned by the server that the verification is passed.

17. An application running device, characterized in that: Applied to the server, the device comprises: A receiving module, configured to receive a device verification request sent by a target device, wherein the device verification request includes a certificate identifier of a target device certificate corresponding to the target device, wherein the target device certificate is used to verify the target service of the target application running on the target device, and wherein the target device certificate is used to represent a device certificate associated with a target account logged in to the target application; The third determination module is used to determine the verification result based on the certificate identifier and the device login condition corresponding to the target service and send it to the target device, wherein the verification result is used to indicate whether the target device is a login device running the target service.

18. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 15 are implemented.

19. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 15.

20. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

Images