Multi-system login method, device, storage medium and program product

Abstract

Embodiments of the present application provide a multi-system login method and device, a storage medium and a program product, and relate to the technical field of security authentication. The method comprises: in response to successful identity verification of a digital portal, receiving a token sent by a server, displaying system portals of a plurality of systems associated with the digital portal, the token comprising an authority identifier; in response to a touch operation on a system portal of a target system in the system portals of the plurality of systems, determining a system verification level of the target system according to the authority identifier; if the system verification level of the target system is a first system level, logging into a preset page of the target system; if the system verification level of the target system is a second system level, verifying first system verification information input by a user based on verification prompt information corresponding to the second system level; and if the verification is successful, logging into the preset page of the target system. The method provided in the embodiments improves the convenience and security of multi-system login.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of distributed technology, and particularly relate to a multi-system login method, device, storage medium and program product. BACKGROUND

[0002] With the development of Internet technology, an enterprise can establish multiple systems to provide different services for users.

[0003] In the related art, multiple systems are independent of each other, and a user can log in to access a corresponding system based on an account password corresponding to the system.

[0004] However, in the process of implementing the present application, the inventors have found that at least the following problem exists in the prior art: in the above manner, the user needs to remember multiple sets of account passwords, which causes inconvenience when logging in to multiple systems. SUMMARY

[0005] Embodiments of the present application provide a multi-system login method, device, storage medium and program product to improve the convenience and security of multi-system login.

[0006] In a first aspect, embodiments of the present application provide a multi-system login method applied to a terminal device, and the method comprises:

[0007] In response to successful identity verification through a digital portal, receiving a token sent by a server, and displaying system portals of multiple systems associated with the digital portal; the token comprises a permission identifier;

[0008] In response to a touch operation on a system portal of a target system in the system portals of the multiple systems, determining a system verification level of the target system according to the permission identifier;

[0009] If the system verification level of the target system is a first system level, logging in to a preset page of the target system;

[0010] If the system verification level of the target system is a second system level, generating verification prompt information corresponding to the second system level; verifying first system verification information input by a user based on the verification prompt information corresponding to the second system level, and if the verification is successful, logging in to a preset page of the target system.

[0011] In a possible design, the verification prompt information comprises at least one of the following: inserting a bank shield, inputting an SMS verification code, performing fingerprint verification, performing voiceprint verification, and performing face verification.

[0012] In a possible design, before successfully logging in to the digital portal, the method further comprises:

[0013] displaying a login page of a digital portal;

[0014] in response to a login operation on the login page, obtaining a portal login account and a password corresponding to the login operation, sending the portal login account and the password to a server to enable the server to verify the portal login account and the password, and if the verification is passed, generating a token and sending the token to the terminal device.

[0015] In a possible design, before the system verification level of the target system is determined according to the permission identifier, the method further includes:

[0016] decrypting the token to obtain a timestamp of generating the token and a valid duration of the token;

[0017] determining whether the token is valid according to the timestamp of generating the token and the valid duration of the token;

[0018] if the token is valid, determining the system verification level of the target system according to the permission identifier.

[0019] In a possible design, the method further includes:

[0020] based on a preset period, actively calling a refresh interface to obtain a new valid token from the server.

[0021] In a possible design, the login operation on the preset page of the target system includes:

[0022] determining a function display level of the target system according to the permission identifier;

[0023] logging in a preset page of the target system, and the preset page of the target system displays function entrances of a plurality of function modules matched with the function display level.

[0024] In a possible design, after the login operation on the preset page of the target system, the method further includes:

[0025] in response to a touch operation on a function entrance of a target function module in the function entrances of the plurality of function modules in the preset page, logging in the target function module;

[0026] in response to execution of a business function provided by the target function module, determining a function verification level of the target function module according to the permission identifier;

[0027] If the function verification level of the target function is a first function level, verification prompt information corresponding to the first function level is generated; first function verification information input by a user based on the verification prompt information corresponding to the first function level is verified, and if the verification is successful, the execution of the business function is completed;

[0028] If the system verification level of the target system is a second function level, verification prompt information corresponding to the second function level is generated; second function verification information input by a user based on the verification prompt information corresponding to the second function level is verified, and if the verification is successful, the execution of the business function is completed;

[0029] The security of the second function verification information is greater than that of the first function verification information.

[0030] In a second aspect, an embodiment of the present application provides a multi-system login method, applied to a server, and the method comprises the following steps:

[0031] Receiving a portal login account and a password of a digital portal sent by a terminal device;

[0032] Verifying the portal login account and the password;

[0033] If the verification is passed, generating a token according to a user unique identifier corresponding to the portal login account; the token comprises a permission identifier; the permission identifier is used to indicate a corresponding system verification level; different system verification levels correspond to different verification complexities;

[0034] Sending the token to the terminal device.

[0035] In a possible design, the step of generating the token according to the user unique identifier corresponding to the portal login account comprises the following steps:

[0036] Combining the user unique identifier corresponding to the portal login account and the permission identifier into a JSON object or a string to obtain token original data;

[0037] Encrypting the original data based on a preset key, and generating the token according to the encrypted original data.

[0038] In a possible design, the step of generating the token according to the user unique identifier corresponding to the portal login account comprises the following steps:

[0039] Recording a timestamp of generating the token;

[0040] Generating the token according to the timestamp, a preset valid time length and the user unique identifier corresponding to the portal login account.

[0041] In a possible design, after the token is generated according to the timestamp, the preset valid time length, and the user unique identifier corresponding to the portal login account, the method further includes:

[0042] If the remaining valid time of the token is less than or equal to the preset time length, a new token is automatically generated.

[0043] In a third aspect, an embodiment of the present application provides a terminal device, including:

[0044] A display module, configured to receive a token sent by a server in response to successful identity verification of a digital portal, and display system portals of a plurality of systems associated with the digital portal; the token includes an authority identifier.

[0045] A determination module, configured to determine a system verification level of a target system of the system portals of the plurality of systems according to the authority identifier in response to a touch operation on a system portal of the target system.

[0046] A login module, configured to log in a preset page of the target system if the system verification level of the target system is a first system level.

[0047] The login module is further configured to generate verification prompt information corresponding to a second system level if the system verification level of the target system is the second system level, and to verify first system verification information input by a user based on the verification prompt information corresponding to the second system level, and log in the preset page of the target system if the verification is successful.

[0048] In a fourth aspect, an embodiment of the present application provides a server, including:

[0049] A receiving module, configured to receive a portal login account and a password of a digital portal sent by a terminal device.

[0050] A verification module, configured to verify the portal login account and the password.

[0051] A generation module, configured to generate a token according to a user unique identifier corresponding to the portal login account if the verification is passed; the token includes an authority identifier; the authority identifier is used to indicate a corresponding system verification level; different system verification levels correspond to different verification complexities.

[0052] A sending module, configured to send the token to the terminal device.

[0053] In a fifth aspect, an embodiment of the present application provides an electronic device, including at least one processor and a memory.

[0054] The memory stores computer execution instructions.

[0055] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method described in the first aspect and various possible designs of the first aspect.

[0056] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, and the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the method described in the first aspect and various possible designs of the first aspect is implemented.

[0057] In a seventh aspect, an embodiment of the present application provides a computer program product, and the computer program product includes a computer program. When a processor executes the computer program, the method described in the first aspect and various possible designs of the first aspect is implemented.

[0058] The multi-system login method, device, storage medium, and program product provided in the embodiments of the present application include the following steps: in response to successful identity verification through a digital portal, a token sent by a server is received, and system portals of a plurality of systems associated with the digital portal are displayed. The token includes an authority identifier. In response to a touch operation on a system portal of a target system in the system portals of the plurality of systems, a system verification level of the target system is determined according to the authority identifier. If the system verification level of the target system is a first system level, a preset page of the target system is logged in. If the system verification level of the target system is a second system level, verification prompt information corresponding to the second system level is generated. First system verification information input by a user based on the verification prompt information corresponding to the second system level is verified. If the verification is successful, the preset page of the target system is logged in. The method provided in the embodiments of the present application sets a digital portal. After successful identity verification through the digital portal, a token is generated to log in to each system in the digital portal based on the token. The authority identifier is embedded when the token is generated. Different systems can be logged in through different verification levels based on the authority identifier. The risk level of different systems is finely managed. Security risks are eliminated. The convenience and security of multi-system login are improved. BRIEF DESCRIPTION OF DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application. Those skilled in the art can obtain other drawings according to these drawings without any creative labor.

[0060] Figure 1 The scene schematic diagram of the multi-system login method provided in the embodiments of the present application is shown in the following figure.

[0061] Figure 2Flowchart of the multi-system login method provided by the embodiment of the present application Figure 1 ;

[0062] Figure 3 Flowchart of the multi-system login method provided by the embodiment of the present application Figure 2 ;

[0063] Figure 4 Interaction diagram of the multi-system login method provided by the embodiment of the present application

[0064] Figure 5 Structure diagram of the terminal device provided by the embodiment of the present application

[0065] Figure 6 Structure diagram of the server provided by the embodiment of the present application

[0066] Figure 7 Hardware structure diagram of the electronic device provided by the embodiment of the present application DETAILED DESCRIPTION

[0067] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in a clear and complete manner with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0068] In the technical solutions of the present application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data comply with relevant laws and regulations and do not violate public order and good customs.

[0069] It should be noted that in the embodiments of the present application, some existing industry solutions such as software, components and models may be mentioned, which should be considered as exemplary and only for the purpose of illustrating the feasibility of the implementation of the technical solutions of the present application, but do not mean that the applicant has or will necessarily use the solutions.

[0070] Currently, the public business of the banking industry involves multiple systems and platforms, such as online banking with functions such as money transfer transactions, and systems for querying information. Due to the different login and authentication mechanisms of these systems, users need to remember and input different account numbers and passwords, causing inconvenience. In addition, the security control mechanisms between different systems are inconsistent, increasing the security risks.

[0071] In order to solve the above problems, improve user experience and system security, the present application inventors have found that the system entrances of multiple systems can be integrated by setting a digital portal, and then a token corresponding to the user is generated after the user logs in the digital portal, and then the system entrance of each system can be logged in based on the token. In order to further fine manage the risk levels of different systems, the permission level information of the user can be added when the token is generated, so that when logging into each system according to the token, the corresponding level verification can be performed based on the permission level information contained in the token, ensuring that systems of different risk levels are protected to different degrees, and eliminating security risks.

[0072] Figure 1 The scene schematic diagram of the multi-system login method provided by the embodiment of the present application is shown in FIG. 1. Figure 1 As shown in FIG. 1, the terminal device 101 and the server 102 are in communication connection. The terminal device 101 can be a mobile phone, a tablet computer, a computer or the like, and the server 102 can be a cluster server or a cloud server.

[0073] In the specific implementation process, the terminal device 101 is installed with a digital portal, the terminal device 101 receives the verification information input by the user for the digital portal, and sends the verification information to the server 102 for identity verification. After the verification is passed, the server 102 generates a token and sends the token to the terminal device 101. The terminal device 101 receives the token sent by the server, displays the system entrances of multiple systems associated with the digital portal, the token includes a permission identifier, and in response to a touch operation on the system entrance of a target system in the system entrances of the multiple systems, the system verification level of the target system is determined according to the permission identifier. If the system verification level of the target system is the first system level, the preset page of the target system is logged in, if the system verification level of the target system is the second system level, the verification prompt information corresponding to the second system level is generated, the first system verification information input by the user based on the verification prompt information corresponding to the second system level is verified, and if the verification is successful, the preset page of the target system is logged in. The multi-system login method provided by the embodiment of the present application sets a digital portal, and generates a token after successfully passing the identity verification for the digital portal, so as to log into each system in the digital portal based on the token. In addition, the permission identifier is embedded when the token is generated, and different systems can be logged in through different verification complexity based on the permission identifier, so as to fine manage the risk levels of different systems and eliminate security risks.

[0074] It should be noted that, Figure 1The illustrated scene diagram is only an example. The multi-system login method and the scene described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, as systems evolve and new business scenarios appear, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0075] The technical solutions of the present application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described in some embodiments.

[0076] Figure 2 Flowchart of the multi-system login method provided by the embodiments of the present application Figure 1 As shown in Figure 2 , the method is applied to a terminal device, and specifically includes:

[0077] 201, in response to successful authentication through a digital portal, receiving a token sent by a server, and displaying system entrances of a plurality of systems associated with the digital portal; the token includes a permission identifier.

[0078] Specifically, an enterprise usually has a plurality of systems to provide different services for users. In order to facilitate user operation, the embodiments integrate a plurality of channel entrances such as enterprise online banking and consulting platforms to build a unified digital portal, so that a user can access all systems after obtaining a unique token, and simplify the login process. When logging in to the digital portal, the user can input the account and password of the digital portal into the terminal device, so as to authenticate the identity of the user. When the authentication is passed, a token corresponding to the user for logging in to each system integrated by the digital portal can be obtained. In addition, different systems have different risk levels, therefore, by adding a permission identifier when generating the token, the access permission and security level of each system are finely managed, so as to eliminate security risks and avoid causing fund loss or information leakage.

[0079] In some embodiments, before the successful login to the digital portal, the method further includes: displaying a login page of the digital portal; in response to a login operation on the login page, obtaining a portal login account and password corresponding to the login operation, and sending the portal login account and password to a server, so that the server authenticates the portal login account and password. If the authentication is passed, a token is generated, and the token is sent to the terminal device.

[0080] Specifically, the terminal device is installed with an application program of the digital portal. After the application program is opened, a login page can be displayed. The login page can include input boxes of an account and a password. After the terminal device receives the portal login account and password and other verification information input by the user, the terminal device sends the verification information to the server for authentication. The server generates a token after the authentication is passed. Then, the token can be sent to the terminal device, so that the terminal device logs in the multiple systems associated with the digital portal based on the token.

[0081] The multi-system login method provided in the embodiment can uniformly manage users based on the digital portal by using the account and password to verify the login of the digital portal. After this login, subsequent logins of the systems can be performed by automatically identifying the token generated after the verification is passed. The security is good, and the convenience of login is improved.

[0082] 202. In response to a touch operation on a system portal of a target system in the system portals of the multiple systems, determine a system verification level of the target system according to the permission identifier.

[0083] Specifically, after the verification is successful, the system portals of the multiple systems are displayed in the page. A touch operation (such as clicking, long pressing, etc.) on one of the system portals can automatically identify the token and log in the system corresponding to the system portal according to the token. In order to perform risk control, the permission identifier can be extracted in the automatic identification of the token. The system verification level indicated by the permission identifier is determined, and then it is determined what degree of verification is required for the user to log in the system.

[0084] In some embodiments, in order to further improve the security, the token can be encrypted to prevent the token from being tampered with. Specifically, before the system verification level of the target system is determined according to the permission identifier, the token can also be decrypted to obtain a timestamp of generating the token and a valid duration of the token. Whether the token is valid is determined according to the timestamp of generating the token and the valid duration of the token. If the token is valid, the system verification level of the target system is determined according to the permission identifier.

[0085] Specifically, after the user is authenticated, the authentication server can generate a token according to the unique identifier (such as user ID) of the user, the permission identifier (such as role, permission level), device information and other context information. When the token is generated, the system can embed the permission information (such as user role, permission level, accessible resources) of the user into the token, so as to be directly used for permission verification in the future. Symmetric encryption (such as AES) or asymmetric encryption (such as RSA) algorithm can also be used to encrypt the content of the token to ensure its security and anti-tamper property.

[0086] In the specific implementation process, the raw data is first generated by combining the user's ID, permission identifier, device information, etc., into a JSON object or string. Next, encryption is performed: the raw data is encrypted using a preset key. Finally, a token is output: the encrypted data is converted into a token and returned to the client.

[0087] In some embodiments, to ensure continuous system security and user convenience, the token may have a certain validity period and an automatic renewal mechanism. Specifically, based on a preset period, the refresh interface is actively called to obtain a new valid token from the server.

[0088] 203. If the system verification level of the target system is the first system level, then log in to the preset page of the target system.

[0089] 204. If the system verification level of the target system is the second system level, then generate verification prompt information corresponding to the second system level; verify the first system verification information entered by the user based on the verification prompt information corresponding to the second system level; if the verification is successful, log in to the preset page of the target system.

[0090] Specifically, system-level security controls can be further subdivided for multiple systems. Different role permissions can be set for different systems. For example, for financial systems, the highest security level role can be assigned. When users access these systems, they need to undergo dual verification through a bank security token and SMS verification code to ensure the authenticity of the user's identity and the legality of the operation. A specific implementation method could be: after logging into the digital portal, the user selects to access the corporate online banking. The system prompts the user to insert the bank security token and enter the SMS verification code. After successful verification, the user can perform high-risk operations, such as fund transfers. For information systems, a lower security level role can be assigned. Users only need to perform basic login verification, without additional security verification measures. A specific implementation method could be: after logging into the digital portal, the user selects to access Feizhi E-Information. The system directly allows access without additional verification.

[0091] In some embodiments, to ensure security, the number of verification failures can be limited. After verifying the verification information entered by the user based on the verification prompt information corresponding to the second system level, the process may further include: if verification fails, updating the total number of failures; the total number of failures is the sum of the number of verification failures performed when logging into multiple systems after successfully logging into the digital portal; if the total number of failures is greater than a preset value, logging out of the digital portal.

[0092] In some embodiments, the method can further include: if the system verification level of the target system is a third system level, generating verification prompt information corresponding to the third system level; verifying second system verification information input by the user based on the verification prompt information corresponding to the third system level, and if the verification is successful, logging into a preset page of the target system; the security of the second system verification information is greater than that of the first system verification information.

[0093] In some embodiments, the verification prompt information includes at least one of the following: inserting a net bank shield, inputting an SMS verification code, performing fingerprint verification, performing voiceprint verification, and performing face verification.

[0094] Specifically, different system levels can perform verification of different complexity levels. For example, the verification types can be stacked, and the more stacked, the higher the complexity level. For example, the complexity levels from low to high can be: directly logging in with verification, needing to perform a net bank shield and an SMS verification code, needing to perform a net bank shield, an SMS verification, and a fingerprint verification, and the like.

[0095] In some embodiments, in order to manage the risk levels of the function modules in detail, different function modules can be displayed to different users. Specifically, the logging into the preset page of the target system can include: determining a function display level of the target system according to the permission identifier; and logging into the preset page of the target system, and the preset page of the target system displays function entrances of a plurality of function modules matched with the function display level.

[0096] In some embodiments, in order to manage the risk levels of the function modules in detail, different verification levels of different function modules can be set for different users. Specifically, after the logging into the preset page of the target system, the method can further include: in response to a touch operation on a function entrance of a target function module in the function entrances of the plurality of function modules in the preset page, logging into the target function module; in response to executing a business function provided by the target function module, determining a function verification level of the target function module according to the permission identifier; if the function verification level of the target function is a first function level, generating verification prompt information corresponding to the first function level; verifying first function verification information input by the user based on the verification prompt information corresponding to the first function level, and if the verification is successful, executing the business function; if the system verification level of the target system is a second function level, generating verification prompt information corresponding to the second function level; verifying second function verification information input by the user based on the verification prompt information corresponding to the second function level, and if the verification is successful, executing the business function; the security of the second function verification information is greater than that of the first function verification information.

[0097] Specifically, in the system, different functions are processed according to different risk levels: for low-risk functions, such as user self-account transactions in enterprise online banking, the user only needs to verify the SMS or password to complete the operation. The specific implementation includes: the user selects to perform self-account operation; the system prompts the user to input the SMS verification code or password; after verification succeeds, the user completes the operation. For high-risk functions, such as transactions with other people's funds in enterprise online banking, the user not only needs to verify the SMS or password, but also needs to pass the second verification through the online banking shield to ensure transaction security. The specific implementation includes: the user selects to perform transactions with other people's funds. The system prompts the user to insert the online banking shield and input the SMS verification code or password. After verification succeeds, the user completes the transaction.

[0098] In this embodiment, through the security hierarchical control mechanism of system level and function level, the security of the system is effectively improved, and the security requirements of different risk operations are met. The access permissions and security verification methods of different systems and functions are finely designed to ensure the security of the operation.

[0099] From the above description, it can be seen that the multi-system login method provided by the embodiment of the application sets a digital portal, generates a token after successfully passing the identity verification of the digital portal, logs in each system in the digital portal based on the token, and embeds a permission identifier when generating the token. Based on the permission identifier, different systems can be logged in through different verification complexities, realizing fine management of the risk levels of different systems and eliminating security risks. The unified security control mechanism ensures the security consistency between the systems, reduces the potential security risks, and the strict verification method and permission setting fully protect the high-risk operations and reduce the possibility of fund loss and information leakage.

[0100] Figure 3 Flowchart of the multi-system login method provided by the embodiment of the application Figure 2 As shown in Figure 3 , the method comprises:

[0101] 301, receiving a portal login account and password of a digital portal sent by a terminal device.

[0102] 302, verifying the portal login account and password.

[0103] 303, if the verification is passed, generating a token according to a user unique identifier corresponding to the portal login account; the token comprises a permission identifier; the permission identifier is used to indicate a corresponding system verification level; different system verification levels correspond to different verification complexities.

[0104] 304, sending the token to the terminal device.

[0105] Specifically, in the process of logging in the digital portal, the terminal device receives the portal login account and password input by the user for the digital portal, and sends the account and password to the server for verification. After verification, the server generates a token according to the unique identifier of the user (such as the portal login account), and embeds the permission identifier in the token generation process to perform fine-grained permission management based on the token when logging into each system. In this embodiment, the user only needs to log in once in the digital portal to obtain a unique token Token to access all systems, improving user experience and reducing the cumbersome operation of repeated login.

[0106] In some embodiments, to further improve security, the token can be encrypted to prevent tampering. The token generated according to the unique identifier of the user corresponding to the portal login account can include: combining the unique identifier of the user corresponding to the portal login account and the permission identifier into a JSON object or a string to obtain token original data; encrypting the original data based on a preset key, and generating a token according to the encrypted original data.

[0107] Specifically, after the user is authenticated, the authentication server can generate a token according to the unique identifier of the user (such as the user ID), the permission identifier (such as the role, the permission level), the device information and other context information. When generating the token, the system can embed the user's permission information (such as user role, permission level, accessible resources) into the token for subsequent direct use in permission verification. Symmetric encryption (such as AES) or asymmetric encryption (such as RSA) algorithms can also be used to encrypt the token content to ensure its security and tamper resistance.

[0108] In the specific implementation process, first, the original data is generated: the ID, permission identifier, device information, etc. of the user are combined into a JSON object or a string. Second, encryption processing: the original data is encrypted using a preset key. Finally, output the token: convert the encrypted data into a token (Token), and return it to the client.

[0109] In some embodiments, to ensure the continuous security of the system and the convenient use of the user, the token Token can have a certain validity period. The token generated according to the unique identifier of the user corresponding to the portal login account includes: recording the timestamp of generating the token; generating a token according to the timestamp, a preset valid duration, and the unique identifier of the user corresponding to the portal login account.

[0110] In some embodiments, to ensure the validity of the token, an automatic update mechanism for the token can be set. Specifically, after the token is generated according to the timestamp, the preset valid duration, and the unique identifier of the user corresponding to the portal login account, the method further includes: if the remaining valid time of the token is less than or equal to the preset duration, a new token is automatically generated.

[0111] Specifically, an effective duration can be set, within which the token is valid from the generation time. If the effective duration is exceeded, it is determined to be invalid. The system can configure the "automatic renewal" or "manual refresh" function of the token, and update the effective duration when the token is about to expire or is refreshed.

[0112] For example, the server adds an effective duration field (such as 30 minutes) when generating the token, and records the timestamp of the token generation in the token. An effective duration field is added when the token is generated, for example, the effective period is 30 minutes. The effective duration can be determined by checking the timestamp after decrypting the token to determine whether it has expired. When the token is about to expire, the system can provide a refresh mechanism to generate a new token to continue the user's session.

[0113] In the process of verifying the validity of the token, the system in the terminal device extracts user information, permission identifier, and effective duration from the token when receiving a request containing the token, and performs permission verification and invalidity check. The system checks whether the user has the permission to perform the requested operation according to the parsed permission identifier. During the verification process, the system checks the timestamp and effective duration field of the token to ensure that the token is used within the effective period. For example, the terminal device decrypts the token, extracts the permission information and effective duration, checks whether the permission information meets the permission requirements of the requested operation, and checks whether the effective duration has expired. If the token has expired, access is denied and the user is prompted to log in again.

[0114] After setting the effective duration of the token to ensure security, the token is reissued to ensure its continuous validity: one way is automatic renewal: the system can automatically renew the token within a certain time window before it expires, for example, generate a new token within the last 10 minutes and return it to the client. Another way is active refresh: the client can request to refresh the token to ensure the continuity of the session. When refreshing the token, the system generates a new token and updates the effective duration.

[0115] Specifically, when the token is about to expire (such as within 10 minutes), the system automatically generates a new token and updates the effective duration. The client can actively call the refresh interface to obtain a new valid token.

[0116] In summary, token generation: generate a token based on user ID and permission identifier, ensure that permission information is embedded, and encrypt to ensure security. Invalid mechanism: set the effective duration when generating the token, and support automatic renewal or active refresh mechanism to ensure the continuity of the session. Validity verification: the system obtains permission information and effective duration by decrypting the token when receiving a request, performs permission verification and expiration check to ensure the validity of the token. Reissue: the system supports the reissue mechanism of the token to deal with the expiration and invalidity of the token.

[0117] The multi-system login method provided by the embodiment generates a token after successfully passing the authentication of the digital portal, logs into each system in the digital portal based on the token, and embeds a permission identifier when generating the token, so that different systems can be logged into through different verification complexities based on the permission identifier, the risk level of different systems is finely managed, and security risks are eliminated.

[0118] Figure 4 An interaction schematic diagram of the multi-system login method provided by the embodiment of the application is shown in FIG. 1. Figure 4 As shown in the figure, the method comprises the following steps.

[0119] 401. The terminal device displays a login page of a digital portal.

[0120] 402. The terminal device receives a touch operation of a user on the login page.

[0121] 403. The terminal device sends a portal login account and a password corresponding to the touch operation to a server.

[0122] 404. The server verifies the portal login account and the password.

[0123] 405. If the verification is passed, the server generates a token according to a user unique identifier corresponding to the portal login account; the token comprises a permission identifier; the permission identifier is used to indicate a system verification level; different system verification levels correspond to different verification complexities.

[0124] 406. The server sends the token to the terminal device.

[0125] 407. The terminal device receives the token sent by the server in response to successfully passing the authentication of the digital portal, displays system entrances of a plurality of systems associated with the digital portal; the token comprises a permission identifier.

[0126] 408. In response to a touch operation on a system entrance of a target system in the system entrances of the plurality of systems, a system verification level of the target system is determined according to the permission identifier.

[0127] 409. If the system verification level of the target system is a first system level, a preset page of the target system is logged into.

[0128] 410. If the system verification level of the target system is a second system level, verification prompt information corresponding to the second system level is generated; first system verification information input by a user based on the verification prompt information corresponding to the second system level is verified, and if the verification is successful, a preset page of the target system is logged into.

[0129] The multi-system login method provided by the embodiment provides a digital portal, generates a token after successfully passing the identity verification of the digital portal, logs into each system in the digital portal based on the token, and embeds a permission identifier when generating the token, so that different systems can be logged into through different verification complexities based on the permission identifier, fine management of risk levels of different systems is realized, and security risks are eliminated.

[0130] Figure 5 The terminal device provided by the embodiment of the application is shown in a structural schematic diagram. As shown in the figure, the terminal device 50 includes a display module 501, a determination module 502, and a login module 503. Figure 5

[0131] The display module 501 is configured to receive a token sent by a server in response to successfully passing the identity verification of a digital portal, and display system entrances of a plurality of systems associated with the digital portal; the token includes a permission identifier.

[0132] The determination module 502 is configured to determine a system verification level of a target system in the system entrances of the plurality of systems according to the permission identifier in response to a touch operation on the system entrance of the target system.

[0133] The login module 503 is configured to log into a preset page of the target system if the system verification level of the target system is a first system level.

[0134] The login module 503 is further configured to generate verification prompt information corresponding to a second system level if the system verification level of the target system is the second system level, and verify first system verification information input by a user based on the verification prompt information corresponding to the second system level, and log into the preset page of the target system if the verification is successful.

[0135] The service network initiation device provided by the embodiment of the application provides a digital portal, generates a token after successfully passing the identity verification of the digital portal, logs into each system in the digital portal based on the token, and embeds a permission identifier when generating the token, so that different systems can be logged into through different verification complexities based on the permission identifier, fine management of risk levels of different systems is realized, and security risks are eliminated.

[0136] In some embodiments, the verification prompt information includes at least one of the following: inserting a bank shield, inputting an SMS verification code, performing fingerprint verification, performing voiceprint verification, and performing face verification.

[0137] In some embodiments, the display module 501 is further configured to display a login page of the digital portal.

[0138] ​In response to a login operation for the login page, a portal login account and a password corresponding to the login operation are obtained, the portal login account and the password are sent to a server, the server verifies the portal login account and the password, if the verification is passed, a token is generated, and the token is sent to the terminal device.

[0139] In some embodiments, the determining module 502 is specifically configured to decrypt the token, obtain a timestamp of generating the token and a valid duration of the token, determine whether the token is valid according to the timestamp of generating the token and the valid duration of the token, and if the token is valid, determine a system verification level of the target system according to the permission identifier.

[0140] In some embodiments, the login module 503 is further configured to actively call a refresh interface based on a preset period, and obtain a new valid token from the server.

[0141] In some embodiments, the login module 503 is specifically configured to determine a function display level of the target system according to the permission identifier, and log in a preset page of the target system, wherein the preset page of the target system displays function entrances of a plurality of function modules matched with the function display level.

[0142] In some embodiments, the login module 503 is further configured to log in a target function module in response to a touch operation on a function entrance of the target function module in the function entrances of the plurality of function modules in the preset page, determine a function verification level of the target function module according to the permission identifier in response to execution of a business function provided by the target function module, generate verification prompt information corresponding to a first function level if the function verification level of the target function is the first function level, verify first function verification information input by a user based on the verification prompt information corresponding to the first function level, and if the verification is successful, complete execution of the business function, generate verification prompt information corresponding to a second function level if the system verification level of the target system is the second function level, verify second function verification information input by the user based on the verification prompt information corresponding to the second function level, and if the verification is successful, complete execution of the business function, and the security of the second function verification information is greater than that of the first function verification information.

[0143] The terminal device provided by the embodiments of the present application can be used to execute the method embodiments described above, which have similar implementation principles and technical effects, and details are not described herein.

[0144] Figure 6 The structure diagram of the server provided by the embodiments of the present application is shown in FIG. 6. Figure 6As shown, the server 60 comprises a receiving module 601, a verifying module 602, a generating module 603 and a sending module 604.

[0145] The receiving module 601 is configured to receive a portal login account and a password of a digital portal sent by a terminal device.

[0146] The verifying module 602 is configured to verify the portal login account and the password.

[0147] The generating module 603 is configured to generate a token according to a user unique identifier corresponding to the portal login account if the verification is passed; the token comprises a permission identifier; the permission identifier is used to indicate a corresponding system verification level; different system verification levels correspond to different verification complexities.

[0148] The sending module 604 is configured to send the token to the terminal device.

[0149] The service network initiating device provided by the embodiment of the present application generates a token after successfully passing the identity verification for the digital portal, logs in each system in the digital portal based on the token, and embeds a permission identifier in the token when generating the token, so that different systems can be logged in through different verification complexities based on the permission identifier, the fine management of risk levels for different systems is realized, and the security risks are eliminated.

[0150] In some embodiments, the generating module 603 is specifically configured to: combine the user unique identifier corresponding to the portal login account and the permission identifier into a JSON object or a string to obtain token original data; encrypt the original data based on a preset key, and generate a token according to the encrypted original data.

[0151] In some embodiments, the generating module 603 is specifically configured to: record a timestamp of generating the token; and generate the token according to the timestamp, a preset valid time length and the user unique identifier corresponding to the portal login account.

[0152] In some embodiments, the generating module 603 is further configured to: if a remaining valid time of the token is less than or equal to a preset time length, automatically generate a new token.

[0153] The server provided by the embodiment of the present application can be used to execute the method embodiment with the server as the execution subject, and the implementation principles and technical effects are similar, and the embodiment will not be described here.

[0154] Figure 7 The hardware structure schematic diagram of the electronic device provided by the embodiment of the present application is shown. The device can be a computer, a tablet device, a server, etc.

[0155] The device 70 can include one or more of the following components: a processing component 701, a memory 702, a power supply component 703, a multimedia component 704, an audio component 705, an input / output (I / O) interface 706, a sensor component 707, and a communication component 708.

[0156] The processing component 701 generally controls the overall operation of the device 70 such as the operation of the display, the telephone call, the data communication, the camera operation and the recording operation. The processing component 701 can include one or more processors 709 to execute instructions to complete the steps of the methods described above. Furthermore, the processing component 701 can include one or more modules to facilitate the interaction between the processing component 701 and other components. For example, the processing component 701 can include a multimedia module to facilitate the interaction between the multimedia component 704 and the processing component 701.

[0157] The memory 702 is configured to store various types of data to support the operation of the device 70. Examples of these data include instructions for any application or method operating on the device 70, contact data, phonebook data, messages, pictures, videos, and so on. The memory 702 can be implemented by any type of volatile or non-volatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0158] The power supply component 703 supplies the power for the various components of the device 70. The power supply component 703 can include a power management system, one or more power supplies, and other components associated with generating, managing and distributing power for the device 70.

[0159] The multimedia component 704 includes a screen providing an output interface between the device 70 and the user. In some embodiments, the screen can include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes the touch panel, the screen can be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense a touch, a slide and a gesture on the touch panel. The touch sensors can not only sense a boundary of a touching or a sliding action, but also detect duration and pressure related to the touching or sliding action. In some embodiments, the multimedia component 704 includes a front camera and / or a back camera. The front camera and / or the back camera can receive external multimedia data when the device 70 is in an operation mode, such as a photographing mode or a video mode. Each of the front camera and the back camera can be a fixed optical lens system or have a focal length and an optical zooming capability.

[0160] The audio component 705 is configured to output and / or input audio signals. For example, the audio component 705 includes a microphone (MIC) that is configured to receive an external audio signal when the device 700 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory 702 or transmitted via the communication component 708. In some embodiments, the audio component 705 also includes a speaker for outputting audio signals.

[0161] The I / O interface 706 provides an interface between the processing component 701 and peripheral interface modules, which can be a keypad, a click wheel, buttons, and the like. The buttons can include, but are not limited to, a home button, a volume button, a start button, and a lock button.

[0162] The sensor component 707 includes one or more sensors for providing status assessments for various aspects of the device 700. For example, the sensor component 707 can detect an open / closed position of the device 700, relative positioning of components, such as a display and a keypad of the device 700, a change of position of the device 700 or a component of the device 700, presence or absence of user contact with the device 700, orientation or acceleration / deceleration / g-force and temperature of the device 700. The sensor component 707 can include an orientation sensor, a proximity sensor, a

[0163] The communication component 708 is configured to facilitate wired or wireless communication between the device 700 and another device. The device 700 can access a wireless network based on a communication standard, such as WiFi, 2G, or 3G, or a combination thereof. In an example embodiment, the communication component 708 receives broadcast signals or broadcast-related information from external broadcast management systems via a broadcast channel. In an example embodiment, the communication component 708 also includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on Radio Frequency Identification (RFID) techniques, infrared data association (IrDA) techniques, ultra-wideband (UWB) techniques, Bluetooth (BT) techniques, and other techniques.

[0164] In exemplary embodiments, the device 70 can be implemented by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, micro-controllers, microprocessors or other electronic components, for executing the above-described methods.

[0165] In exemplary embodiments, a non-transitory computer readable storage medium including instructions, such as the memory 702 including instructions, is also provided, which can be executed by the processor 709 of the device 70 to complete the above-described methods. For example, the non-transitory computer readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disc, and an optical data storage device, etc.

[0166] The above-described computer readable storage medium can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic storage, a flash memory, a magnetic disc or a optical disc. The readable storage medium can be any available medium which can be accessed by a general or special purpose computer.

[0167] An exemplary readable storage medium is coupled to the processor, so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the device.

[0168] It can be understood by those skilled in the art that all or part of the steps of the above-described method embodiments can be completed by program instruction related hardware. The foregoing program can be stored in a computer readable storage medium. When the program is executed, the steps of the above-described method embodiments are executed; and the foregoing storage medium includes: a ROM, a RAM, a magnetic disc or an optical disc, and various storage media which can store program codes.

[0169] The embodiments of the present application also provide a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the multi-system login method executed by the multi-system login device.

[0170] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A multi-system login method, characterized in that, Applied to a terminal device, the method includes: In response to successful authentication through the digital portal, a token sent by the server is received, and system entry points for multiple systems associated with the digital portal are displayed; the token includes an authorization identifier. In response to a touch operation on the system entry of a target system among the system entry points of the plurality of systems, the system verification level of the target system is determined based on the permission identifier; If the system verification level of the target system is the first system level, then log in to the preset page of the target system; If the system verification level of the target system is the second system level, then a verification prompt message corresponding to the second system level is generated; the first system verification message entered by the user based on the verification prompt message corresponding to the second system level is verified; if the verification is successful, the user logs into the preset page of the target system. The preset page for logging into the target system includes: The functional display level of the target system is determined based on the permission identifier; Log in to the preset page of the target system, where the preset page of the target system displays function entry points for multiple function modules that match the function display level; After logging into the preset page of the target system, the method further includes: In response to a touch operation on the function entry of a target function module among the function entries of multiple function modules in the preset page, log in to the function module; In response to executing the business functions provided by the functional module, the functional verification level of the target functional module is determined according to the permission identifier; If the function verification level of the target function is the first function level, then a verification prompt message corresponding to the first function level is generated; the first function verification message input by the user based on the verification prompt message corresponding to the first function level is verified; if the verification is successful, then the business function is executed. If the system verification level of the target system is the second functional level, then a verification prompt message corresponding to the second functional level is generated; the second functional verification message input by the user based on the verification prompt message corresponding to the second functional level is verified; if the verification is successful, then the business function is executed. The security of the second function verification information is greater than that of the first function verification information.

2. The method according to claim 1, characterized in that, The verification prompt information includes at least one of the following: inserting a bank security token, entering an SMS verification code, performing fingerprint verification, performing voiceprint verification, or performing facial verification.

3. The method according to claim 1, characterized in that, The response prior to successful login to the digital portal also includes: Display the login page of the digital portal; In response to a login operation on the login page, the system obtains the portal login account and password corresponding to the login operation, sends the portal login account and password to the server, so that the server can verify the portal login account and password. If the verification is successful, a token is generated and the token is sent to the terminal device.

4. The method according to claim 1, characterized in that, Before determining the system verification level of the target system based on the permission identifier, the method further includes: Decrypt the token to obtain the timestamp of the token's generation and the token's validity period; The validity of the token is determined based on the timestamp of the generated token and the validity period of the token. If valid, the system verification level of the target system is determined based on the permission identifier.

5. The method according to claim 4, characterized in that, The method further includes: Based on a preset period, the refresh interface is actively called to obtain a new valid token from the server.

6. A multi-system login method, characterized in that, Applied to a server, the method includes: Receive the digital portal login account and password sent by the terminal device; Verify the portal login account and password; If the verification is successful, a token is generated based on the unique user identifier corresponding to the portal login account; the token includes a permission identifier; the permission identifier is used to indicate the corresponding system verification level; different system verification levels correspond to different verification complexities; Send the token to the terminal device; In response to successful authentication through the digital portal, the terminal device receives a token sent by the server and displays system entry points for multiple systems associated with the digital portal; the token includes an authorization identifier. The terminal device responds to a touch operation on the system entry of a target system among the system entry points of the plurality of systems, and determines the system verification level of the target system based on the permission identifier; If the system verification level of the target system is the first system level, then the terminal device logs into the preset page of the target system; If the system verification level of the target system is the second system level, the terminal device generates verification prompt information corresponding to the second system level; verifies the first system verification information input by the user based on the verification prompt information corresponding to the second system level; if the verification is successful, the user logs into the preset page of the target system. The preset page for logging into the target system includes: The functional display level of the target system is determined based on the permission identifier; Log in to the preset page of the target system, where the preset page of the target system displays function entry points for multiple function modules that match the function display level; After logging into the preset page of the target system, the method further includes: In response to a touch operation on the function entry of a target function module among the function entries of multiple function modules in the preset page, log in to the function module; In response to executing the business functions provided by the functional module, the functional verification level of the target functional module is determined according to the permission identifier; If the function verification level of the target function is the first function level, then a verification prompt message corresponding to the first function level is generated; the first function verification message input by the user based on the verification prompt message corresponding to the first function level is verified; if the verification is successful, then the business function is executed. If the system verification level of the target system is the second functional level, then a verification prompt message corresponding to the second functional level is generated; the second functional verification message input by the user based on the verification prompt message corresponding to the second functional level is verified; if the verification is successful, then the business function is executed. The security of the second function verification information is greater than that of the first function verification information.

7. The method according to claim 6, characterized in that, The step of generating a token based on the unique user identifier corresponding to the portal login account includes: Combine the user's unique identifier and permission identifier corresponding to the portal login account into a JSON object or string to obtain the token's raw data; The original data is encrypted using a preset key, and a token is generated based on the encrypted original data.

8. The method according to claim 6 or 7, characterized in that, The step of generating a token based on the unique user identifier corresponding to the portal login account includes: Record the timestamp of the generated token; A token is generated based on the timestamp, the preset validity period, and the unique identifier of the user corresponding to the portal login account.

9. The method according to claim 8, characterized in that, After generating the token based on the timestamp, preset validity period, and the unique user identifier corresponding to the portal login account, the process further includes: If the remaining validity period of the token is less than or equal to the preset duration, a new token will be automatically generated.

10. A terminal device, characterized in that, include: The display module is used to receive a token sent by the server in response to successful authentication through the digital portal and to display the system entry points of multiple systems associated with the digital portal. The token includes an authorization identifier; The determination module is used to respond to a touch operation on the system entry of a target system among the system entry points of the plurality of systems, and determine the system verification level of the target system based on the permission identifier; The login module is used to log in to the preset page of the target system if the system verification level of the target system is the first system level. The login module is also used to generate verification prompt information corresponding to the second system level if the system verification level of the target system is the second system level; to verify the first system verification information entered by the user based on the verification prompt information corresponding to the second system level; and to log in to the preset page of the target system if the verification is successful. The login module is specifically used to determine the functional display level of the target system based on the permission identifier; and to log in to the preset page of the target system, where the preset page of the target system displays the functional entry points of multiple functional modules that match the functional display level. The login module is also used to log in to the function module in response to a touch operation on the function entry of a target function module among the function entry of multiple function modules in the preset page. In response to executing the business functions provided by the functional module, the functional verification level of the target functional module is determined according to the permission identifier; If the function verification level of the target function is the first function level, then a verification prompt message corresponding to the first function level is generated; the first function verification message input by the user based on the verification prompt message corresponding to the first function level is verified; if the verification is successful, then the business function is executed. If the system verification level of the target system is the second functional level, then a verification prompt message corresponding to the second functional level is generated; the second functional verification message input by the user based on the verification prompt message corresponding to the second functional level is verified; if the verification is successful, then the business function is executed. The security of the second function verification information is greater than that of the first function verification information.

11. A server, characterized in that, include: The receiving module is used to receive the portal login account and password of the digital portal sent by the terminal device; The verification module is used to verify the portal login account and password; The generation module is used to generate a token based on the unique user identifier corresponding to the portal login account if the verification is successful; the token includes a permission identifier; the permission identifier is used to indicate the corresponding system verification level; Different system verification levels correspond to different verification complexities; A sending module is used to send the token to the terminal device; In response to successful authentication through the digital portal, the terminal device receives a token sent by the server and displays system entry points for multiple systems associated with the digital portal; the token includes an authorization identifier. The terminal device responds to a touch operation on the system entry of a target system among the system entry points of the plurality of systems, and determines the system verification level of the target system based on the permission identifier; If the system verification level of the target system is the first system level, then the terminal device logs into the preset page of the target system; If the system verification level of the target system is the second system level, the terminal device generates verification prompt information corresponding to the second system level; verifies the first system verification information input by the user based on the verification prompt information corresponding to the second system level; if the verification is successful, the user logs into the preset page of the target system. The preset page for logging into the target system includes: The functional display level of the target system is determined based on the permission identifier; Log in to the preset page of the target system, where the preset page of the target system displays function entry points for multiple function modules that match the function display level; After logging into the preset page of the target system, the method further includes: In response to a touch operation on the function entry of a target function module among the function entries of multiple function modules in the preset page, log in to the function module; In response to executing the business functions provided by the functional module, the functional verification level of the target functional module is determined according to the permission identifier; If the function verification level of the target function is the first function level, then a verification prompt message corresponding to the first function level is generated; the first function verification message input by the user based on the verification prompt message corresponding to the first function level is verified; if the verification is successful, then the business function is executed. If the system verification level of the target system is the second functional level, then a verification prompt message corresponding to the second functional level is generated; the second functional verification message input by the user based on the verification prompt message corresponding to the second functional level is verified; if the verification is successful, then the business function is executed. The security of the second function verification information is greater than that of the first function verification information.

12. An electronic device, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the multi-system login method as described in any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the multi-system login method as described in any one of claims 1 to 9.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the multi-system login method according to any one of claims 1 to 9.

Images