Authorized login method and device, electronic equipment and storage medium

Abstract

The invention provides an authorized login method and device, electronic equipment and a storage medium, and relates to the technical field of cloud security, and the method comprises the steps: firstly, obtaining a user-defined code which is used for obtaining user identity authentication information; secondly, executing the user-defined code based on a sandbox engine to obtain execution result information; and finally, acquiring user identity authentication information from the first application program according to the execution result information, and authorizing a user of the first application program to log in the second application program based on the user identity authentication information. In the embodiment of the invention, the user-defined code is executed by utilizing the sandbox engine, and the sandbox engine provides an isolation environment to execute the untrusted user-defined code, so that the security of code extension can be ensured.

Description

Technical Field

[0001] The present application relates to the field of cloud security technology, and in particular to an authorized login method, device, electronic device and storage medium. Background Art

[0002] With the development of communication technology and Internet technology, applications with various service functions have been widely used, and more and more users use applications on terminal devices to handle various affairs in daily life and work. Due to the large variety of applications, it will bring inconvenience to users to register an account and log in to each application separately. Therefore, through the identity and access management services on the cloud, such as Identity as a Service (IDaaS), the user's identity authentication information is managed uniformly to enable the user of the source application to log in to the target application in an authorized manner.

[0003] Since there are many types of source applications, the authorization protocol (e.g., OAuth protocol) does not define detailed standards for obtaining user authentication information for various source applications. In order to obtain user authentication information of various source applications to implement authorized login, code extension is required, that is, running the user-defined code corresponding to the source application. However, code extension will affect the security of identity and access management services, for example, causing information leakage, code consumption of a large amount of computing resources or a large number of network access attacks. Summary of the invention

[0004] The embodiments of the present application provide an authorized login method, device, electronic device, and storage medium to solve the security problem of code expansion for authorized login.

[0005] In a first aspect, an embodiment of the present application provides an authorized login method, the method comprising: obtaining a user-defined code, the user-defined code being used to obtain user identity authentication information; executing the user-defined code based on a sandbox engine to obtain execution result information; obtaining user identity authentication information from a first application based on the execution result information, and authorizing the user of the first application to log in to a second application based on the user identity authentication information.

[0006] In the second aspect, an embodiment of the present application provides an authorized login device, which includes: an information acquisition module, used to obtain a user-defined code, the user-defined code is used to obtain user identity authentication information; a code execution module, used to execute the user-defined code based on a sandbox engine to obtain execution result information; an authorized login module, used to obtain user identity authentication information from a first application based on the execution result information, and authorize the user of the first application to log in to the second application based on the user identity authentication information.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor implements any of the above methods when executing the computer program.

[0008] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of the above is implemented.

[0009] Compared with the prior art, this application has the following advantages:

[0010] The present application provides an authorized login method, device, electronic device and storage medium. First, a user-defined code is obtained, and the user-defined code is used to obtain user identity authentication information; second, the user-defined code is executed based on a sandbox engine to obtain execution result information; finally, based on the execution result information, the user identity authentication information is obtained from a first application, and the user of the first application is authorized to log in to a second application based on the user identity authentication information. In the embodiment of the present application, the user-defined code is executed using a sandbox engine, and the sandbox engine provides an isolated environment to execute untrusted user-defined code, which can ensure the security of code expansion.

[0011] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments according to the present application and should not be regarded as limiting the scope of the present application.

[0013] Figure 1 A schematic diagram of an application scenario of the authorized login method provided in this application.

[0014] Figure 2 This is a flowchart of an authorized login method according to an embodiment of the present application.

[0015] Figure 3 This is a structural block diagram of an authorization login device according to an embodiment of the present application.

[0016] Figure 4 A block diagram of an electronic device used to implement an embodiment of the present application. DETAILED DESCRIPTION

[0017] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the concept or scope of the present application. Therefore, the drawings and descriptions are considered to be exemplary in nature and not restrictive.

[0018] To facilitate understanding of the technical solutions of the embodiments of the present application, the following describes the related technologies of the embodiments of the present application. The following related technologies can be combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0019] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0020] Figure 1 A schematic diagram of an application scenario of the authorized login method provided for this application. In this embodiment, the identity and access management service is identity as a service, and the identity as a service server (IDaaS Server) uniformly manages the user's identity authentication information. IDaaS provides cloud-based user identity authentication and access management services to subscribed corporate users and individual users. IDaaS Server is based on the Hypertext Transfer Protocol (HTTP) and communicates with the sandbox engine (sandboxing) through a remote procedure call (RPC). In this embodiment, the sandbox engine is implemented by function computing (FC). Function computing is an event-driven serverless computing service. By encapsulating the code into functions and automatically executing them when events are triggered, high-availability, elastic, and low-cost computing capabilities can be achieved without managing servers and infrastructure.

[0021] The sandbox engine includes multiple execution engine instances (e.g., Script Engine), multiple ScriptEngines constitute a container, multiple execution engine instances are compiled using a compilation language (e.g., Web Assembly), and multiple execution engine instances are used to interpret and execute user-defined code (User JavaScript) to obtain execution result information. The user-defined code may include the code used by IDaaS users to obtain user identity authentication information. Different source applications obtain user identity authentication information in different ways, so users are required to write custom code to implement code extension so that IDaaS can adapt to multiple different types of source applications.

[0022] Among them, the execution result information includes the access address information corresponding to the identity authentication information, and may also include log information (Log). The access address information is sent to a proxy server (for example, a Squid server). When the proxy server determines that the access address information complies with the pre-configured security rules (for example, prohibiting access to private network addresses, etc.), the proxy server obtains the user identity authentication information from the network address corresponding to the source application according to the access address information. The user identity authentication information may include user identity information, such as account information, etc. In addition, it may also include authentication information, such as signature information, authorization code, token, etc. After obtaining the user identity authentication information, the user of the source application is authorized to log in to the target application based on the user identity authentication information. In addition, the log information is stored in the Simple Log Service (SLS) for user query.

[0023] In the embodiment of the present application, a sandbox engine is used to execute user-defined code. The sandbox engine provides an isolated environment to execute untrusted user-defined code, thereby ensuring the security of code expansion.

[0024] The present application embodiment provides an authorized login method. The method in this embodiment can be applied to a computing device, which may include a server, etc. Figure 2 The flowchart of the authorization login method according to an embodiment of the present application is shown, including:

[0025] Step S201, obtaining a user-defined code, where the user-defined code is used to obtain user identity authentication information.

[0026] Step S202: Execute the user-defined code based on the sandbox engine to obtain execution result information.

[0027] Step S203: acquiring user identity authentication information from the first application according to the execution result information, and authorizing the user of the first application to log in to the second application based on the user identity authentication information.

[0028] The user-defined code may include the code used by the user of the identity and access management service to obtain the user authentication information. Different source applications obtain the user authentication information in different ways, so the user needs to write the custom code to implement code extension so that the identity and access management service can adapt to multiple different types of source applications. The first application is the source application, and the second application is the target application.

[0029] In this embodiment, the sandbox engine can be deployed in the server of the identity and access management service, or it can be deployed separately in other servers. The sandbox engine is a constructed software isolation environment in which untrusted user code can be run to obtain execution result information. Since the environment in which the user code is executed is isolated, it will not affect the execution of tasks outside the sandbox, so there will be no security issues, and it can avoid information leakage, code consumption of a large amount of computing resources or a large amount of network access and other attack behaviors.

[0030] The user identity authentication information may include user identity information, such as account information, etc. It may also include authentication information, such as signature information, authorization code, token, etc. After obtaining the user identity authentication information, the user identity authentication information is verified based on the authorization protocol (such as OAuth protocol), and if the verification passes, the user of the first application is authorized to log in to the second application.

[0031] The authorized login method provided in the embodiment of the present application first obtains the user-defined code, which is used to obtain the user identity authentication information; secondly, the user-defined code is executed based on the sandbox engine to obtain the execution result information; finally, the user identity authentication information is obtained from the first application according to the execution result information, and the user of the first application is authorized to log in to the second application based on the user identity authentication information. In the embodiment of the present application, the user-defined code is executed by the sandbox engine, and the sandbox engine provides an isolated environment to execute the untrusted user-defined code, which can ensure the security of code expansion.

[0032] In one implementation, the sandbox engine includes at least one execution engine instance; step S202, executing the user-defined code based on the sandbox engine to obtain execution result information, includes: compiling at least one execution engine instance using a compiled language, and interpreting or compiling and executing the user-defined code using at least one execution engine instance to obtain execution result information.

[0033] The user-defined code may include codes written in multiple languages, for example, codes written in JavaScript. The compiled language may include multiple languages, for example, Web Assembly, which is a class assembly language with a compact binary format that can provide compilation targets for languages ​​such as C / C++ so that they can run on the Web. In this embodiment, the user-defined code is executed using a sandbox engine, which provides an isolated environment to execute untrusted user-defined code, thereby ensuring the security of code expansion.

[0034] In one implementation, the method further includes: configuring at least one execution engine instance to correspond to a corresponding execution instruction quantity threshold and an execution time threshold, and terminating code execution if at least one of the execution instruction quantity threshold or the execution time threshold is exceeded when executing user-defined code.

[0035] In actual applications, security rules can be configured in the execution engine instance according to specific needs. The security rules include execution instruction number threshold and execution time threshold. If the number of execution instructions of the execution code exceeds the execution instruction number threshold, or the execution time exceeds the execution time threshold, the execution of the code is stopped, effectively preventing malicious code from occupying computing resources.

[0036] In one implementation, the execution result information includes access address information corresponding to the identity authentication information, and obtaining the user identity authentication information from the first application based on the execution result information, including: when it is determined that the access address information complies with pre-configured security rules, obtaining the user identity authentication information from the first application based on the access address information.

[0037] In actual applications, security rules can be pre-configured in the sandbox engine. The security rules can include the type of access address information that is restricted, for example, prohibiting access to private network addresses, etc. In compliance with the security rules, the user identity authentication information is obtained from the first application. In this embodiment, the security of accessing the network address is improved by setting security rules.

[0038] In one implementation, the execution result information includes access address information corresponding to the identity authentication information, and obtaining user identity authentication information from the first application based on the execution result information, including: sending the access address information to the proxy server, so that the proxy server obtains the user identity authentication information from the first application based on the access address information when it determines that the access address information complies with pre-configured security rules; and receiving the user identity authentication information sent by the proxy server.

[0039] In actual applications, in addition to pre-configuring security rules directly in the sandbox engine, you can also pre-configure security rules in the proxy server and implement network access restrictions through the proxy server to avoid security vulnerabilities caused by SSRF (Server-Side Request Forgery).

[0040] Among them, the security rules may include the type of access address information that restricts access, for example, prohibiting access to private network addresses, etc. When the security rules are met, the proxy server obtains user authentication information from the first application, and after receiving the user authentication information sent by the proxy server, authorizes the user of the first application to log in to the second application.

[0041] Among them, proxy servers can include many types, for example, Squid servers. Proxy servers can also be other servers that support HTTP or Socks5 proxy protocols. Socks5 servers act as intermediaries between front-end machines and server machines that use TCP / IP protocol to communicate, allowing front-end machines in the intranet to access servers in the Internet, making communication more secure. The Socks5 server forwards the request sent by the front end to the real target server. The front end and the Socks5 server also communicate through the TCP / IP protocol. The front end sends the request originally intended to be sent to the target server to the Socks5 server, and then the Socks5 server forwards the request to the target server.

[0042] In one implementation, the execution result information also includes log information; the method further includes: storing the log information in a preset storage space, wherein the log information records the execution process of the user-defined code.

[0043] Among them, the execution result information may include log information in addition to the access address information corresponding to the identity authentication information. The log information may include a log that records the execution process during the execution of the user-defined code, etc. The log information is stored in a preset database or service, for example, the log information is stored in a simple log service (SimpleLog Service, SLS) for user query and use. SLS is an application log management service that provides a centralized log collection, log storage, log retrieval, log analysis and log reporting basic services for a large number of developers and operation and maintenance personnel.

[0044] In one implementation, the sandbox engine is implemented in any of the following ways: function computing, deployment on a physical server, deployment on a cloud server, or deployment on an application container engine.

[0045] Among them, Function Compute is an event-driven serverless computing service. By encapsulating the code into functions and automatically executing them when events are triggered, high-availability, elastic, and low-cost computing capabilities can be achieved without managing servers and infrastructure. Function Compute provides operating environments for multiple languages ​​(Java, Node.js, Python, PHP, Go, etc.) and a variety of event triggering methods (HTTP triggering, message queue triggering, timed triggering, etc.) to meet the needs of different application scenarios.

[0046] Application container engines include the Docker engine. The Docker engine is an open source application container engine that allows developers to package applications and dependency packages into a portable image and then publish them to machines with Linux or Windows operating systems. It can also achieve virtualization.

[0047] Corresponding to the application scenario and method of the method provided in the embodiment of the present application, the embodiment of the present application also provides an authorized login device. Figure 3 The figure is a structural block diagram of an authorized login device according to an embodiment of the present application, and the device comprises:

[0048] The information acquisition module 301 is used to acquire a user-defined code, and the user-defined code is used to acquire user identity authentication information.

[0049] The code execution module 302 is used to execute the user-defined code based on the sandbox engine to obtain execution result information.

[0050] The authorization login module 303 is used to obtain user identity authentication information from the first application according to the execution result information, and authorize the user of the first application to log in to the second application based on the user identity authentication information.

[0051] The authorization login device provided in the embodiment of the present application first obtains the user-defined code, which is used to obtain the user identity authentication information; secondly, the user-defined code is executed based on the sandbox engine to obtain the execution result information; finally, the user identity authentication information is obtained from the first application according to the execution result information, and the user of the first application is authorized to log in to the second application based on the user identity authentication information. In the embodiment of the present application, the user-defined code is executed by the sandbox engine, and the sandbox engine provides an isolated environment to execute the untrusted user-defined code, which can ensure the security of code expansion.

[0052] In one implementation, the sandbox engine includes at least one execution engine instance; the code execution module 302 is used to: compile at least one execution engine instance using a compilation language, interpret or compile and execute user-defined code using at least one execution engine instance, and obtain execution result information.

[0053] In one implementation, the device is also used to: configure an execution instruction quantity threshold and an execution time threshold corresponding to at least one execution engine instance, and terminate code execution if at least one of the execution instruction quantity threshold or the execution time threshold is exceeded when executing user-defined code.

[0054] In one implementation, the execution result information includes access address information corresponding to the identity authentication information. When the authorization login module 303 obtains the user identity authentication information from the first application based on the execution result information, it is used to: obtain the user identity authentication information from the first application based on the access address information when it is determined that the access address information complies with pre-configured security rules.

[0055] In one implementation, the execution result information includes access address information corresponding to the identity authentication information. When the authorization login module 303 obtains the user identity authentication information from the first application based on the execution result information, it is used to: send the access address information to the proxy server, so that the proxy server obtains the user identity authentication information from the first application based on the access address information when it determines that the access address information complies with pre-configured security rules; and receive the user identity authentication information sent by the proxy server.

[0056] In one implementation, the execution result information also includes log information; the device is further used to: store the log information in a preset storage space, and the log information records the execution process of the user-defined code.

[0057] In one implementation, the sandbox engine is implemented in any of the following ways: function computing, deployment on a physical server, deployment on a cloud server, or deployment on an application container engine.

[0058] The functions of each module in the embodiment of the present application can be referred to the corresponding description in the above method, and have corresponding beneficial effects, which will not be repeated here.

[0059] Figure 4 is a block diagram of an electronic device used to implement an embodiment of the present application. Figure 4 As shown, the electronic device includes: a memory 410 and a processor 420. The memory 410 stores a computer program that can be run on the processor 420. When the processor 420 executes the computer program, the method in the above embodiment is implemented. The number of the memory 410 and the processor 420 can be one or more.

[0060] The electronic device also includes:

[0061] The communication interface 430 is used to communicate with external devices and perform data exchange transmission.

[0062] If the memory 410, the processor 420 and the communication interface 430 are implemented independently, the memory 410, the processor 420 and the communication interface 430 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0063] Optionally, in a specific implementation, if the memory 410, the processor 420 and the communication interface 430 are integrated on a chip, the memory 410, the processor 420 and the communication interface 430 can communicate with each other through an internal interface.

[0064] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the method provided in the embodiment of the present application when the program is executed by a processor.

[0065] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided by the embodiment of the present application.

[0066] An embodiment of the present application also provides a chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided in the embodiment of the application.

[0067] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the Advanced RISC Machines (ARM) architecture.

[0068] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of exemplary but not limiting description, many forms of RAM are available. For example, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DR RAM).

[0069] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0070] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0071] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0072] Any process or method described in the flow chart or otherwise described herein can be understood as a module, fragment or portion of a code representing one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0073] The logic and / or steps described in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or used in combination with these instruction execution systems, devices or apparatuses.

[0074] It should be understood that the various parts of the present application can be implemented with hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented with software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium, and when the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0075] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the above-mentioned integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a disk or an optical disk, etc.

[0076] The above is only an exemplary embodiment of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope recorded in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An authorized login method, characterized in that: The method comprises: Obtaining a user-defined code, wherein the user-defined code is used to obtain user identity authentication information; Execute the user-defined code based on the sandbox engine to obtain execution result information; The user identity authentication information is acquired from the first application according to the execution result information, and a user of the first application is authorized to log in to the second application based on the user identity authentication information.

2. The method according to claim 1, characterized in that: The sandbox engine includes at least one execution engine instance; The executing the user-defined code based on the sandbox engine to obtain execution result information includes: The at least one execution engine instance is compiled using a compilation language, and the user-defined code is interpreted or compiled and executed using the at least one execution engine instance to obtain execution result information.

3. The method according to claim 2, characterized in that The method further comprises: The at least one execution engine instance is configured with an execution instruction quantity threshold and an execution time threshold respectively corresponding to the at least one execution engine instance. If at least one of the execution instruction quantity threshold or the execution time threshold is exceeded when executing the user-defined code, the code execution is terminated.

4. The method according to any one of claims 1 to 3, characterized in that: The execution result information includes access address information corresponding to the identity authentication information, and obtaining the user identity authentication information from the first application according to the execution result information includes: In the case where it is determined that the access address information complies with the pre-configured security rule, the user identity authentication information is obtained from the first application according to the access address information.

5. The method according to any one of claims 1 to 3, characterized in that: The execution result information includes access address information corresponding to the identity authentication information, and obtaining the user identity authentication information from the first application according to the execution result information includes: Sending the access address information to the proxy server, so that the proxy server obtains the user identity authentication information from the first application according to the access address information when determining that the access address information complies with a pre-configured security rule; Receive the user identity authentication information sent by the proxy server.

6. The method according to claim 4, characterized in that The execution result information also includes log information; the method also includes: The log information is stored in a preset storage space, and the log information records the execution process of the user-defined code.

7. The method according to any one of claims 1 to 3, characterized in that: The sandbox engine is implemented in any of the following ways: Function computing is deployed on physical servers, cloud servers, or application container engines.

8. An authorized login device, characterized in that: The device comprises: An information acquisition module is used to acquire a user-defined code, wherein the user-defined code is used to acquire user identity authentication information; A code execution module, used to execute the user-defined code based on the sandbox engine to obtain execution result information; The authorization login module is used to obtain the user identity authentication information from the first application according to the execution result information, and authorize the user of the first application to log in to the second application based on the user identity authentication information.

9. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory, wherein the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images