Identity authentication method and device for group-type enterprise system

Abstract

The invention provides an identity authentication method and device for a group-type enterprise system, and the method comprises the steps: a main enterprise system carries out the authentication of an identity authentication request initiated by a user, and returns an authentication result to the user; sending a one-time authorization code to the sub-enterprise system according to an authorization code application request of the sub-enterprise system; a token is sent to the subsystem according to the token application request of the sub-enterprise system; and returning login information of the user to the sub-enterprise system according to the token sent by the sub-enterprise system so as to complete login of the user in the sub-enterprise system. According to the method and the device, the main enterprise system transmits the identity information through the sub-enterprise system, so that the credible identity information of the user is transmitted from the main enterprise system to the sub-enterprise system, the whole process is rapid and efficient, one-place login and multi-place mutual trust are realized, the method and the device are invisible to the user, the user can realize service operation switching without repeated login, and the user experience is improved. And the user experience is well improved.

Description

Technical Field

[0001] The present invention relates to the field of identity authentication, and more specifically, to an identity authentication method and device for a group enterprise system. Background Art

[0002] In a group enterprise system, in addition to the main enterprise, there are also several subsidiary enterprises. When users need to switch business between different enterprises, traditional technologies require users to log in to each enterprise before performing business operations. Only after successful login and identity authentication can they perform business operations in the enterprise system. This kind of identity authentication not only has many page jumps, but also a cumbersome authentication process, resulting in a poor user experience. Summary of the invention

[0003] In order to solve the technical problem in the prior art that when a user switches services in a group enterprise system, identity authentication not only has many page jumps but also has a cumbersome authentication process, resulting in a poor user experience, the present invention provides an identity authentication method and device for a group enterprise system.

[0004] According to one aspect of the present invention, the present invention provides an identity authentication method for a group enterprise system, wherein the group enterprise system includes a main enterprise system and multiple sub-enterprise systems, and the method includes:

[0005] The main enterprise system authenticates the identity authentication request initiated by the user and returns the authentication result to the user, wherein the identity authentication request includes the account name and account password of the user, and the authentication result includes authentication success and authentication failure;

[0006] The main enterprise system sends a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, wherein the authorization code application request includes the account name of the user and the identity information of the sub-enterprise system, the account name of the user is obtained by the sub-enterprise system parsing the business operation request initiated by the user to it, and the one-time authorization code includes the identity information of the main enterprise system;

[0007] The main enterprise system sends a token to the subsystem according to the token application request of the sub-enterprise system, wherein the token application request includes the one-time authorization code;

[0008] The main enterprise system returns the user's login information to the sub-enterprise system according to the token sent by the sub-enterprise system to complete the user's login in the sub-enterprise system, wherein the login information includes the user's account name and account password.

[0009] According to another aspect of the present invention, the present invention provides an identity authentication device for a group enterprise system, wherein the group enterprise system includes a main enterprise system and multiple sub-enterprise systems, and the device includes:

[0010] A first authentication module, configured to authenticate the identity authentication request initiated by the user by the main enterprise system and return the authentication result to the user, wherein the identity authentication request includes the account name and account password of the user, and the authentication result includes authentication success and authentication failure;

[0011] An authorization code module, used for the main enterprise system to send a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, wherein the authorization code application request includes the account name of the user and the identity information of the sub-enterprise system, the account name of the user is obtained by the sub-enterprise system parsing the business operation request initiated by the user to it, and the one-time authorization code includes the identity information of the main enterprise system;

[0012] A token generation module, configured for the main enterprise system to send a token to the subsystem according to a token application request of the sub-enterprise system, wherein the token application request includes the one-time authorization code;

[0013] The second authentication module is used for the main enterprise system to return the user's login information to the sub-enterprise system according to the token sent by the sub-enterprise system to complete the user's login in the sub-enterprise system, wherein the login information includes the user's account name and account password.

[0014] According to another aspect of the present invention, the present invention provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the method described in any one of the above aspects of the present invention.

[0015] According to another aspect of the present invention, an electronic device is provided, comprising: a processor; a memory for storing instructions executable by the processor; the processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any one of the above aspects of the present invention.

[0016] The identity authentication method and device for a group enterprise system described in the present invention, wherein the method includes the main enterprise system authenticating the identity authentication request initiated by the user and returning the authentication result to the user; the main enterprise system sending a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system; the main enterprise system sending a token to the sub-system according to the token application request of the sub-enterprise system; the main enterprise system returning the user's login information to the sub-enterprise system according to the token sent by the sub-enterprise system to complete the user's login in the sub-enterprise system. In the method and device, the main enterprise system uses the identity information transmitted by the sub-enterprise system to realize the transmission of the user's trusted identity information from the main enterprise system to the sub-enterprise system. The whole process is fast and efficient, realizing one-place login and mutual trust in multiple places, and is invisible to the user. The user does not need to log in multiple times to switch business operations, which greatly improves the user experience. At the same time, it provides a common identity authentication framework for developers, improving the efficiency of developers. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] A more complete understanding of exemplary embodiments of the present invention may be obtained by referring to the following drawings:

[0018] Figure 1 A flowchart of an identity authentication method for a group enterprise system according to a preferred embodiment of the present invention;

[0019] Figure 2 It is a structural schematic diagram of an identity authentication device for a group enterprise system according to a preferred embodiment of the present invention;

[0020] Figure 3 Schematic diagram of the structure of an electronic device according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0021] Now, exemplary embodiments of the present invention are described with reference to the accompanying drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. These embodiments are provided to disclose the present invention in detail and completely and to fully convey the scope of the present invention to those skilled in the art. The terms used in the exemplary embodiments shown in the accompanying drawings are not intended to limit the present invention. In the accompanying drawings, the same units / elements are marked with the same reference numerals.

[0022] Unless otherwise specified, the terms (including technical terms) used herein have the commonly understood meanings to those skilled in the art. In addition, it is understood that the terms defined in commonly used dictionaries should be understood to have the same meanings as those in the context of the relevant fields, and should not be understood as idealized or overly formal meanings.

[0023] Exemplary Methods

[0024] Figure 1 Flow chart of the identity authentication method for a group enterprise system according to a preferred embodiment of the present invention. The group enterprise system described in this preferred embodiment includes a main enterprise system and multiple subsidiary enterprise systems, such as Figure 1 As shown, the identity authentication method for a group enterprise system described in this preferred embodiment starts from step 101.

[0025] In step 101, the main enterprise system authenticates the identity authentication request initiated by the user and returns the authentication result to the user, wherein the identity authentication request includes the account name and account password of the user, and the authentication result includes authentication success and authentication failure.

[0026] In step 102, the main enterprise system sends a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, wherein the authorization code application request includes the account name of the user and the identity information of the sub-enterprise system, the account name of the user is obtained by the sub-enterprise system through parsing the business operation request initiated by the user to it, and the one-time authorization code includes the identity information of the main enterprise system.

[0027] Preferably, the main enterprise system sends a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, including:

[0028] The main enterprise system parses the authorization code application request to obtain the identity information of the sub-enterprise system and the account name of the user, wherein the identity information of the sub-enterprise system is the social credit code / taxpayer identification number of the sub-enterprise;

[0029] The login status of the user is determined according to the user's account name, wherein:

[0030] Determining an authentication result of the user according to the account name of the user;

[0031] When the authentication result is authentication success, determining the login status as login success, otherwise, determining the login status as login failure;

[0032] When the login status is successful, a one-time authorization code is generated according to the identity information of the main enterprise system and sent to the sub-enterprise system. The identity information of the main enterprise system is the social credit code / taxpayer identification number of the main enterprise.

[0033] In step 103, the main enterprise system sends a token to the subsystem according to the token application request of the sub-enterprise system, wherein the token application request includes the one-time authorization code.

[0034] Preferably, the main enterprise system sending a token to the subsystem according to the token application request of the sub-enterprise system comprises:

[0035] The main enterprise system parses the token application request to obtain the one-time authorization code;

[0036] The main enterprise system verifies the validity of the one-time authorization code and confirms the verification result, wherein the verification result includes verification valid and verification invalid;

[0037] When the verification result is valid, a token is generated and sent to the sub-enterprise system.

[0038] In step 104, the main enterprise system returns the user's login information to the sub-enterprise system according to the token sent by the sub-enterprise system to complete the user's login in the sub-enterprise system, wherein the login information includes the user's account name and account password.

[0039] Preferably, the method further comprises:

[0040] After the user completes logging into the sub-enterprise system, business processing is performed according to the business operation request, and a business processing result is generated and returned to the user.

[0041] The identity authentication method for a group enterprise system described in this preferred embodiment uses the identity information of the subsidiary enterprise system without the need for additional parameters, thereby achieving the transfer of trusted identities from a main enterprise to multiple subsidiary enterprises, thereby ensuring data security and protecting user data privacy; and through the transfer of trusted identities, users can log in seamlessly between the main and subsidiary enterprises, thereby improving user efficiency.

[0042] Exemplary Devices

[0043] Figure 2 Schematic diagram of the structure of the identity authentication device for a group enterprise system according to a preferred embodiment of the present invention. The group enterprise system described in this preferred embodiment includes a main enterprise system and multiple sub-enterprise systems, such as Figure 2 As shown, the identity authentication device 200 for a group enterprise system described in this preferred embodiment includes:

[0044] The first authentication module 201 is used for the main enterprise system to authenticate the identity authentication request initiated by the user and return the authentication result to the user, wherein the identity authentication request includes the account name and account password of the user, and the authentication result includes authentication success and authentication failure;

[0045] The authorization code module 202 is used for the main enterprise system to send a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, wherein the authorization code application request includes the account name of the user and the identity information of the sub-enterprise system, the account name of the user is obtained by the sub-enterprise system parsing the business operation request initiated by the user to it, and the one-time authorization code includes the identity information of the main enterprise system;

[0046] A token generation module 203, configured for the main enterprise system to send a token to the subsystem according to a token application request of the sub-enterprise system, wherein the token application request includes the one-time authorization code;

[0047] The second authentication module 204 is used for the main enterprise system to return the user's login information to the sub-enterprise system according to the token sent by the sub-enterprise system to complete the user's login in the sub-enterprise system, wherein the login information includes the user's account name and account password.

[0048] Preferably, the authorization code module 202 enables the main enterprise system to send a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, including:

[0049] The main enterprise system parses the authorization code application request to obtain the identity information of the sub-enterprise system and the account name of the user, wherein the identity information of the sub-enterprise system is the social credit code / taxpayer identification number of the sub-enterprise;

[0050] The login status of the user is determined according to the user's account name, wherein:

[0051] Determining an authentication result of the user according to the account name of the user;

[0052] When the authentication result is authentication success, determining the login status as login success, otherwise, determining the login status as login failure;

[0053] When the login status is successful, a one-time authorization code is generated according to the identity information of the main enterprise system and sent to the sub-enterprise system. The identity information of the main enterprise system is the social credit code / taxpayer identification number of the main enterprise.

[0054] Preferably, the token generation module 203 enables the main enterprise system to send a token to the subsystem according to the token application request of the sub-enterprise system, including:

[0055] The main enterprise system parses the token application request to obtain the one-time authorization code;

[0056] The main enterprise system verifies the validity of the one-time authorization code and confirms the verification result, wherein the verification result includes verification valid and verification invalid;

[0057] When the verification result is valid, a token is generated and sent to the sub-enterprise system.

[0058] Preferably, the device further comprises:

[0059] An authorization application module, used for the sub-enterprise system to send an authorization code application request to the main enterprise system to obtain the login information of the user, wherein the authorization code application request includes the account name of the user and the identity information of the sub-enterprise system, the account name of the user is obtained by the sub-enterprise system parsing the business operation request initiated by the user to it, and the login information includes the account name and account password of the user;

[0060] A token application module, used for the sub-enterprise system to send a token application request to the main enterprise system;

[0061] A token sending module is used for the sub-enterprise system to send a token to the main enterprise system to obtain the login information of the user to complete the login of the user in the sub-enterprise system, wherein the login information includes the account name and account password of the user.

[0062] The identity authentication device for a group enterprise system described in this preferred embodiment has the same steps as the identity authentication method for a group enterprise system in performing user identity authentication when a user service is switched, and the technical effects achieved are also the same, which will not be repeated here.

[0063] Exemplary Electronic Devices

[0064] Figure 3 The electronic device according to the preferred embodiment of the present invention is a schematic diagram of the structure of the electronic device. The electronic device can be any one or both of the first device and the second device, or a stand-alone device independent of them, and the stand-alone device can communicate with the first device and the second device to receive the collected input signal from them. Figure 3 FIG. 1 is a block diagram of an electronic device according to an embodiment of the present disclosure. Figure 3 As shown, the electronic device includes one or more processors 301 and a memory 302 .

[0065] The processor 301 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0066] The memory 302 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 301 may run the program instructions to implement the energy consumption anomaly diagnosis method based on the enterprise energy consumption space of each disclosed embodiment described above and / or other desired functions. In one example, the electronic device may also include: an input device 303 and an output device 304, which are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0067] In addition, the input device 303 may also include, for example, a keyboard, a mouse, and the like.

[0068] The output device 304 can output various information to the outside, and can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto.

[0069] Of course, to simplify, Figure 3 Only some of the components related to the present disclosure in the electronic device are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device may further include any other appropriate components.

[0070] Exemplary computer program products and computer-readable storage media

[0071] In addition to the above-mentioned methods and devices, an embodiment of the present disclosure may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the identity authentication method for a group enterprise system according to various embodiments of the present disclosure described in the above "Exemplary Method" section of this specification.

[0072] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0073] In addition, an embodiment of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, causes the processor to execute the steps of an identity authentication method for a group enterprise system according to various embodiments of the present disclosure described in the above “Exemplary Method” section of this specification.

[0074] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0075] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0076] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0077] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0078] The apparatus and method of the present disclosure may be implemented in many ways. For example, the apparatus and method of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0079] It should also be noted that in the apparatus, equipment and method of the present disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present disclosure. The above description of the disclosed aspects is provided to enable any technician in the field to make or use the present disclosure. Various modifications to these aspects are very obvious to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown here, but to the widest scope consistent with the principles and novel features disclosed herein.

[0080] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. An identity authentication method for a group enterprise system, wherein the group enterprise system includes a main enterprise system and multiple subsidiary enterprise systems, characterized in that: The method comprises: The main enterprise system authenticates the identity authentication request initiated by the user and returns the authentication result to the user, wherein the identity authentication request includes the account name and account password of the user, and the authentication result includes authentication success and authentication failure; The main enterprise system sends a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, wherein the authorization code application request includes the account name of the user and the identity information of the sub-enterprise system, the account name of the user is obtained by the sub-enterprise system parsing the business operation request initiated by the user to it, and the one-time authorization code includes the identity information of the main enterprise system; The main enterprise system sends a token to the subsystem according to the token application request of the sub-enterprise system, wherein the token application request includes the one-time authorization code; The main enterprise system returns the user's login information to the sub-enterprise system according to the token sent by the sub-enterprise system to complete the user's login in the sub-enterprise system, wherein the login information includes the user's account name and account password.

2. The method according to claim 1, characterized in that The main enterprise system sends a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, including: The main enterprise system parses the authorization code application request to obtain the identity information of the sub-enterprise system and the account name of the user, wherein the identity information of the sub-enterprise system is the social credit code / taxpayer identification number of the sub-enterprise; The login status of the user is determined according to the user's account name, wherein: Determining an authentication result of the user according to the account name of the user; When the authentication result is authentication success, determining the login status as login success, otherwise, determining the login status as login failure; When the login status is successful, a one-time authorization code is generated according to the identity information of the main enterprise system and sent to the sub-enterprise system. The identity information of the main enterprise system is the social credit code / taxpayer identification number of the main enterprise.

3. The method according to claim 1, characterized in that: The main enterprise system sending a token to the subsystem according to the token application request of the sub-enterprise system comprises: The main enterprise system parses the token application request to obtain the one-time authorization code; The main enterprise system verifies the validity of the one-time authorization code and confirms the verification result, wherein the verification result includes verification valid and verification invalid; When the verification result is valid, a token is generated and sent to the sub-enterprise system.

4. The method according to claim 1, characterized in that The method further comprises: After the user completes logging into the sub-enterprise system, business processing is performed according to the business operation request, and a business processing result is generated and returned to the user.

5. An identity authentication device for a group enterprise system, the group enterprise system comprising a main enterprise system and a plurality of sub-enterprise systems, characterized in that: The device comprises: A first authentication module, configured to authenticate the identity authentication request initiated by the user by the main enterprise system and return the authentication result to the user, wherein the identity authentication request includes the account name and account password of the user, and the authentication result includes authentication success and authentication failure; An authorization code module, used for the main enterprise system to send a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, wherein the authorization code application request includes the account name of the user and the identity information of the sub-enterprise system, the account name of the user is obtained by the sub-enterprise system parsing the business operation request initiated by the user to it, and the one-time authorization code includes the identity information of the main enterprise system; A token generation module, configured for the main enterprise system to send a token to the subsystem according to a token application request of the sub-enterprise system, wherein the token application request includes the one-time authorization code; The second authentication module is used for the main enterprise system to return the user's login information to the sub-enterprise system according to the token sent by the sub-enterprise system to complete the user's login in the sub-enterprise system, wherein the login information includes the user's account name and account password.

6. The device according to claim 5, characterized in that The authorization code module enables the main enterprise system to send a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system, including: The main enterprise system parses the authorization code application request to obtain the identity information of the sub-enterprise system and the account name of the user, wherein the identity information of the sub-enterprise system is the social credit code / taxpayer identification number of the sub-enterprise; The login status of the user is determined according to the user's account name, wherein: Determining an authentication result of the user according to the account name of the user; When the authentication result is authentication success, determining the login status as login success, otherwise, determining the login status as login failure; When the login status is successful, a one-time authorization code is generated according to the identity information of the main enterprise system and sent to the sub-enterprise system. The identity information of the main enterprise system is the social credit code / taxpayer identification number of the main enterprise.

7. The device according to claim 5, characterized in that The token generation module enables the main enterprise system to send a token to the subsystem according to the token application request of the sub-enterprise system, including: The main enterprise system parses the token application request to obtain the one-time authorization code; The main enterprise system verifies the validity of the one-time authorization code and confirms the verification result, wherein the verification result includes verification valid and verification invalid; When the verification result is valid, a token is generated and sent to the sub-enterprise system.

8. The device according to claim 5, characterized in that The device also includes: An authorization application module, used for the sub-enterprise system to send an authorization code application request to the main enterprise system to obtain the login information of the user, wherein the authorization code application request includes the account name of the user and the identity information of the sub-enterprise system, the account name of the user is obtained by the sub-enterprise system parsing the business operation request initiated by the user to it, and the login information includes the account name and account password of the user; A token application module, used for the sub-enterprise system to send a token application request to the main enterprise system; A token sending module is used for the sub-enterprise system to send a token to the main enterprise system to obtain the login information of the user to complete the login of the user in the sub-enterprise system, wherein the login information includes the account name and account password of the user.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the method according to any one of claims 1 to 4.

10. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1 to 4 above.

Images