Login state keeping method and device, electronic equipment, chip, storage medium and computer program product

Abstract

The embodiment of the invention provides a login state keeping method, a login state keeping device, electronic equipment, a chip, a storage medium and a computer program product. The method comprises the following steps: receiving a first request sent by an application system; the first request is used for requesting to update first effective time of an authorization certificate; the authorization certificate is an authorization certificate for a user to access the application system; and if the locally stored authorization certificate is valid, resetting the first valid time of the authorization certificate, and prolonging the valid time of the login certificate of the user.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of Internet technology, and specifically to a method for maintaining a login status, a device for maintaining a login status, an electronic device, a chip, a storage medium, and a computer program product. Background Art

[0002] The system services used by Internet users are often provided by multiple application systems (Service Provider, SP), and it is often necessary to implement single sign-on between various systems. The common single-point system design process is that the authentication center (Identity Provider, IDP) issues authorization credentials for each application system based on the user's login credentials. After the authorization credential is issued, its life cycle is no longer directly related to the login credential. The authorization credentials of each application system are also independent of each other. As a result, if the user jumps from the first application system to the target system, if the user operates in the target system for a long time, when the user needs to return to the first application system to operate, the login credentials saved by the authentication center may become invalid, and the user needs to log in again, resulting in the interruption of the original access process and a reduction in user experience. Summary of the invention

[0003] Embodiments of the present application provide a method for maintaining a login status, a device for maintaining a login status, an electronic device, a chip, a storage medium, and a computer program product.

[0004] The login status maintaining method provided in the embodiment of the present application is applied to an authentication center, including:

[0005] receiving a first request sent by an application system; the first request is used to request to update a first validity period of an authorization credential; the authorization credential is an authorization credential for a user to access the application system;

[0006] If the authorization credential stored locally is valid, the first validity period of the authorization credential is reset, and the validity period of the user's login credential is extended.

[0007] The login status maintaining method provided in the embodiment of the present application is applied to an application system, including:

[0008] receiving a first access request from a user;

[0009] If the first access request carries an authorization credential, verifying the authorization credential;

[0010] If it is verified that the authorization certificate is invalid, a first request is sent to the authentication center; the first request is used to request to update the first validity period of the authorization certificate; the authorization certificate is the authorization certificate for the user to access the application system; the first validity period is the validity period of the authorization certificate in the authentication center.

[0011] The login status maintaining device provided in the embodiment of the present application is applied to an authentication center, including:

[0012] A first receiving unit: used to receive a first request sent by an application system; the first request is used to request to update a first validity period of an authorization credential; the authorization credential is an authorization credential for a user to access the application system;

[0013] The first processing unit is used for resetting the first validity period of the authorization credential and extending the validity period of the user's login credential if the authorization credential stored locally is valid.

[0014] The login status maintaining device provided in the embodiment of the present application is applied to an application system, including:

[0015] A second receiving unit: configured to receive a first access request from a user;

[0016] The second processing unit is used to verify the authorization credential if the first access request carries the authorization credential; if the authorization credential is verified to be invalid, send a first request to the authentication center; the first request is used to request to update the first validity period of the authorization credential; the authorization credential is the authorization credential for the user to access the application system; the first validity period is the validity period of the authorization credential in the authentication center.

[0017] The electronic device provided in the embodiment of the present application includes: a processor and a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute any login status maintenance method provided in the embodiment of the present application.

[0018] The chip provided in the embodiment of the present application includes: a processor, which is used to call and run a computer program from a memory, so that a device equipped with the chip executes any login status maintaining method provided in the embodiment of the present application.

[0019] The storage medium provided in the embodiments of the present application is used to store a computer program, and the computer program enables a computer to execute any login status maintaining method provided in the embodiments of the present application.

[0020] The computer program product provided in the embodiments of the present application includes a computer program, and when the computer program is executed by a processor, it implements any login status maintaining method provided in the embodiments of the present application.

[0021] Through the login status maintenance method provided in the embodiment of the present application, the validity period of the authorization credential of the application system is associated with the validity period of the login credential. When the validity period of the authorization credential is updated, the validity period of the login credential is also extended accordingly, so that the user's login status is maintained, avoiding interruptions in the access process and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0023] Figure 1 Schematic diagram of the implementation process of the method for maintaining the login status provided in the embodiment of the present application Figure 1 ;

[0024] Figure 2 Schematic diagram of the implementation process of the method for maintaining the login status provided in the embodiment of the present application Figure 2 ;

[0025] Figure 3 Schematic diagram of the implementation process of the method for maintaining the login status provided in the embodiment of the present application Figure 3 ;

[0026] Figure 4 Schematic diagram of the implementation process of the method for maintaining the login status provided in the embodiment of the present application Figure 4 ;

[0027] Figure 5 A schematic diagram of the interactive process of a user accessing application system resources provided in an embodiment of the present application;

[0028] Figure 6 A schematic diagram of the structure of a login status maintaining device 600 provided in an embodiment of the present application;

[0029] Figure 7 A schematic diagram of the structure of a login status maintaining device 700 provided in an embodiment of the present application;

[0030] Figure 8 A schematic structural diagram of an electronic device provided in an embodiment of the present application;

[0031] Fig. 9 A schematic structural diagram of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0033] It should be noted that in the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the embodiments of the present application, the character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0034] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between two items, or an association relationship between the two items, or a relationship between indication and being indicated, configuration and being configured, and the like.

[0035] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0036] At present, the system services used by Internet users are often provided by multiple application systems, and it is often necessary to implement a single point between various systems. The current common single point systems, such as open authorization OAuth, Open ID Connection (OpenIDConnect, OIDC), Security Assertion Markup Language (Security Assertion Markup Language, SAML), Central Authentication Service (Central Authentication Service, CAS), etc., define the single sign-on process design as follows: after the application system logs in to the IDP, the IDP will issue a login credential to the user. When the user subsequently accesses each application system, the IDP will issue an authorization credential to each application system based on the login credential within the validity period of the login credential. After the authorization credential is issued, its life cycle is no longer directly related to the login credential. At the same time, because each application system has a unique authorization credential and there is no direct association between them, if the user jumps from the current system to the target system, the user may operate in the target system for a long time, which may cause the authorization token of the above current system to become invalid, but the user is not aware of this. When the user needs to return to the above current system to operate, the login credential will become invalid and the user will need to log in again, resulting in the interruption of the original access process and a decline in user experience. In addition, users often do not understand that they have crossed two different server systems, which will objectively further affect the user experience. In the single sign-on process solution in the related technology, there are risks such as inaccurate judgment of user login status and information leakage.

[0037] Figure 1 Schematic diagram of the implementation process of the method for maintaining the login status provided in the embodiment of the present application Figure 1 ,like Figure 1 As shown, the embodiment of the present application provides a method for maintaining a login status, which is applied to an authentication center, and the method includes the following steps:

[0038] Step 101: Receive a first request sent by an application system; the first request is used to request to update a first validity period of an authorization credential; the authorization credential is an authorization credential for a user to access the application system.

[0039] In an embodiment of the present application, when a user initiates a login, the authentication center verifies that the account information is correct, issues a corresponding login credential to the user's corresponding account, sets a validity period for the login credential, and saves the login credential.

[0040] In an embodiment of the present application, the login credentials can be saved in a Redis cache, with the login credential ID as the key value and the identity information associated with the login credential as the value value. The expiration time of the key-value pair is set to the validity time of the login credential, thereby establishing an association between the user account identity and the login credential.

[0041] In an embodiment of the present application, the login credentials can be returned to the browser according to the set request header, and the browser saves it in a Cookie. The validity period of the login credentials saved by the browser is infinite, that is, the browser does not actively invalidate the login credentials. The validity of all login credentials is determined by the authentication center.

[0042] In an embodiment of the present application, when a user accesses the resources of an application system for the first time through a browser, an authorization credential has not yet been obtained, so the access request reaching the application system does not carry an authorization credential. At this time, the application system can redirect the access request to an authentication center. When the authentication center determines that the application system is legal, it will issue an authorization credential to the application system, set a first validity period, save the authorization credential locally, and send the authorization credential and the first validity period to the browser and application system through redirection. The authentication center manages the association between the login credential and the authorization credential, as well as the validity period of the login credential and the first validity period of the authorization credential.

[0043] In the embodiment of the present application, the first effective time may be set to a preset value, or may be adjusted according to the frequency of user access to the application system, for example: Among them, F min is the minimum frequency of users accessing the application system, T i The first valid time of the authorization certificate for the user to access the application system SPi. For example, the minimum frequency of the user accessing SP1 is F1, then T1 is set according to F1 so that F1 and T1 satisfy The lowest frequency of users accessing SP2 is F2, so T2 is set according to F2 so that If the minimum frequency F3 of users accessing SP3 is 1 time / second, T3 can be set to 2 seconds, so

[0044] Based on this, in an optional implementation manner of the present application, the first effective time is related to the frequency with which the user accesses the application system.

[0045] In the embodiment of the present application, the setting of the first effective time is associated with the frequency of user access to the application system to avoid the first effective time being set too long or too short, which affects access security and user access experience.

[0046] Step 102: If the authorization credential stored locally is valid, the first validity period of the authorization credential is reset, and the validity period of the user's login credential is extended.

[0047] In an embodiment of the present application, if the time when the authentication center locally stores the authorization credential is within the first valid time, the authorization credential is confirmed to be valid and the first valid time of the authorization credential is reset. Exemplarily, the first valid time is reset based on the frequency with which the current user accesses the application system.

[0048] In an embodiment of the present application, if the time for which the authentication center locally stores the authorization credential exceeds the first validity period, the authorization credential is confirmed to be invalid. At this time, it is determined whether the user's login credential is valid. If the user's login credential is valid, the authorization credential is reissued to the application system based on the user's login credential, and the first validity period is set for the reissued authorization credential, and the validity period of the user's login credential is extended. The authorization credential and the first validity period are sent to the browser and application system through redirection.

[0049] Based on this, in an optional implementation of the present application, if the locally stored authorization credential is invalid, it is determined whether the user's login credential is valid;

[0050] If the login credential is valid, the authorization credential is reissued, a first validity period is set for the authorization credential, and the validity period of the user's login credential is extended.

[0051] In an embodiment of the present application, when the first validity period of the authorization credential is reset, the validity period of the user's login credential is correspondingly extended. For example, the first duration can be extended within the current validity period of the login credential, and the first duration is the same as the reset first validity period.

[0052] Based on this, in an optional implementation manner of the present application, extending the validity period of the user's login credentials includes:

[0053] Based on the current validity period of the login credential, the first duration is extended; the first duration is the same as the duration of the reset first validity period.

[0054] In an embodiment of the present application, there are usually multiple application systems. For example, the validity period of the current user's login credentials is T. During the authentication, the first validity period T1 of the authorization credential of SP1 and the second validity period T2 of the authorization credential of SP2 are reset successively. Then, the validity period of the user's login credentials is extended to T+T1+T2. If the authentication center sets T1 and T2 at the same time, the longer time between T1 and T2 can be selected as the first time period.

[0055] Figure 2Schematic diagram of the implementation process of the method for maintaining the login status provided in the embodiment of the present application Figure 2 ,like Figure 2 As shown, the embodiment of the present application provides a method for maintaining a login status, which is applied to an application system, and the method includes the following steps:

[0056] Step 201: Receive a first access request from a user.

[0057] In the embodiment of the present application, the first access request is a request from a user to access application system resources through a browser.

[0058] Step 202: If the first access request carries an authorization credential, the authorization credential is verified.

[0059] In the embodiment of the present application, the authorization credential is the credential for the user to access application system resources.

[0060] In an embodiment of the present application, if a user accesses an application system for the first time, the first access request does not carry an authorization credential, and the application system redirects the user's access request to an authentication center so that the authentication center issues an authorization credential. After the authentication center issues the authorization credential, the access request is redirected to the application system again. At this time, the user's access request carries the authorization credential and a first validity period; the first validity period is the validity period of the authorization credential in the authentication center.

[0061] After receiving the authorization certificate, the application system saves it locally in the application system and sets a second validity period for the authorization certificate, which is the validity period of the authorization certificate in the application system.

[0062] Based on this, in an optional implementation manner of the present application, if the first access request does not carry an authorization credential, the first access request is redirected to an authentication center;

[0063] receiving a second access request from the user; the second access request carries the authorization credential and the first validity period;

[0064] The authorization credential is saved, and a second validity period is set for the authorization credential.

[0065] In an embodiment of the present application, the second validity period may be shorter than the first validity period to avoid the situation where the authorization certificate has expired in the authentication center but is valid in the application system, thereby ensuring access security.

[0066] Exemplary, second effective time

[0067] Based on this, in an optional implementation manner of the present application, the second effective time is related to the first effective time and the frequency of the user accessing the application system;

[0068] The duration of the second effective time is shorter than the duration of the first effective time.

[0069] Step 203: If it is verified that the authorization credential is invalid, a first request is sent to the authentication center; the first request is used to request to update the first validity period of the authorization credential; the authorization credential is the authorization credential for the user to access the application system; the first validity period is the validity period of the authorization credential in the authentication center.

[0070] In an embodiment of the present application, the validity of the authorization credentials carried in the user's access request is verified. If the authorization credentials locally stored in the application system are within the second validity period, the verification authorization credentials are valid. If the authorization credentials locally stored in the application system exceed the second validity period, the verification authorization credentials are invalid.

[0071] Based on this, in an optional implementation manner of the present application, the verification that the authorization credential is invalid includes:

[0072] If the time for storing the authorization certificate exceeds the second validity period, verifying that the authorization certificate is invalid.

[0073] refer to Figure 3 , Figure 3 Schematic diagram of the implementation process of the method for maintaining the login status provided in the embodiment of the present application Figure 3 ,like Figure 3 As shown, the method for maintaining the login status includes the following process:

[0074] The user initiates login through the browser, and the browser initiates a login request to the IDP, carrying the user's account information. When the IDP verifies that the account information is correct, it will issue the corresponding login credentials to the account, set the validity period of the login credentials, save them in the Redis cache, and use the login credential ID as the key value, the login credential-associated identity information as the value, and set the expiration time of the key-value pair to the validity period of the login credential; the IDP returns the login credential to the browser according to the set request header, and the browser saves it in the cookie. The validity period of the browser saving the login credential is infinite, that is, the browser does not actively Invalid login credentials. The validity of all login credentials is determined by IDP. When a user accesses SP1 resources and the request does not carry an authorization credential, SP1 will redirect the request to the IDP authorization process. When IDP determines that SP1 is legitimate, it will issue an authorization credential to SP1 and set the first validity period T1. It will redirect the request back to SP1 and carry the authorization credential and T1. When SP1 receives the resource request redirected by IDP, it obtains the authorization credential and T1. After verifying that the authorization information is legitimate, SP1 saves the authorization credential in the Redis cache, uses the authorization credential ID as the key, and sets the expiration time of the key to When the user repeatedly accesses the resources of SP1, if the authorization credential saved by SP1 has not expired, the user is allowed to access directly; if the authorization credential of SP1 expires, SP1 initiates an authorization credential refresh request to IDP by redirecting the access request to IDP; after IDP receives the refresh request from SP1, IDP determines that the authorization credential has not expired on the IDP side, and refreshes the first validity period of the authorization credential, returns the original authorization credential and the refreshed T1 to SP1 by redirecting, and adds T to the validity period of the login credential. i If the authorization credential expires on the IDP side, determine whether the login credential has expired. If it has not expired, reissue the authorization credential, set the first validity period of the new authorization credential, and update the validity period of the login credential plus T. i Duration; if the login credentials are invalid, it means that the system has not visited any SP within the validity period of the login credentials, then according to the normal single point logic, it is determined that the user is not logged in; redirect to the login page for the user to log in.

[0075] refer to Figure 4 , Figure 4 Schematic diagram of the implementation process of the method for maintaining the login status provided in the embodiment of the present application Figure 3 ,like Figure 4 As shown, the method for maintaining the login status includes the following process:

[0076] The user initiates login through the browser, and the browser initiates a login request to the IDP, carrying the user's account information. When the IDP verifies that the account information is correct, it will issue the corresponding login credential to the account, set the validity period of the login credential, save it in the Redis cache, and use the login credential ID as the key value, the login credential-associated identity information as the value, and set the expiration time of the key-value pair to the validity period of the login credential; the IDP returns the login credential to the browser according to the set request header, and the browser saves it in the cookie. The validity period of the login credential saved by the browser is infinite, that is, the browser does not actively expire the login credential, and the judgment of whether all login credentials are valid is determined by the IDP; the process of user access to SP1 resources can refer to Figure 3 After accessing SP1, the user does not continue to access it for a period of time and starts to access SP2. The process of accessing SP2 is the same as the relevant mechanism of SP1. You can refer to Figure 3The process of user accessing SP1 can be understood for the sake of understanding, which will not be repeated here; when the user accesses SP1 again after the authorization certificate of SP1 expires (that is, SP1 has not been visited within T1 time), because the authorization certificates saved by SP1 and IDP are both invalid, SP1 will redirect to the authorization address of IDP. After IDP determines that the authorization certificate carried by SP1 is invalid, it will check whether the login certificate corresponding to the authorization certificate is invalid. Since the user will extend the validity period of the login certificate when accessing SP2, the login certificate must be valid at this time. IDP will re-issue the authorization certificate to SP1 based on the login certificate, and the user uses the latest authorization certificate to access the relevant resources of SP1; the user does not need to log in again. Through the above mechanism, the user can be kept logged in when the user has operations.

[0077] In the embodiment of the present application, the interactive process of users accessing application system resources involves three parties, namely the browser, the application system, and the authentication center. Figure 5 , Figure 5 The interactive flow diagram of the user accessing the application system resources provided in the embodiment of the present application is as follows: Figure 5 As shown, the user logs in through the browser, and the browser performs login authentication to the authentication center. After authentication, the authentication center saves the login credentials and the validity period of the login credentials locally, and returns the login credentials to the browser. The user accesses the SP1 resource through the browser, and the browser sends an access request to SP1, carrying the user's identity information. SP1 requests an authorization credential from the authentication center. After the authentication center issues the authorization credential to SP1, it sets the first validity period of the authorization credential, extends the validity period of the login credential to the first validity period, and returns the authorization credential to SP1; the user accesses the SP2 resource through the browser, and the browser sends an access request to SP2, carrying the user's identity information. SP2 requests an authorization credential from the authentication center. After the authentication center issues the authorization credential to SP2, it sets the first validity period of the authorization credential, extends the validity period of the login credential to the first validity period, and returns the authorization credential to SP2.

[0078] In the embodiment of the present application, a credential management and state retention module (Token State Management Module, TSMM) can be added to the IDP. The credential management is mainly used to manage the relationship between the login credential and the account, as well as the relationship between the login credential and the authorization credential; the state retention module is mainly used to receive the SP credential refresh request, and synchronously update the login credential validity time and the first validity time of the authorization credential. All data is stored in the Redis cache, and the validity period of the login credential and the authorization credential is controlled by the cache expiration automatic expiration function. A new authorization credential management module (Token Management Module, TMM) is added to the SP, which mainly records the authorization credential and the second validity time of the authorization credential. The data is stored in the Redis cache, and the authorization credential id is used as the key. The validity period of the authorization credential is controlled by the cache expiration automatic expiration function. The purpose of TMM saving the authorization credential and the second validity time is to minimize the interaction frequency between the SP and the IDP under the premise of maintaining the login state, and reduce the negative impact of state maintenance on business throughput.

[0079] In the embodiment of the present application, the login status of the multi-application system is maintained by the user accessing the resources of the SP, that is, during the user's access to the SP, as long as the accessed SP verification authorization credential is invalid, the SP will send a request to the IDP to trigger the update of the validity period of the associated login credential, thereby ensuring that the user's login credential is valid when accessing the SP. After the SP receives the user's request for the first time, the SP redirects to the IDP, and the TSMM module of the IDP issues an authorization credential to each accessed SP (if the user is already logged in, otherwise log in again), and sets the validity period T i (i represents the SP's ID). At the same time, the IDP redirects the relevant information to the SP through the browser. After receiving the response request, the SP's TMM module will set the second expiration time of the authorization credential to When the user subsequently sends a resource access request, the SP's TMM module will verify whether the locally saved authorization credential is valid. If it is invalid, it will send a request to the IDP. The TSMM module will verify whether the authorization credential is valid. If it is valid, it will re-update the authorization credential. The first validity period is T i , the validity period of the login credentials plus T i If the IDP's authorization certificate is also invalid, the IDP determines whether to reissue a new authorization certificate based on the login certificate. If the login certificate is valid, the SP will be reissued an authorization certificate, and the first validity period of the authorization certificate is set to T. i , synchronously update the login credential validity period plus T i Duration; if the login credentials are invalid, it means that the user has not used any of the systems within the login validity period, the login status is invalid, and the user logs in again.

[0080] The login status maintenance method provided in the embodiment of the present application uses user access to system resources as a trigger condition for maintaining the login status, which is more accurate than using screen brightness as a trigger condition; on the basis of the general authorization process and interface specifications, the relationship mapping between resource access and login status between SP and IDP is achieved by slightly modifying the authorization credentials and valid time data management method of IDP and SP, which is non-business invasive, user-unaware, and more lightweight and simple; by adding a TSMM module to the IDP and a TMM module to the SP, information interaction and management between user resource access and login status maintenance are achieved, without the need for complex information synchronization between systems or jump status maintenance between systems, and the implementation plan and process are simple and the cost is lower.

[0081] The present application embodiment also provides a login status maintaining device 600, referring to Figure 6 , Figure 6 The structure diagram of the login status maintaining device 600 provided in the embodiment of the present application is as follows. The login status maintaining device 600 in the embodiment includes:

[0082] A first receiving unit: used to receive a first request sent by an application system; the first request is used to request to update a first validity period of an authorization credential; the authorization credential is an authorization credential for a user to access the application system;

[0083] The first processing unit is used for resetting the first validity period of the authorization credential and extending the validity period of the user's login credential if the authorization credential stored locally is valid.

[0084] In an embodiment of the present application, the first processing unit is used to determine whether the user's login credentials are valid if the locally stored authorization credentials are invalid; if the login credentials are valid, reissue the authorization credentials, set a first validity period for the authorization credentials, and extend the validity period of the user's login credentials.

[0085] In the embodiment of the present application, the first effective time is related to the frequency with which the user accesses the application system.

[0086] In an embodiment of the present application, the first processing unit is used to extend a first duration based on a current validity period of the login credential; the first duration is the same as the duration of the reset first validity period.

[0087] Those skilled in the art should understand that Figure 6 The functions implemented by each unit in the login status maintaining device 600 shown can be understood by referring to the related description of the aforementioned method. Figure 6The functions of the various units in the login status maintaining device 600 shown can be implemented by a program running on a processor, or can be implemented by a specific logic circuit.

[0088] The present application embodiment also provides a login status maintaining device 700, referring to Figure 7 , Figure 7 The structure diagram of the login status maintaining device 700 provided in the embodiment of the present application is as follows. The login status maintaining device 700 in the embodiment includes:

[0089] The second receiving unit is used to receive the first access request of the user.

[0090] The second processing unit is used to verify the authorization credential if the first access request carries the authorization credential; if the authorization credential is verified to be invalid, send a first request to the authentication center; the first request is used to request to update the first validity period of the authorization credential; the authorization credential is the authorization credential for the user to access the application system; the first validity period is the validity period of the authorization credential in the authentication center.

[0091] In an embodiment of the present application, the second processing unit is used to redirect the first access request to the authentication center if the first access request does not carry the authorization credential; the second receiving unit is used to receive the user's second access request; the second access request carries the authorization credential and the first validity period; the second processing unit is used to save the authorization credential and set a second validity period for the authorization credential.

[0092] In the embodiment of the present application, the second processing unit is used to verify that the authorization credential is invalid if the time for storing the authorization credential exceeds the second validity period.

[0093] In the embodiment of the present application, the second effective time is related to the first effective time and the frequency with which the user accesses the application system; and the duration of the second effective time is shorter than the duration of the first effective time.

[0094] Those skilled in the art should understand that Figure 7 The functions implemented by each unit in the login status maintaining device 700 shown can be understood by referring to the related description of the aforementioned method. Figure 7 The functions of the various units in the login status maintaining device 700 shown can be implemented by a program running on a processor, or can be implemented by a specific logic circuit.

[0095] Figure 8 It is a schematic structural diagram of an electronic device 800 provided in an embodiment of the present application. Figure 8The electronic device 800 shown includes a processor 810, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0096] Alternatively, if Figure 8 As shown, the electronic device 800 may further include a memory 820. The processor 810 may call and run a computer program from the memory 820 to implement the method in the embodiment of the present application.

[0097] The memory 820 may be a separate device independent of the processor 810 , or may be integrated into the processor 810 .

[0098] Alternatively, if Figure 8 As shown, the electronic device 800 may further include a transceiver 830, and the processor 810 may control the transceiver 830 to communicate with other devices, specifically, may send information or data to other devices, or receive information or data sent by other devices.

[0099] The transceiver 830 may include a transmitter and a receiver. The transceiver 830 may further include an antenna, and the number of the antennas may be one or more.

[0100] The electronic device 800 may specifically be the login status maintaining device 600 / login status maintaining device 700 of the embodiment of the present application, and the electronic device 800 may implement the corresponding processes implemented by the login status maintaining device 600 / login status maintaining device 700 in each method of the embodiment of the present application, which will not be described in detail here for the sake of brevity.

[0101] Exemplarily, an embodiment of the present application further provides a computer program product, including a computer program, and the computer program can be executed by the processor 810 of the communication device 800 to complete the steps of any of the aforementioned methods.

[0102] Fig. 9 It is a schematic structural diagram of the chip of an embodiment of the present application. Fig. 9 The chip 900 shown includes a processor 910, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0103] Alternatively, if Fig. 9 As shown, the chip 900 may further include a memory 920. The processor 910 may call and run a computer program from the memory 920 to implement the method in the embodiment of the present application.

[0104] The memory 920 may be a separate device independent of the processor 910 , or may be integrated into the processor 910 .

[0105] Optionally, the chip 900 may further include an input interface 930. The processor 910 may control the input interface 930 to communicate with other devices or chips, and specifically, may obtain information or data sent by other devices or chips.

[0106] Optionally, the chip 900 may further include an output interface 940. The processor 910 may control the output interface 940 to communicate with other devices or chips, and specifically, may output information or data to other devices or chips.

[0107] The chip can be applied to the electronic device 800 in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the electronic device 800 in each method of the embodiment of the present application, which will not be described here for the sake of brevity.

[0108] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0109] It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software units in the decoding processor are combined and executed. The software unit can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, and other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0110] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0111] It should be understood that the above-mentioned memory is exemplary but not restrictive. For example, the memory in the embodiments of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM), etc. That is to say, the memory in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

[0112] The present application embodiment further provides a storage medium for storing a computer program. The storage medium can be applied to the electronic device 800 in the present application embodiment, and the computer program enables the computer to execute the corresponding processes implemented by the electronic device 800 in each method of the present application embodiment, which will not be described in detail for the sake of brevity.

[0113] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0114] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0115] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0116] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0117] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0118] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or an electronic device 800, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0119] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for maintaining a logged-in status, characterized in that: Applicable to certification centers, including: receiving a first request sent by an application system; the first request is used to request to update a first validity period of an authorization credential; the authorization credential is an authorization credential for a user to access the application system; If the authorization credential stored locally is valid, the first validity period of the authorization credential is reset, and the validity period of the user's login credential is extended.

2. The method according to claim 1, characterized in that: Also includes: If the locally stored authorization credential is invalid, determining whether the user's login credential is valid; If the login credential is valid, the authorization credential is reissued, a first validity period is set for the authorization credential, and the validity period of the user's login credential is extended.

3. The method according to claim 1, characterized in that: The first effective time is related to the frequency with which the user accesses the application system.

4. The method according to any one of claims 1 to 3, characterized in that The extending the validity period of the user's login credentials includes: Based on the current validity period of the login credential, the first duration is extended; the first duration is the same as the duration of the reset first validity period.

5. A method for maintaining a logged-in status, characterized in that: Applied to application systems, including: receiving a first access request from a user; If the first access request carries an authorization credential, verifying the authorization credential; If it is verified that the authorization certificate is invalid, a first request is sent to the authentication center; the first request is used to request to update the first validity period of the authorization certificate; the authorization certificate is the authorization certificate for the user to access the application system; the first validity period is the validity period of the authorization certificate in the authentication center.

6. The method according to claim 5, characterized in that Also includes: If the first access request does not carry the authorization credential, redirecting the first access request to the authentication center; receiving a second access request from the user; The second access request carries the authorization credential and the first validity period; Saving the authorization certificate and setting a second validity period for the authorization certificate; The verifying that the authorization credential is invalid comprises: If the time for storing the authorization certificate exceeds the second validity period, verifying that the authorization certificate is invalid.

7. The method according to claim 6, characterized in that The second effective time is related to the first effective time and the frequency of the user accessing the application system; The duration of the second effective time is shorter than the duration of the first effective time.

8. A login status maintaining device, characterized in that: Applicable to certification centers, including: A first receiving unit: used to receive a first request sent by an application system; the first request is used to request to update a first validity period of an authorization credential; the authorization credential is an authorization credential for a user to access the application system; The first processing unit is used for resetting the first validity period of the authorization credential and extending the validity period of the user's login credential if the authorization credential stored locally is valid.

9. A login status maintaining device, characterized in that: Applied to application systems, including: A second receiving unit: configured to receive a first access request from a user; The second processing unit is used to verify the authorization credential if the first access request carries the authorization credential; if the authorization credential is verified to be invalid, send a first request to the authentication center; the first request is used to request to update the first validity period of the authorization credential; the authorization credential is the authorization credential for the user to access the application system; the first validity period is the validity period of the authorization credential in the authentication center.

10. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to execute the login status maintaining method as described in any one of claims 1 to 4, or 5 to 7.

11. A chip, characterized in that: include: A processor, used to call and run a computer program from a memory, so that a device equipped with the chip executes the login status maintaining method described in any one of claims 1 to 4, or 5 to 7.

12. A storage medium, characterized in that: Used to store a computer program, wherein the computer program enables a computer to execute the login status maintaining method according to any one of claims 1 to 4, or 5 to 7.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the login status maintaining method according to any one of claims 1 to 4 or 5 to 7.

Images