Joint login method and login device based on national secret algorithm

Abstract

The application provides a joint login method and login device based on a national secret algorithm, which comprises the following steps: a service end receives a third-party request sent by a client; authorization information of a third-party service is obtained according to a unique merchant code, and the authorization information is sent to the client; user information corresponding to the authorization information is obtained; a third-party national secret algorithm corresponding to the third-party service is obtained according to the unique merchant code, and the user information is encrypted and signed according to the third-party national secret algorithm to obtain a final message; an API interface address of the third-party service is obtained according to the unique merchant code of the third-party service, and a login request is sent to the API interface address; a token response result of the login request of the third-party service is received, and an access token in the token response result is sent to the client, so that the client accesses a page of the third-party service. The method solves the problem that the user experience is poor when logging into a third-party service platform in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of financial technology, and in particular, to a joint login method and login device based on a national secret algorithm. Background Art

[0002] In the current mobile Internet era, APP application software has become an indispensable tool in people's daily lives. With the opening of the financial services ecosystem, more and more third-party merchant services are being integrated into financial APPs, such as online shopping, life payment, insurance services, etc. This has greatly enriched the functions of APPs, but it has also brought a series of technical challenges, especially in terms of user login and information authorization.

[0003] Currently, there are two main approaches to integrating third-party merchant services into financial apps. One is by directly embedding a link to the third-party service page within the app, requiring users to re-login to the third-party merchant platform upon access. While this approach is simple to implement, it offers a poor user experience, especially for users who frequently access third-party services. Frequent logins are not only time-consuming but also reduce user retention. The other approach involves a platform-level joint login mechanism. After a user logs into a financial app for the first time, the app platform forwards their credentials to the third-party merchant, enabling automatic login. While this approach solves the problem of duplicate logins, it carries security risks during credential transmission and storage. If credentials are maliciously intercepted, user privacy and account security are compromised. Furthermore, the existing process for integrating third-party merchants into financial apps is often complex, requiring extensive technical integration and configuration on both sides, increasing development costs and timelines. Furthermore, financial apps often monitor third-party services passively. If a third-party service fails, such as a page loading anomaly or a service response timeout, the app often cannot immediately detect and take action. These issues can lead to user issues and impact the overall user experience. Summary of the Invention

[0004] The main purpose of this application is to provide a joint login method and login device based on the national encryption algorithm, so as to at least solve the problem of poor user experience when logging into a third-party service platform in the prior art.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a joint login method based on the national secret algorithm is provided, including: a server receives a third-party request sent by a client, the server is used to transfer data between the client and the third-party service, and the third-party request includes a unique merchant code of the third-party service; obtains authorization information of the third-party service according to the unique merchant code, and sends the authorization information to the client, the authorization information is the type of user information required to access the third-party service; when the user information corresponding to the authorization information is authorized to the third-party service, obtains the user information corresponding to the authorization information; obtains the authorization information according to the unique merchant code The third-party service corresponds to a third-party national secret algorithm, and the user information is encrypting and signing according to the third-party national secret algorithm to obtain a final message; the API interface address of the third-party service is obtained according to the unique merchant code of the third-party service, and a login request is sent to the API interface address, and the login request includes the final message; when the third-party service receives the login request and decrypts and verifies the signature of the final message, the token response result of the login request of the third-party service is received, and the access token in the token response result is sent to the client, so that the client can access the page of the third-party service, and the access token is the authentication credential for the client to access the third-party service.

[0006] Optionally, obtaining the user information corresponding to the authorization information includes: obtaining the user information corresponding to the authorization information in an associated system based on the authorization information, the user information including a unique user code, and the associated system being a system for managing and storing user information; parameterizing the user information and splicing it into a message to be encrypted.

[0007] Optionally, a third-party national secret algorithm corresponding to the third-party service is obtained according to the unique merchant code, and the user information is encrypted and signed according to the third-party national secret algorithm to obtain a final message, including: randomly generating an SM4 symmetric key, symmetrically encrypting the message to be encrypted to obtain a first encrypted message; asymmetrically encrypting the SM4 symmetric key according to the SM2 public key configuration of the third-party national secret algorithm to obtain a second encrypted message; sorting the parameters of the message to be encrypted in ascending order of ASCII codes to obtain a string to be signed, and signing the string to be signed according to the SM2 private key to obtain a signature string; splicing the first encrypted message, the second encrypted message and the signature string to obtain a final message.

[0008] Optionally, the generation process of the token response result comprises: the third-party service receiving the login request, and decrypting and verifying the final message according to the third-party national secret algorithm corresponding to the third-party service to obtain decryption information; generating the token response result according to the decryption information, and returning the token response result to the service end.

[0009] Optionally, the process that the client accesses the page of the third-party service comprises: the client obtaining a front-end address of the third-party service of the service end; the client accessing the front-end address according to the access token, so that the third-party service verifies whether the access token is valid, obtains a verification result, and feeds back the verification result to the service end, the verification result comprising a verification state and a verification time consumption, the verification state being that the access token is valid or invalid; in the case that the verification state is that the access token is valid, the client successfully accesses the page of the third-party service.

[0010] Optionally, in the case that the third-party service verifies that the access token is invalid, the client needs to authorize the authorization information of the third-party service again.

[0011] Optionally, the method further comprises: in the case that the service end sends the login request to the third-party service, recording the unique user code, the unique merchant code and the API interface address to obtain first monitoring information; in the case that the service end receives the token response result and the verification result of the third-party service, recording a response state in the token response result, the verification state in the verification result and the verification time consumption to obtain second monitoring information, the response state being used to reflect whether the third-party service successfully generates an access token; according to the verification state, the proportion of the number of times that the access token is valid in a unit time range to the total number of verifications is calculated to obtain a verification success rate; according to the verification time consumption, the proportion of the number of times that the verification time consumption exceeds a preset threshold in a unit time range to the total number of verifications is calculated to obtain a long verification time consumption rate; and a work log is constructed according to the first monitoring information, the second monitoring information, the verification success rate and the long verification time consumption rate.

[0012] Optionally, the method further comprises: the service end obtaining a monitoring index corresponding to the third-party service, and judging whether the third-party service is normally running according to the monitoring index, the monitoring index being used to evaluate whether the verification success rate and the long verification time consumption rate of the work log are in a normal range; in the case that the verification success rate is lower than a preset threshold or the long verification time consumption rate is higher than a preset threshold, sending a fault alarm to the third-party service.

[0013] Optionally, the method further includes: the server periodically sending a probe message to the third-party service, wherein the probe message is used to detect the service status of the API interface address of the third-party service.

[0014] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a joint login device based on the national secret algorithm is provided, including: a first receiving unit, for a server to receive a third-party request sent by a client, the server being used to transfer data between the client and the third-party service, the third-party request including a unique merchant code of the third-party service; a first acquisition unit, for acquiring authorization information of the third-party service according to the unique merchant code, and sending the authorization information to the client, the authorization information being the type of user information required to access the third-party service; a second acquisition unit, for acquiring the user information corresponding to the authorization information when the user information corresponding to the authorization information is authorized to the third-party service; a third acquisition unit, for acquiring the user information corresponding to the authorization information according to the unique merchant code The unique merchant code is used to obtain the third-party national secret algorithm corresponding to the third-party service, and the user information is encrypting and signing according to the third-party national secret algorithm to obtain a final message; the first sending unit is used to obtain the API interface address of the third-party service according to the unique merchant code of the third-party service, and send a login request to the API interface address, and the login request includes the final message; the second sending unit is used to receive the token response result of the login request of the third-party service when the third-party service receives the login request and decrypts and verifies the signature of the final message, and send the access token in the token response result to the client, so that the client can access the page of the third-party service, and the access token is the authentication credential for the client to access the third-party service.

[0015] Applying the technical solution of the present application, in the above-mentioned joint login method based on the national secret algorithm, it includes: the server receives a third-party request sent by the client, the above-mentioned server is used to transfer data between the above-mentioned client and the third-party service, and the above-mentioned third-party request includes the unique merchant code of the above-mentioned third-party service; according to the above-mentioned unique merchant code, the authorization information of the above-mentioned third-party service is obtained, and the above-mentioned authorization information is sent to the above-mentioned client, and the above-mentioned authorization information is the type of user information required to access the above-mentioned third-party service; in the case that the above-mentioned user information corresponding to the above-mentioned authorization information is authorized to the above-mentioned third-party service, the above-mentioned user information corresponding to the above-mentioned authorization information is obtained; according to the above-mentioned unique merchant code, the above-mentioned third-party service is obtained. The third-party national secret algorithm corresponding to the third-party service is used, and the user information is encrypted and signed according to the third-party national secret algorithm to obtain the final message; the API interface address of the third-party service is obtained according to the unique merchant code of the third-party service, and a login request is sent to the API interface address, and the login request includes the final message; when the third-party service receives the login request and decrypts and verifies the signature of the final message, the token response result of the login request of the third-party service is received, and the access token in the token response result is sent to the client, so that the client can access the page of the third-party service. The access token is the authentication credential for the client to access the third-party service. This application obtains the authorization information of the third-party service on the server side and feeds it back to the client. After the client authorizes, the server side obtains the API interface of the third-party service and sends a request, and receives the access token in the request response result and sends it to the client. The client accesses the page of the third-party service according to the access token to realize joint login. The user does not need to enter the login information again to complete the operation of logging into the third-party service. In addition, during the data transmission process, the data is encrypted using the national secret algorithm to ensure the security of the data transmission process, solving the problem of poor user experience when logging into the third-party service platform in the existing technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The following is a hardware structure diagram of a mobile terminal that performs a joint login method based on a national encryption algorithm according to an embodiment of the present application;

[0017] Figure 2 A schematic diagram of a joint login method based on a national encryption algorithm according to an embodiment of the present application is shown;

[0018] Figure 3 An interactive diagram of a joint login method based on a national encryption algorithm provided according to an embodiment of the present application is shown;

[0019] Figure 4The figure shows a structural block diagram of a joint login device based on a national encryption algorithm provided according to an embodiment of the present application.

[0020] The above drawings include the following reference numerals:

[0021] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. DETAILED DESCRIPTION

[0022] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] As introduced in the background technology, in the existing technology, users need to log in again when accessing a third-party merchant platform and the user's privacy information is at security risk. To solve this technical problem, the embodiments of the present application provide a joint login method and login device based on the national encryption algorithm.

[0026] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present invention.

[0027] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure diagram of a mobile terminal for a joint login method based on a national encryption algorithm according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown) a processor 102 (the processor 102 may include but is not limited to a microprocessor MCU or a programmable logic device FPGA and other processing devices) and a memory 104 for storing data, wherein the above mobile terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0028] Memory 104 can be used to store computer programs, such as application software programs and modules, such as a computer program corresponding to a joint login method based on a national encryption algorithm in an embodiment of the present invention. Processor 102 executes the computer programs stored in memory 104 to perform various functional applications and data processing, thereby implementing the above-mentioned method. Memory 104 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, memory 104 may further include memory remotely located from processor 102, which can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof. Transmission device 106 is used to receive or transmit data via a network. Specific examples of such networks may include a wireless network provided by the mobile terminal's telecommunications provider. In one example, transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0029] In this embodiment, a joint login method based on a national encryption algorithm is provided, which runs on a mobile terminal, a computer terminal or a similar computing device. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0030] Figure 2is a flowchart of a joint login method based on a national secret algorithm according to an embodiment of the present application. As shown in Figure 2 the method comprises the following steps:

[0031] Step S201, the service end receives the third-party request sent by the client, the service end is used for data transmission between the client and the third party service, and the third-party request includes the unique merchant code of the third-party service;

[0032] Specifically, when the client wants to access the page of the third-party service and sends a request, the service end is responsible for receiving the third-party request sent by the client, and the third-party request contains the unique identification of the third-party service, that is, the unique merchant code. The purpose is to ensure that when the user sends the third-party request, the service end can accurately identify which specific third-party service the client wants to access.

[0033] Step S202, obtaining the authorization information of the third-party service according to the unique merchant code, and sending the authorization information to the client, the authorization information being the type of user information required for accessing the third-party service;

[0034] Specifically, according to the unique merchant code carried in the received request, the service end can obtain the authorization information related to the third-party service in the information pre-configured by the third-party service, and then feed back the authorization information to the client. The user can authorize the displayed authorization information. The authorization information specifically specifies the category of personal information that the user needs to share when accessing the third-party service. This design realizes fine-grained permission control, ensures that the user only provides necessary information to the third-party service, and enhances the privacy protection of user data.

[0035] Step S203, in the case that the user information corresponding to the authorization information is authorized to the third-party service, obtaining the user information corresponding to the authorization information;

[0036] Specifically, when the service end confirms that the user has given the third-party service access permission to the user information type specified in the authorization information, the service end will extract these specific user information from the related system, so as to realize the safe transmission of subsequent user information. This process realizes the information calling based on the explicit authorization of the user, and ensures that the use of user data strictly follows the user's intention and the set permission boundary.

[0037] Step S204, obtaining the third-party national secret algorithm corresponding to the third-party service according to the unique merchant code, and encrypting and signing the user information according to the third-party national secret algorithm to obtain the final message;

[0038] Specifically, the server can obtain the SM algorithm configuration associated with the third-party service from the information pre-configured by the third-party service according to the unique merchant code, and then apply the specific SM algorithm to encrypt and digitally sign the user information to generate a secure final message. The implementation of this encryption and signature process enhances the security of information transmission, effectively preventing data leakage or tampering during transmission. At the same time, the design of digital signature further ensures the integrity of the final message and the credibility of the sender's identity.

[0039] Step S205, obtaining the API interface address of the third-party service according to the unique merchant code of the third-party service, and sending a login request to the API interface address, wherein the login request includes the final message;

[0040] Specifically, the server can accurately identify and call the corresponding API interface address in the pre-configured information of the third-party service according to the unique merchant code of the third-party service, and then encapsulate the final message processed by encryption and signature into the login request and safely deliver it to the third-party interface.

[0041] Step S206, in the case that the third-party service receives the login request and decrypts and verifies the final message, receiving the token response result of the login request of the third-party service, and sending the access token in the token response result to the client to enable the client to access the page of the third-party service, wherein the access token is the authentication credential of the client accessing the third-party service.

[0042] Specifically, when the third-party service successfully receives and verifies the encrypted message sent by the server, it confirms its legality and integrity, generates and returns a token response result of the login request, which contains a key access token. The server captures this response, extracts the access token, and safely forwards it to the client as a dedicated authentication credential for the client to access the third-party service page. Through this process, it ensures smooth transition from the APP to the third-party service without the need to re-enter the credentials.

[0043] In the joint login method based on the national secret algorithm, the server receives a third-party request sent by the client, the server is configured to transmit data between the client and a third-party service, the third-party request includes a unique merchant code of the third-party service; authorization information of the third-party service is obtained according to the unique merchant code, and the authorization information is sent to the client, the authorization information is a type of user information required to access the third-party service; in the case that the user information corresponding to the authorization information is authorized to the third-party service, the user information corresponding to the authorization information is obtained; a third-party national secret algorithm corresponding to the third-party service is obtained according to the unique merchant code, and the user information is encrypted and signed according to the third-party national secret algorithm to obtain a final message; an API interface address of the third-party service is obtained according to the unique merchant code of the third-party service, and a login request is sent to the API interface address, the login request includes the final message; in the case that the third-party service receives the login request and decrypts and verifies the final message, a token response result of the login request of the third-party service is received, and an access token in the token response result is sent to the client to enable the client to access a page of the third-party service, and the access token is an authentication credential of the client to access the third-party service. The authorization information of the third-party service is obtained on the server and fed back to the client, after the client is authorized, the API interface of the third-party service is obtained on the server and a request is sent, and an access token in the request response result is received and sent to the client, and the client accesses the page of the third-party service according to the access token to realize joint login, and the user can complete the login operation of the third-party service without entering the login information again, and in the data transmission process, the data is encrypted by using the national secret algorithm, so that the security in the data transmission process is ensured, and the problem that the user experience is poor when logging into the third-party service platform in the prior art is solved.

[0044] In order to obtain user information, in an optional implementation, the user information corresponding to the authorization information is obtained, and the step S203 includes:

[0045] In step S2031, the user information corresponding to the authorization information is obtained from the association system according to the authorization information, the user information includes a unique user code, and the association system is a system for managing and storing user information.

[0046] Specifically, based on the parameters permitted by the user in the authorization information, the system accurately extracts detailed information corresponding to the user from the associated database specifically responsible for user information management and storage, such as the user's name, mobile phone number, and user's eligibility information for participating in third-party activities. These materials contain the user's unique identification code. Through this step, on-demand retrieval of user data is achieved.

[0047] Step S2032: parameterize the above user information and combine them to form a message to be encrypted.

[0048] Specifically, the system converts the extracted user information into a series of parameters, and concatenates the parameters corresponding to each information to construct the message to be encrypted. This parameterization and message construction process realizes the effective organization and formatting of user information. The system can integrate multiple independent information fragments into a whole, facilitating the use of a unified encryption scheme for protection.

[0049] In order to encrypt the user information, in an optional embodiment, the third-party national encryption algorithm corresponding to the third-party service is obtained according to the unique merchant code, and the user information is encrypted and signed according to the third-party national encryption algorithm to obtain a final message. The above step S204 includes:

[0050] Step S2041: randomly generate an SM4 symmetric key, and symmetrically encrypt the message to be encrypted to obtain a first encrypted message;

[0051] Specifically, the system randomly generates an SM4 symmetric encryption key and performs an encryption operation on the encrypted message, thereby generating a first encrypted message. By adopting a symmetric encryption algorithm, even if the first encrypted message is intercepted during transmission, it is difficult to decrypt without the correct key, thereby significantly improving the confidentiality of the data transmission process and protecting user information from unauthorized access.

[0052] Step S2042: Asymmetrically encrypt the SM4 symmetric key according to the SM2 public key configuration of the third-party national encryption algorithm to obtain a second encrypted message;

[0053] Specifically, according to the national secret algorithm SM2 public key configured by the third-party service, the previously generated SM4 symmetric key is asymmetrically encrypted to obtain the second encrypted message. This double encryption strategy first ensures the confidentiality of the original message through SM4, and then uses the SM2 public key to protect the encryption key itself, building a multi-level encryption defense system. Even if the second encrypted message is intercepted during transmission, due to the asymmetric encryption characteristics of the encryption key, the attacker will not be able to decrypt the original SM4 key without the corresponding SM2 private key, and thus will not be able to decrypt the message content.

[0054] Step S2043: sort the parameters of the message to be encrypted in ascending order of ASCII codes to obtain a string to be signed, and sign the string to be signed using the SM2 private key to obtain a signature string;

[0055] Specifically, the system sorts the parameters in the constructed message to be encrypted in ascending order according to the ASCII code of the key value of the first character. If the same characters are encountered, the system sorts them in ascending order according to the ASCII code of the key value of the second character, and so on. The sorted parameters and their corresponding values ​​are combined into the format of "parameter = parameter value", and these parameters are connected with the & character to obtain the string to be signed, thereby adding additional security at the data transmission level.

[0056] Step S2044: Concatenate the first encrypted message, the second encrypted message, and the signature string to obtain a final message.

[0057] Specifically, the system combines the three key components, namely the first encrypted message formed by symmetric encryption, the second encrypted message protected by asymmetric encryption, and the signature string used to verify integrity and authenticity, in an orderly manner to form the final message structure.

[0058] When the third-party service receives the login request, in order to generate an access token, in an optional embodiment, the process of generating the token response result further includes:

[0059] Step S301: The third-party service receives the login request and decrypts and verifies the signature of the final message according to the third-party national encryption algorithm corresponding to the third-party service to obtain decrypted information.

[0060] Specifically, when a third-party service receives a login request containing encrypted data and a signature, it will use the matching national encryption algorithm SM2 private key to decrypt the final message and verify the signature of the message. After completing the decryption and signature verification, the third-party service can safely restore the information carried by the final message, including the details of the user's authorization.

[0061] Step S302: Generate the token response result according to the decrypted information, and return the token response result to the server.

[0062] Specifically, based on the decrypted information, the third-party service will generate a secure token response that encapsulates proof of the user's login status and key data such as possible expiration time. This token response result will then be securely fed back to the financial APP's server. This process not only confirms the user's valid identity, but also simplifies the subsequent login verification process in the form of a token.

[0063] In order to enable the client to access the third-party service page, in an optional embodiment, the process of the client accessing the third-party service page, the method further includes:

[0064] Step S303: the client obtains the front-end address of the third-party service from the server;

[0065] Specifically, after successfully receiving the access token returned by the server, the client will obtain the pre-configured front-end access entry address of the third-party service from the server.

[0066] In step S304, the client accesses the front-end address based on the access token, causing the third-party service to verify whether the access token is valid, obtain a verification result, and feed the verification result back to the server. The verification result includes a verification status and a verification time. The verification status indicates whether the access token is valid or invalid.

[0067] Specifically, the client uses the obtained access token, that is, the login token, to access the front-end entrance of the third-party service. This action triggers the third-party service to immediately verify the validity of the token. The verification process not only checks the legitimacy of the token, but also calculates the response time of the verification, that is, the verification time. If the token is confirmed to be valid, the third-party service will allow the client to access its page and feedback this verification status together with the time information to the server.

[0068] Step S305: When the verification status indicates that the access token is valid, the client successfully accesses the page of the third-party service.

[0069] Specifically, when the access token is verified to be valid, the client can access the page of the third-party service and achieve a smooth service experience. This mechanism ensures that only authenticated users can access specific resources, thereby strengthening the security of the system and preventing unauthorized access. For users, in a joint login process, they can directly transition from the APP environment to the third-party service environment without going through additional login steps, which greatly improves operational efficiency and user satisfaction.

[0070] When the access token expires, in order to enable the client to still access the third-party service page, in an optional implementation, the above method further includes:

[0071] Step S306: When the third-party service verifies that the access token is invalid, the client needs to re-authorize the authorization information of the third-party service.

[0072] Specifically, if the third-party service determines that the access token has expired or is invalid in the verification process, the client needs to restart the authorization process to update its credentials for accessing the third-party service.

[0073] To record the process of federated login, in an optional embodiment, the above method further comprises:

[0074] Step S401, in the case where the service sends the login request to the third-party service, the unique user code, the unique merchant code and the API interface address are recorded to obtain first monitoring information;

[0075] Specifically, in the link of initiating a federated login request by the service to the third-party service, in order to achieve comprehensive activity tracking, the system automatically records the core identifiers involved in the login, including the unique code of the user, the unique code of the merchant and the API interface address of the third-party service, thereby constructing the first monitoring information.

[0076] Step S402, in the case where the service receives the token response result and the verification result of the third-party service, the response status in the token response result, the verification status in the verification result and the verification time consumption are recorded to obtain second monitoring information, and the response status is used to reflect whether the third-party service successfully generates an access token;

[0077] Specifically, when the service receives the token response result and the verification result of the third-party service, the corresponding state information is recorded, including whether the third-party service successfully generates an access token, and the validity status of the token in the verification process and the time consumed for completing the verification, thereby constructing the second monitoring information.

[0078] Step S403, according to the verification status, the proportion of the number of times that the access token is valid in the total number of verifications within a unit time range is calculated to obtain a verification success rate;

[0079] Specifically, in a set time period, the system calculates the ratio of the number of times that the access token is determined to be valid to the total number of verification requests, thereby obtaining the verification success rate as a key indicator, and the verification success rate reflects the reliability of the system in processing federated login requests.

[0080] Step S404, according to the verification time consumption, the proportion of the number of times that the verification time consumption exceeds a preset threshold in the total number of verifications within a unit time range is calculated to obtain a long verification time consumption rate;

[0081] Specifically, the system calculates the proportion of the total verification requests of the overtime cases by analyzing the time consumed for each verification, i.e., verification time, and counting the verification time greater than a preset time threshold in a specific time, so as to obtain the performance indicator of the long verification time rate, which effectively quantifies the efficiency of the federated login verification link.

[0082] In step S405, a work log is constructed according to the first monitoring information, the second monitoring information, the verification success rate and the long verification time rate.

[0083] Specifically, the first monitoring information, the second monitoring information, the verification success rate and the long verification time rate are used to construct a detailed work log for system operation and maintenance, and the construction of the work log realizes comprehensive recording and tracking of the running state of the federated login mechanism.

[0084] In order to monitor the third-party service according to the work log, in an optional embodiment, the method further comprises:

[0085] In step S406, the server obtains monitoring indicators corresponding to the third-party service, and judges whether the third-party service is running normally according to the monitoring indicators, wherein the monitoring indicators are used to evaluate whether the verification success rate and the long verification time rate of the work log are within a normal range.

[0086] Specifically, the server obtains the monitoring indicator information pre-configured by the third-party service, and compares the verification success rate and the long verification time rate in the work log corresponding to the third-party service with the monitoring indicators to evaluate whether the running state of the third-party service is within a healthy and acceptable range.

[0087] In step S407, a fault alarm is sent to the third-party service when the verification success rate is lower than a preset threshold or the long verification time rate is higher than a preset threshold.

[0088] Specifically, when the verification success rate drops below a set warning level or the long verification time rate exceeds a predetermined limit, the server will immediately send a fault warning notification to the operation and maintenance personnel and business personnel of the third-party service, so as to timely notify the third-party service provider to troubleshoot and repair. After receiving the fault warning notification, the business personnel can configure to offline the third-party service, so as to avoid that the customers receive error information when further using the third-party function. After receiving the message, the operation and maintenance personnel can timely repair the problem.

[0089] In order to be able to monitor the service state of the third-party service, in an optional embodiment, the method further comprises:

[0090] In step S408, the server periodically sends a probe packet to the third-party service, and the probe packet is used to detect the service state of the API interface address of the third-party service.

[0091] Specifically, the server periodically sends a probe packet to the third-party service, and the main function of the probe packet is to detect the service state of the API interface address of the third-party service, that is, whether the current API interface address is available. This active monitoring effectively realizes continuous tracking and evaluation of the stability of the third-party service.

[0092] In order to further understand the interaction process of the joint login, Figure 3 An interaction diagram of a joint login method based on a national cryptographic algorithm is shown.

[0093] As Figure 3 shown, the interaction process of the joint login is as follows: first, the user clicks the third-party service that the user wants to access in the APP, and after receiving the access request, the APP server sends the user the authorization information that needs to be confirmed. After the user authorizes the authorization information according to the authorization information interface, the user sends the authorization information to the APP server. The APP server obtains the corresponding user information according to the authorization information, and uses the national cryptographic algorithm to encrypt and sign the user information and sends it to the third-party service. The third-party service returns the login token of the user, that is, the access token, to the APP server according to the user information. After obtaining the login token, the APP server sends the login token to the user. The user can access the third-party page with the login token to realize joint login.

[0094] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0095] The application also provides a joint login device based on a national cryptographic algorithm. It should be noted that the joint login device based on a national cryptographic algorithm provided by the application can be used to execute the joint login method based on a national cryptographic algorithm provided by the application. The device is used to realize the above-mentioned embodiments and preferred embodiments, and the description is omitted. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware or a combination of software and hardware is also possible and is contemplated.

[0096] The joint login device based on a national cryptographic algorithm provided by the application is described below.

[0097] Figure 4 is a structural block diagram of a joint login device based on a national secret algorithm according to an embodiment of the present application. As shown in the figure, the device comprises: Figure 4

[0098] A first receiving unit 10 is configured to receive a third-party request sent by a client on a server, the server being configured to transmit data between the client and a third-party service, and the third-party request comprising a unique merchant code of the third-party service.

[0099] Specifically, when the client wants to access a page of the third-party service and sends a request, the server is responsible for receiving the third-party request sent by the client, and the third-party request contains a unique identifier of the third-party service, i.e., a unique merchant code. The purpose is to ensure that when the user sends the third-party request, the server can accurately identify which specific third-party service the client wants to access.

[0100] A first obtaining unit 20 is configured to obtain authorization information of the third-party service according to the unique merchant code, and send the authorization information to the client, the authorization information being a type of user information required for accessing the third-party service.

[0101] Specifically, according to the unique merchant code carried in the received request, the server can obtain the authorization information related to the third-party service from the information pre-configured by the third-party service, and then feed back the authorization information to the client. The user can authorize the displayed authorization information. The authorization information specifically indicates the category of personal information to be shared by the user when accessing the third-party service. This design realizes fine-grained permission control, ensures that the user only provides necessary information to the third-party service, and enhances the privacy protection of user data.

[0102] A second obtaining unit 30 is configured to obtain the user information corresponding to the authorization information, in a case where the user information corresponding to the authorization information is authorized to the third-party service.

[0103] Specifically, when the server confirms that the user has given the third-party service access permission to the type of user information specified in the authorization information, the server will extract these specific user information from the related system, so as to facilitate the subsequent secure transmission of user information. This process realizes information calling based on explicit authorization of the user, and ensures that the use of user data strictly follows the user's intention and the set permission boundary.

[0104] A third obtaining unit 40 is configured to obtain a third-party national secret algorithm corresponding to the third-party service according to the unique merchant code, and encrypt and sign the user information according to the third-party national secret algorithm, to obtain a final message.

[0105] ​Specifically, the server can obtain the SM algorithm configuration associated with the third-party service in the information pre-configured by the third-party service according to the unique merchant code, and then apply the specific SM algorithm to encrypt and digitally sign the user information to generate a secure final message. The implementation of this encryption and signature process enhances the security of information transmission, effectively preventing data leakage or tampering during transmission. At the same time, the design of digital signature further ensures the integrity of the final message and the credibility of the sender's identity.

[0106] The first sending unit 50 is configured to obtain the API interface address of the third-party service according to the unique merchant code of the third-party service, and send a login request to the API interface address, wherein the login request includes the final message.

[0107] Specifically, the server can accurately identify and call the corresponding API interface address in the information pre-configured by the third-party service according to the unique merchant code of the third-party service, and then encapsulate the final message processed by encryption and signature into the login request and safely deliver it to the third-party interface.

[0108] The second sending unit 60 is configured to receive the token response result of the login request of the third-party service when the third-party service receives the login request and decrypts and verifies the final message, and send the access token in the token response result to the client to enable the client to access the page of the third-party service, wherein the access token is the authentication credential of the client for accessing the third-party service.

[0109] Specifically, when the third-party service successfully receives and verifies the encrypted message sent by the server, it confirms the legality and integrity of the message, generates and returns a token response result of the login request, which contains a key access token. The server captures this response, extracts the access token, and safely forwards it to the client as a dedicated authentication credential for the client to access the third-party service page. Through this process, it ensures that the user can smoothly transition from the APP to the third-party service without the need to re-enter the credentials.

[0110] Through this embodiment, the first receiving unit is used for the server to receive the third-party request sent by the client, and the above-mentioned server is used to transfer data between the above-mentioned client and the third-party service, and the above-mentioned third-party request includes the unique merchant code of the above-mentioned third-party service; the first obtaining unit is used to obtain the authorization information of the above-mentioned third-party service according to the above-mentioned unique merchant code, and send the above-mentioned authorization information to the above-mentioned client, and the above-mentioned authorization information is the type of user information required to access the above-mentioned third-party service; the second obtaining unit is used to obtain the above-mentioned user information corresponding to the above-mentioned authorization information when the above-mentioned user information corresponding to the above-mentioned authorization information is authorized to the above-mentioned third-party service; the third obtaining unit is used to obtain the above-mentioned user information corresponding to the above-mentioned third-party service according to the above-mentioned unique merchant code. The third-party national secret algorithm is used, and the user information is encrypted and signed according to the third-party national secret algorithm to obtain the final message; the first sending unit is used to obtain the API interface address of the third-party service according to the unique merchant code of the third-party service, and send a login request to the API interface address, and the login request includes the final message; the second sending unit is used to receive the token response result of the login request of the third-party service when the third-party service receives the login request and decrypts and verifies the signature of the final message, and send the access token in the token response result to the client, so that the client can access the page of the third-party service. The access token is the authentication credential for the client to access the third-party service. This application obtains the authorization information of the third-party service on the server side and feeds it back to the client. After the client authorizes, the server side obtains the API interface of the third-party service and sends a request, and receives the access token in the request response result and sends it to the client. The client accesses the page of the third-party service according to the access token to realize joint login. The user does not need to enter the login information again to complete the operation of logging into the third-party service. In addition, during the data transmission process, the data is encrypted using the national secret algorithm to ensure the security of the data transmission process, solving the problem of poor user experience when logging into the third-party service platform in the existing technology.

[0111] In order to obtain the user information, in an optional embodiment, the second obtaining unit obtains the user information corresponding to the authorization information, and includes:

[0112] A first acquisition module is configured to acquire the user information corresponding to the authorization information from a correlation system according to the authorization information, wherein the user information includes a unique user code, and the correlation system is a system for managing and storing user information;

[0113] Specifically, according to the parameters permitted by the user in the authorization information, the system accurately extracts detailed information corresponding to the user, such as the user's name, mobile phone number and the user's qualification information for participating in third-party activities, from the associated database specially responsible for user information management and storage. The user's unique identification code is contained in these information. Through this step, the user data is retrieved on demand.

[0114] The second acquisition module is used for parameterizing the user information and splicing to form the to-be-encrypted message.

[0115] Specifically, the system converts the extracted user information into a series of parameters, splices the parameters corresponding to each information, and constructs a to-be-encrypted message. This parameterization and message construction process realizes effective organization and formatting of user information. The system can integrate multiple independent information segments into a whole, which is convenient for protection by using a unified encryption scheme.

[0116] In order to encrypt the user information, in an optional implementation manner, the third-party national encryption algorithm corresponding to the third-party service is obtained according to the unique merchant code, and the user information is encrypted and signed according to the third-party national encryption algorithm to obtain a final message. The third acquisition unit includes:

[0117] The third acquisition module is used for randomly generating an SM4 symmetric key, performing symmetric encryption on the to-be-encrypted message, and obtaining a first encrypted message.

[0118] Specifically, the system randomly generates an SM4 symmetric encryption key and performs encryption operation on the to-be-encrypted message, thereby generating a first encrypted message. By using the symmetric encryption algorithm, the first encrypted message is difficult to be decrypted without the correct key even if it is intercepted during transmission, thereby significantly improving the confidentiality during data transmission and protecting the user information from unauthorized access.

[0119] The fourth acquisition module is used for performing asymmetric encryption on the SM4 symmetric key according to the SM2 public key configuration of the third-party national encryption algorithm, and obtaining a second encrypted message.

[0120] Specifically, the SM4 symmetric key generated previously is subjected to asymmetric encryption according to the SM2 public key of the national encryption algorithm configured by the third-party service, thereby obtaining a second encrypted message. This double encryption strategy first ensures the confidentiality of the original message by using SM4, and then protects the encryption key itself by using the SM2 public key, thereby constructing a multi-level encryption defense system. Even if the second encrypted message is intercepted during transmission, the attacker cannot decrypt the original SM4 key due to the asymmetric encryption characteristics of the encryption key, and thus cannot decrypt the message content.

[0121] The fifth obtaining module is configured to perform ASCII code incremental sorting on parameters of the to-be-encrypted message to obtain a to-be-signed string, and sign the to-be-signed string according to an SM2 private key to obtain a signature string;

[0122] Specifically, the system performs ASCII code incremental sorting on parameters in the constructed to-be-encrypted message according to key values of first characters, and if the same characters are encountered, performs ASCII code incremental sorting on key values of second characters, and so on, combines the sorted parameters and corresponding values in the format of 'parameter=parameter value', and connects the parameters by using a character to obtain a to-be-signed string, thereby increasing additional security at a data transmission level.

[0123] The sixth obtaining module is configured to splice the first encrypted message, the second encrypted message and the signature string to obtain a final message.

[0124] Specifically, the system sequentially combines the first encrypted message formed by symmetric encryption, the second encrypted message protected by asymmetric encryption, and the signature string for verifying integrity and authenticity, to form a final message structure.

[0125] When the third-party service receives the login request, in order to generate an access token, in an optional implementation, the generation process of the token response result includes the following steps:

[0126] The first generating unit is configured to cause the third-party service to receive the login request, and decrypt and verify the final message according to the third-party national cryptographic algorithm corresponding to the third-party service to obtain decrypted information.

[0127] Specifically, when the third-party service receives the login request containing encrypted data and a signature, it will use the matching national cryptographic algorithm SM2 private key to decrypt the final message and verify the signature of the message. After decryption and verification, the third-party service can safely restore the information carried by the final message, including the details of user authorization.

[0128] The second generating unit is configured to generate the token response result according to the decrypted information, and return the token response result to the service end.

[0129] Specifically, according to the decrypted information, the third-party service will generate a secure token response, which encapsulates the proof of the user login state and possible expiration time and other key data. Subsequently, this token response result is safely fed back to the service end of the financial APP. This process not only confirms the valid identity of the user, but also simplifies the subsequent login verification process in the form of a token.

[0130] In order to enable the client to access the page of the third-party service, in an optional embodiment, the process of the client accessing the page of the third-party service, the device further comprises:

[0131] A first access unit is configured to enable the client to obtain the front-end address of the third-party service of the server.

[0132] Specifically, after successfully receiving the access token returned by the server, the client obtains the pre-configured front-end access entry address of the third-party service from the server.

[0133] A second access unit is configured to enable the client to access the front-end address according to the access token, so that the third-party service verifies whether the access token is valid, obtains a verification result, and feeds back the verification result to the server, wherein the verification result comprises a verification state and a verification time consumption, and the verification state is that the access token is valid or invalid.

[0134] Specifically, the client accesses the front-end entry of the third-party service by using the obtained access token, which triggers the third-party service to instantly verify the validity of the token. The verification process not only checks the legality of the token, but also calculates the response time of the verification, i.e. the verification time consumption. If the token is confirmed to be valid, the third-party service will allow the client to access its page, and will feed back the verification state together with the time consumption information to the server.

[0135] A third access unit is configured to enable the client to successfully access the page of the third-party service when the verification state is that the access token is valid.

[0136] Specifically, when the verification confirms that the access token is valid, the client can access the page of the third-party service, realizing a smooth service experience. This mechanism ensures that only authenticated users can access specific resources, thereby strengthening the security of the system and preventing unauthorized access. For users, in a single federated login process, they can directly transition from the APP environment to the third-party service environment without going through additional login steps, greatly improving the operation efficiency and user satisfaction.

[0137] When the access token is invalid, in order to enable the client to still access the page of the third-party service, in an optional embodiment, the device further comprises:

[0138] A first invalidation unit is configured to enable the client to re-authorize the authorization information of the third-party service when the third-party service verifies that the access token is invalid.

[0139] Specifically, if the third-party service determines that the access token has expired or is invalid in the verification process, the client needs to restart the authorization process to update its credentials for accessing the third-party service.

[0140] In order to record the process of joint login, in an optional embodiment, the above-mentioned device further comprises:

[0141] The first recording unit is configured to record the unique user code, the unique merchant code and the API interface address of the third-party service to obtain first monitoring information when the service end sends the login request to the third-party service.

[0142] Specifically, in the process of initiating a joint login request from the service end to the third-party service, in order to achieve comprehensive activity tracking, the system automatically records the core identification involved in the login, including the unique code of the user, the unique code of the merchant and the API interface address of the third-party service, thereby constructing the first monitoring information.

[0143] The second recording unit is configured to record the response status in the token response result, the verification status in the verification result and the verification time consumption to obtain second monitoring information when the service end receives the token response result and the verification result of the third-party service, and the response status is used to reflect whether the third-party service successfully generates an access token.

[0144] Specifically, when the service end receives the token response result and the verification result of the third-party service, the corresponding state information is recorded, including whether the third-party service successfully generates an access token, the validity status of the token in the verification process and the time consumed for completing the verification, thereby constructing the second monitoring information.

[0145] The third recording unit is configured to calculate the proportion of the number of times that the access token is valid within a unit time range to the total number of verifications according to the verification status to obtain a verification success rate.

[0146] Specifically, within a set time period, the system calculates the ratio of the number of times that the access token is determined to be valid to the total number of verification requests, thereby obtaining the key indicator of the verification success rate, which reflects the reliability of the system in processing joint login requests.

[0147] The fourth recording unit is configured to calculate the proportion of the number of times that the verification time consumption exceeds a preset threshold within a unit time range to the total number of verifications according to the verification time consumption to obtain a long verification time consumption rate.

[0148] Specifically, the system calculates the proportion of the total verification requests of the timeout cases by analyzing the time consumed for each verification, i.e., verification time consumption, and counting the verification time consumption greater than a preset time consumption threshold in a specific time, so as to obtain the performance index of the long verification time consumption rate, which effectively quantifies the efficiency of the federated login verification link.

[0149] The fifth recording unit is configured to construct a work log according to the first monitoring information, the second monitoring information, the verification success rate and the long verification time consumption rate.

[0150] Specifically, the first monitoring information, the second monitoring information, the verification success rate and the long verification time consumption rate are used to construct a detailed work log for system operation and maintenance, and the construction of the work log realizes comprehensive recording and tracking of the running state of the federated login mechanism.

[0151] In order to monitor the third-party service according to the work log, in an optional embodiment, the apparatus further comprises:

[0152] The first monitoring unit is configured to acquire, by the server, monitoring indexes corresponding to the third-party service, and determine whether the third-party service is running normally according to the monitoring indexes, wherein the monitoring indexes are used to evaluate whether the verification success rate and the long verification time consumption rate of the work log are within a normal range.

[0153] Specifically, the server acquires the monitoring index information pre-configured by the third-party service, compares the verification success rate and the long verification time consumption rate in the work log corresponding to the third-party service with the monitoring indexes, and evaluates whether the running state of the third-party service is within a healthy and acceptable range.

[0154] The second monitoring unit is configured to send a fault alarm to the third-party service when the verification success rate is lower than a preset threshold or the long verification time consumption rate is higher than a preset threshold.

[0155] Specifically, when the verification success rate drops below a set warning level or the long verification time consumption rate exceeds a predetermined limit, the server immediately sends a fault warning notification to the operation and maintenance personnel and the business personnel of the third-party service, so as to timely notify the third-party service provider to troubleshoot and repair, the business personnel can configure to offline the third-party service after receiving the fault warning notification, so as to avoid that the customers receive error information when further using the third-party function, and the operation and maintenance personnel can timely repair the problem after receiving the message.

[0156] In order to be able to monitor the service state of the third-party service, in an optional embodiment, the apparatus further comprises:

[0157] The third monitoring unit is configured for the server to periodically send probe messages to the third-party service, where the probe messages are used to detect the service status of the API interface address of the third-party service.

[0158] Specifically, the server will periodically send probe messages to third-party services. Its main function is to detect the service status of the API interface address of the third-party service, that is, whether the current API interface address is available. This active monitoring approach effectively realizes the continuous tracking and evaluation of the stability of third-party services.

[0159] The aforementioned joint login device based on the national secret algorithm includes a processor and a memory. The aforementioned first receiving unit, first acquisition unit, second acquisition unit, third acquisition unit, first sending unit, and second sending unit are all stored as program units in the memory. The processor executes the program units stored in the memory to implement the corresponding functions. The aforementioned modules are all located in the same processor; alternatively, the aforementioned modules may be located in different processors in any combination.

[0160] The processor contains a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the kernel parameters can be adjusted to improve the user experience when logging into the third-party service platform.

[0161] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0162] An embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes the above-mentioned joint login method based on the national encryption algorithm when running.

[0163] Specifically, a joint login method based on the national secret algorithm includes:

[0164] Step S201: A server receives a third-party request sent by a client. The server is used to transfer data between the client and the third-party service. The third-party request includes a unique merchant code of the third-party service.

[0165] Step S202: Obtain authorization information for the third-party service based on the unique merchant code, and send the authorization information to the client. The authorization information is the type of user information required to access the third-party service.

[0166] Step S203: if the user information corresponding to the authorization information is authorized to the third-party service, obtain the user information corresponding to the authorization information;

[0167] Step S204, according to the above-mentioned unique merchant code to obtain the third party service corresponding to the third party national encryption algorithm, and according to the above-mentioned third party national encryption algorithm to the above-mentioned user information encryption signing, get the final message;

[0168] Step S205, according to the unique merchant code of the third party service to obtain the API interface address of the third party service, and send a login request to the API interface address, the login request includes the final message;

[0169] Step S206, in the case of receiving login request and decrypting and verifying the final message of the third party service, receiving the token response result of the login request of the third party service, and sending the access token in the token response result to the client, so that the client accesses the page of the third party service, the access token is the authentication credential of the client accessing the third party service.

[0170] Obviously, those skilled in the art should understand that the modules or steps of the present application can be realized by general computing devices, which can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, which can be realized by program codes executable by computing devices, so that they can be stored in storage devices and executed by computing devices, and in some cases, the steps shown or described can be executed in different order, or they can be made into individual integrated circuit modules, or multiple modules or steps can be made into a single integrated circuit module. Thus, the present application is not limited to any particular hardware and software combination.

[0171] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0172] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0173] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0174] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0175] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0176] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0177] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0178] It should also be noted that the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0179] From the above description, it can be seen that the above-mentioned embodiments of the present application achieve the following technical effects:

[0180] 1) A joint login method based on a national secret algorithm, a server receives a third-party request sent by a client, the server is used for data transmission between the client and a third-party service, the third-party request includes a unique merchant code of the third-party service; obtain the authorization information of the third-party service according to the unique merchant code, and send the authorization information to the client, the authorization information is the type of user information required to access the third-party service; in the case that the user information corresponding to the authorization information is authorized to the third-party service, obtain the user information corresponding to the authorization information; obtain the third-party national secret algorithm corresponding to the third-party service according to the unique merchant code, and encrypt and sign the user information according to the third-party national secret algorithm to obtain the final message; obtain the API interface address of the third-party service according to the unique merchant code of the third-party service, and send a login request to the API interface address, the login request includes the final message; in the case that the third-party service receives the login request and decrypts and verifies the final message, receive the token response result of the login request of the third-party service, and send the access token in the token response result to the client, so that the client accesses the page of the third-party service, and the access token is the authentication credential of the client accessing the third-party service. The application obtains the authorization information of the third-party service on the server and feeds back to the client. After the client is authorized, the server obtains the API interface of the third-party service and sends a request, receives the access token in the request response result, and sends it to the client. The client accesses the page of the third-party service according to the access token to realize joint login. The user does not need to input login information again to complete the login operation of the third-party service. In the data transmission process, the national secret algorithm is used to encrypt the data, which ensures the security of the data transmission process, and solves the problem that the user experience of logging into the third-party service platform is poor in the prior art.

[0181] 2) A joint login device based on a national secret algorithm of the present application, a first receiving unit, for a server to receive a third-party request sent by a client, the server being used to transfer data between the client and the third-party service, the third-party request including the unique merchant code of the third-party service; a first acquiring unit, for acquiring authorization information of the third-party service according to the unique merchant code, and sending the authorization information to the client, the authorization information being the type of user information required to access the third-party service; a second acquiring unit, for acquiring the user information corresponding to the authorization information when the user information corresponding to the authorization information is authorized to the third-party service; a third acquiring unit, for acquiring the third-party service according to the unique merchant code The third-party national secret algorithm corresponding to the third-party service is used, and the user information is encrypted and signed according to the third-party national secret algorithm to obtain the final message; the first sending unit is used to obtain the API interface address of the third-party service according to the unique merchant code of the third-party service, and send a login request to the API interface address, and the login request includes the final message; the second sending unit is used to receive the token response result of the login request of the third-party service when the third-party service receives the login request and decrypts and verifies the signature of the final message, and send the access token in the token response result to the client, so that the client can access the page of the third-party service, and the access token is the authentication credential for the client to access the third-party service. This application obtains the authorization information of the third-party service on the server side and feeds it back to the client. After the client authorizes, the server side obtains the API interface of the third-party service and sends a request, and receives the access token in the request response result and sends it to the client. The client accesses the page of the third-party service according to the access token to realize joint login. The user does not need to enter the login information again to complete the operation of logging into the third-party service, and in the process of data transmission, the data is encrypted using the national secret algorithm to ensure the security of the data transmission process, solving the problem of poor user experience in logging into the third-party service platform in the existing technology.

[0182] The above description is merely a preferred embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A joint login method based on the national secret algorithm, characterized in that: include: The server receives a third-party request sent by the client, the server being used to transfer data between the client and the third-party service, the third-party request including a unique merchant code of the third-party service; Obtaining authorization information for the third-party service based on the unique merchant code, and sending the authorization information to the client, where the authorization information is the type of user information required to access the third-party service; In a case where the user information corresponding to the authorization information is authorized to the third-party service, obtaining the user information corresponding to the authorization information; Obtaining the third-party national encryption algorithm corresponding to the third-party service according to the unique merchant code, and encrypting and signing the user information according to the third-party national encryption algorithm to obtain a final message; Obtaining the API interface address of the third-party service according to the unique merchant code of the third-party service, and sending a login request to the API interface address, wherein the login request includes the final message; When the third-party service receives the login request and decrypts and verifies the signature of the final message, it receives the token response result of the login request from the third-party service, and sends the access token in the token response result to the client, so that the client can access the page of the third-party service. The access token is the authentication credential for the client to access the third-party service.

2. The method according to claim 1, characterized in that Obtaining the user information corresponding to the authorization information includes: Acquiring the user information corresponding to the authorization information in the associated system according to the authorization information, wherein the user information includes a unique user code, and the associated system is a system for managing and storing user information; The user information is parameterized and spliced ​​to form a message to be encrypted.

3. The method according to claim 2, characterized in that Obtain the third-party national secret algorithm corresponding to the third-party service based on the unique merchant code, and encrypt and sign the user information based on the third-party national secret algorithm to obtain a final message, including: Randomly generate an SM4 symmetric key, and symmetrically encrypt the message to be encrypted to obtain a first encrypted message; Asymmetrically encrypt the SM4 symmetric key according to the SM2 public key configuration of the third-party national secret algorithm to obtain a second encrypted message; Sort the parameters of the message to be encrypted in ascending order by ASCII code to obtain a string to be signed, and sign the string to be signed according to the SM2 private key to obtain a signature string; The first encrypted message, the second encrypted message and the signature string are concatenated to obtain a final message.

4. The method according to claim 3, characterized in that The process of generating the token response result includes: The third-party service receives the login request and decrypts and verifies the signature of the final message according to the third-party national encryption algorithm corresponding to the third-party service to obtain decrypted information; Generate the token response result according to the decryption information, and return the token response result to the server.

5. The method according to claim 4, characterized in that The process of the client accessing the third-party service page includes: The client obtains the front-end address of the third-party service from the server; The client accesses the front-end address according to the access token, so that the third-party service verifies whether the access token is valid, obtains a verification result, and feeds back the verification result to the server. The verification result includes a verification status and a verification time. The verification status indicates whether the access token is valid or invalid. When the verification status indicates that the access token is valid, the client successfully accesses the page of the third-party service.

6. The method according to claim 5, characterized in that In the case that the third-party service verifies that the access token is invalid, the client needs to re-authorize the authorization information of the third-party service.

7. The method according to claim 6, characterized in that The method further comprises: When the server sends the login request to the third-party service, the server records the unique user code, the unique merchant code, and the API interface address to obtain first monitoring information; When the server receives the token response result and the verification result of the third-party service, recording the response status in the token response result, the verification status and the verification time in the verification result, and obtaining second monitoring information, wherein the response status is used to reflect whether the third-party service successfully generates an access token; According to the verification status, the ratio of the number of times the access token is valid to the total number of verifications within a unit time range is counted to obtain the verification success rate; According to the verification time, the ratio of the number of times the verification time exceeds the preset threshold to the total number of verifications within a unit time range is calculated to obtain the long verification time rate; A work log is constructed according to the first monitoring information, the second monitoring information, the verification success rate, and the long verification time consumption rate.

8. The method according to claim 7, characterized in that The method further comprises: The server obtains monitoring indicators corresponding to the third-party service and determines whether the third-party service is operating normally based on the monitoring indicators, wherein the monitoring indicators are used to evaluate whether the verification success rate and the long verification time rate of the work log are within a normal range; When the verification success rate is lower than a preset threshold or the long verification time consumption rate is higher than a preset threshold, a fault alarm is sent to the third-party service.

9. The method according to claim 1, characterized in that The method further comprises: The server periodically sends a probe message to the third-party service, where the probe message is used to detect the service status of the API interface address of the third-party service.

10. A joint login device based on the national secret algorithm, characterized in that: include: A first receiving unit is configured to receive, at a server end, a third-party request sent by a client, the server end being configured to transfer data between the client and the third-party service, the third-party request including a unique merchant code of the third-party service; a first acquiring unit, configured to acquire authorization information of the third-party service according to the unique merchant code, and send the authorization information to the client, where the authorization information is the type of user information required to access the third-party service; a second acquiring unit, configured to acquire the user information corresponding to the authorization information when the user information corresponding to the authorization information is authorized to the third-party service; A third obtaining unit is configured to obtain a third-party national encryption algorithm corresponding to the third-party service according to the unique merchant code, and encrypt and sign the user information according to the third-party national encryption algorithm to obtain a final message; A first sending unit is configured to obtain an API interface address of the third-party service according to the unique merchant code of the third-party service, and send a login request to the API interface address, where the login request includes the final message; The second sending unit is used to receive the token response result of the login request of the third-party service when the third-party service receives the login request and decrypts and verifies the signature of the final message, and send the access token in the token response result to the client, so that the client can access the page of the third-party service. The access token is the authentication credential for the client to access the third-party service.

Images