Authorization login method and device, computer device, readable storage medium and program product

Abstract

The application relates to an authorized login method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: in response to an access request of an authorized page sent by a mobile terminal, feeding back the authorized page to the mobile terminal; the access request is sent by the mobile terminal in response to a graphic code displayed by a zero-trust client; the graphic code is generated based on parameter information in a management and control server; the parameter information at least contains an access address and a user identifier of the authorized page, and the authorized page is used for triggering a login authorization request; receiving a login authorization request sent by the mobile terminal, the login authorization request carrying an authorization code provided by a third-party platform and the user identifier; obtaining identity information corresponding to the user identifier from the third-party platform based on the authorization code, and completing the authorized login processing. The method can realize offline login authorization of the zero-trust client.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to an authorization login method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the development of network security, the application of zero-trust architecture is becoming increasingly widespread. When users access business functions under a zero-trust architecture, they usually need to authorize login to the zero-trust client through third-party applications (such as DingTalk, WeChat Work, etc.) and initiate identity authentication. The management server in the zero-trust architecture will perform identity authentication based on the user's identity information, the health status of the device corresponding to the zero-trust client, and access behavior, thereby deciding whether to grant the user access permissions.

[0003] In some enterprise scenarios, strict network access control policies may prevent users' devices from accessing the internet. Therefore, in such situations, zero-trust clients cannot authorize logins, resulting in the inability to access business functions. Summary of the Invention

[0004] Therefore, it is necessary to provide an authorization login method, apparatus, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical problems.

[0005] Firstly, this application provides an authorization login method, which is applied to a management server and includes:

[0006] In response to an access request for an authorization page sent by a mobile terminal, the authorization page is returned to the mobile terminal; the access request is sent by the mobile terminal in response to the graphic code displayed by the zero-trust client, and the graphic code is generated based on parameter information in the management server; the parameter information includes at least the access address of the authorization page and the user identifier, and the authorization page is used to trigger a login authorization request;

[0007] Receive a login authorization request sent by a mobile terminal, wherein the login authorization request carries an authorization code provided by a third-party platform and the user identifier;

[0008] Based on the authorization code, the user identifier's corresponding identity information is obtained from the third-party platform to complete the authorization login process.

[0009] In one embodiment, the method further includes:

[0010] In response to the parameter acquisition request sent by the zero-trust client, a user identifier and a device identifier corresponding to the zero-trust client are generated;

[0011] Send parameter information to the zero-trust client. The parameters include the user identifier, the device identifier, and the access address of the pre-stored authorization page.

[0012] In one embodiment, the method further includes:

[0013] Receive an authorization query request sent by the zero-trust client, the authorization query request carrying the device identifier;

[0014] Determine the user identifier corresponding to the device identifier, and query whether the identity information corresponding to the user identifier exists;

[0015] If the identity information exists, an authorization query result indicating successful authorization login is returned to the zero-trust client;

[0016] If the identity information is not available, the authorization query result indicating that the authorization login failed is sent back to the zero-trust client.

[0017] Secondly, this application also provides an authorization login method, which is applied to a zero-trust client, and the method includes:

[0018] In response to a login command, a parameter retrieval request is sent to the management server; the parameter retrieval request is used to instruct the management server to return the parameter information corresponding to the zero-trust client; wherein, the parameter information includes at least the access address of the authorization page and the user identifier;

[0019] The system receives parameter information sent by the control server, generates and displays a graphic code based on the parameter information, and uses the graphic code to enable the mobile terminal to obtain the access address of the authorization page and the user identifier, and performs authorization login processing based on the access address of the authorization page and the user identifier.

[0020] In one embodiment, the step of sending a parameter retrieval request to the management server in response to a login command includes:

[0021] In response to a login command, check the current network connectivity status;

[0022] If the network connectivity status is not connected, a parameter acquisition request is sent to the management and control server.

[0023] In one embodiment, the parameter information further includes a device identifier, and the method further includes:

[0024] Send an authorization query request to the control server, the query request carrying the device identifier;

[0025] The system receives the authorization query result sent by the management server, which is used to indicate whether the authorization login was successful.

[0026] Thirdly, this application also provides an authorization login device, which is applied to a management and control server, and the device includes:

[0027] The feedback module is used to respond to the access request for the authorization page sent by the mobile terminal and to provide feedback of the authorization page to the mobile terminal; the access request is sent by the mobile terminal in response to the graphic code displayed by the zero-trust client, and the graphic code is generated based on the parameter information in the management server; the parameter information includes at least the access address of the authorization page and the user identifier, and the authorization page is used to trigger the login authorization request;

[0028] The first receiving module is used to receive a login authorization request sent by the mobile terminal, wherein the login authorization request carries an authorization code provided by a third-party platform and the user identifier;

[0029] The authorization login module is used to obtain the identity information corresponding to the user identifier from the third-party platform based on the authorization code, and complete the authorization login process.

[0030] In one embodiment, the device further includes:

[0031] The generation module is used to generate the user identifier and device identifier corresponding to the zero-trust client in response to the parameter acquisition request sent by the zero-trust client.

[0032] The first sending module is used to send parameter information to the zero-trust client, the parameters including the user identifier, the device identifier, and the access address of the pre-stored authorization page.

[0033] In one embodiment, the device further includes:

[0034] The second receiving module is used to receive the authorization query request sent by the zero-trust client, wherein the authorization query request carries the device identifier;

[0035] The query module is used to determine the user identifier corresponding to the device identifier and to query whether the identity information corresponding to the user identifier exists.

[0036] The second sending module is used to send an authorization query result indicating successful authorization login to the zero-trust client when the identity information exists.

[0037] The second sending module is also used to send an authorization query result indicating that the authorization login failed to the zero-trust client if the identity information does not exist.

[0038] Fourthly, this application also provides an authorization login device, which is applied to a zero-trust client, and the device includes:

[0039] The first sending module is used to send a parameter acquisition request to the management server in response to a login command; the parameter acquisition request is used to instruct the management server to return the parameter information corresponding to the zero-trust client; wherein, the parameter information includes at least the access address of the authorization page and the user identifier;

[0040] The first receiving module is used to receive parameter information sent by the management and control server, generate and display a graphic code based on the parameter information; the graphic code is used to enable the mobile terminal to obtain the access address of the authorization page and the user identifier, and to perform authorization login processing based on the access address of the authorization page and the user identifier.

[0041] In one embodiment, the first sending module is specifically used for:

[0042] In response to a login command, check the current network connectivity status;

[0043] If the network connectivity status is not connected, a parameter acquisition request is sent to the management and control server.

[0044] In one embodiment, the parameter information further includes a device identifier, and the device further includes:

[0045] The second sending module is used to send an authorization query request to the control server, the query request carrying the device identifier;

[0046] The second receiving module is used to receive the authorization query result sent by the management and control server. The authorization query result is used to indicate whether the authorization login was successful.

[0047] Fifthly, this application also provides an authorized login system, including a zero-trust client and a management server; wherein:

[0048] The zero-trust client is used to send a parameter acquisition request to the management server in response to a login command; the parameter acquisition request is used to instruct the management server to return parameter information corresponding to the zero-trust client; wherein, the parameter information includes at least the access address of the authorization page and the user identifier; receiving the parameter information sent by the management server, generating and displaying a graphic code based on the parameter information;

[0049] The control server is used to respond to the access request for the authorization page sent by the mobile terminal and send the authorization page back to the mobile terminal; the access request is sent by the mobile terminal in response to the graphic code displayed by the zero-trust client, and the authorization page is used to trigger the login authorization request; receive the login authorization request sent by the mobile terminal, the login authorization request carrying the authorization code provided by the third-party platform and the user identifier; obtain the identity information corresponding to the user identifier from the third-party platform based on the authorization code, and complete the authorization login process.

[0050] Sixthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method steps of the first or second aspect described above.

[0051] In a seventh aspect, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method steps of the first or second aspect described above.

[0052] Eighthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the method steps of the first or second aspect described above.

[0053] The aforementioned authorization login method, device, computer equipment, computer-readable storage medium, and computer program product allow the management server to respond to an access request for an authorization page sent by a mobile terminal and provide the authorization page back to the mobile terminal. The access request is sent by the mobile terminal in response to recognizing the graphic code displayed by the zero-trust client. The graphic code is generated based on parameter information in the management server; the parameter information includes at least the access address of the authorization page and the user identifier, and the authorization page is used to trigger the login authorization request. Then, the management server can receive the login authorization request sent by the mobile terminal, which carries an authorization code and user identifier provided by a third-party platform. Based on the authorization code, the management server retrieves the identity information corresponding to the user identifier from the third-party platform to complete the authorization login process. Through this solution, the zero-trust client can display a graphic code based on parameters provided by the management server, without needing to obtain the graphic code from the third-party platform, achieving offline display of the graphic code. Furthermore, the management server can also provide an authorization page to the mobile terminal, allowing users to log in on the authorization page. Through interaction between the mobile terminal and the third-party platform, the management server obtains the authorization code from the third-party platform, and then uses this authorization code to retrieve the user's identity information from the third-party platform to complete the authorization login. In this way, even when the zero-trust client is offline, login authorization can still be performed to access business functions. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is an application environment diagram of the authorization login method in one embodiment;

[0056] Figure 2 This is a flowchart illustrating an authorization login method in one embodiment;

[0057] Figure 3 This is a flowchart illustrating the authorization login method in another embodiment;

[0058] Figure 4 This is a flowchart illustrating an example of authorized login in one embodiment;

[0059] Figure 5 This is a structural block diagram of an authorization login device in one embodiment;

[0060] Figure 6 This is a structural block diagram of the authorization login device in another embodiment;

[0061] Figure 7 This is an internal structure diagram of a terminal device in one embodiment;

[0062] Figure 8 This is a diagram of the internal structure of a server in one embodiment. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0064] The authorization login method provided in this application embodiment can be applied to, for example, Figure 1The application environment shown includes a zero-trust client 110, a management server 120, a mobile terminal 130, and a third-party platform 140. The zero-trust client can be installed on a personal computer, laptop, or other terminal device. The mobile terminal can be a smartphone, tablet, IoT device, or portable wearable device. Third-party applications, such as WeChat Work or DingTalk, can be installed on the mobile terminal. The third-party platform is a service platform for these third-party applications. The zero-trust client can communicate with the management server; the mobile terminal can communicate with both the management server and the third-party platform via a network. The management server and the third-party platform can be servers, which can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing cloud computing services; this embodiment does not limit the scope of these servers.

[0065] In one exemplary embodiment, such as Figure 2 As shown, an authorization login method is provided, which is applied to... Figure 1 Taking the management server in the example, the following steps are included:

[0066] Step 202: In response to the access request for the authorization page sent by the mobile terminal, the authorization page is sent back to the mobile terminal.

[0067] The access request is sent by the mobile terminal in response to the graphical code displayed by the zero-trust client. The graphical code is generated based on the parameter information in the management server. The parameter information includes at least the access address of the authorization page and the user identifier. The authorization page is used to trigger the login authorization request.

[0068] In this embodiment, the zero-trust client can request parameter information from the management server when the network is not connected. This parameter information is used to generate an image code. The image code can be a barcode, QR code, etc. The parameter information includes at least the access address of the authorization page and a user identifier. The authorization page is an authorization page provided by the management server, and the access address of the authorization page can be the URL (Uniform Resource Locator) of the authorization page; the user identifier is a user code generated by the management server to uniquely identify the user. The zero-trust client can generate an image code based on the obtained parameter information and then display the image code. The user can scan the image code with a mobile terminal, which can then recognize and parse the image code to obtain the access address of the authorization page and the user identifier. Then, the mobile terminal can send an access request for the authorization page to the management server based on the access address of the authorization page. After receiving the access request, the management server sends the page data of the authorization page back to the mobile terminal. A third-party application is installed on the mobile terminal.

[0069] Step 204: Receive a login authorization request sent by the mobile terminal. The login authorization request carries an authorization code and user identifier provided by the third-party platform.

[0070] In this embodiment, after receiving the page data of the authorization page, the mobile terminal can display the authorization page based on the page data. The authorization page may contain authorization options. After the user triggers the authorization option on the authorization page, the mobile device responds to the triggering operation by sending an authorization request to the third-party platform. This authorization request carries the user identifier and verification information, and is used to access the login-free authorization URL. The login-free authorization URL is the URL of the login-free function provided by the third-party platform. After the third-party IM platform verifies the IM application user based on the verification information, if the verification is successful, it sends a response message to the mobile terminal. This response message contains the authorization code and a redirection status code.

[0071] After receiving the response message, the mobile terminal parses it to obtain the authorization code redirection status code. Based on the redirection status code, the mobile terminal can send a login authorization request to the management server, which carries the authorization code and user identifier. After receiving the login authorization request, the management server can parse it to obtain the authorization code and user identifier.

[0072] Step 206: Obtain the identity information corresponding to the user identifier from the third-party platform based on the authorization code, and complete the authorization login process.

[0073] In this embodiment, the management server can use an authorization code to call the open interface of a third-party platform to obtain the user's identity information and store this identity information in correspondence with the user identifier. The management server can then complete the authorized login based on this identity information. For example, if the management server successfully obtains the identity information, it determines that the user's authorization is successful; otherwise, it determines that the user's authorization has failed.

[0074] This solution allows the zero-trust client to display graphical codes based on parameters provided by the management server, eliminating the need to obtain them from third-party platforms and enabling offline display. Furthermore, the management server can provide an authorization page to mobile terminals, allowing users to log in. Through interaction between the mobile terminal and the third-party platform, an authorization code is obtained, which is then used to retrieve the user's identity information and complete the login authorization. Thus, even when the zero-trust client is offline, authorized login can still be performed, enabling access to business functions.

[0075] Optionally, the method further includes: in response to a parameter acquisition request sent by a zero-trust client, generating a user identifier and a device identifier corresponding to the zero-trust client; sending parameter information to the zero-trust client, wherein the parameters include the user identifier, the device identifier, and the access address of a pre-stored authorization page.

[0076] In this embodiment, when the network is not connected, the zero-trust client can send a parameter acquisition request to the management server. This request may carry a client identifier, which is a pre-configured identifier in the zero-trust client. Upon receiving the parameter acquisition request, the management server can generate a user identifier and a device identifier corresponding to the zero-trust client. The user identifier can be a user code, and the device identifier can be a device code. Both the user identifier and device identifier are one-time temporary identifiers with a validity period shorter than a preset threshold, for example, 10 minutes. The user identifier and device identifier are unique within their validity period. The management server can also obtain the access address of a pre-configured authorization page and send the user identifier, device identifier, and the pre-stored access address of the authorization page as parameter information to the zero-trust client. The management server generates the user identifier and device identifier corresponding to the zero-trust client, stores them accordingly, and can delete the correspondence when the validity period expires.

[0077] Based on the above scheme, the management server can send parameter information to the zero-trust client, so that the zero-trust client can display an offline QR code based on the parameter information to realize offline login to the zero-trust client; and the user identifier and device identifier in the parameter information are one-time temporary identifiers, which can improve the security of offline login.

[0078] Optionally, the method further includes: receiving an authorization query request sent by a zero-trust client, the authorization query request carrying a device identifier; determining the user identifier corresponding to the device identifier, and querying whether there is identity information corresponding to the user identifier; if identity information exists, sending an authorization query result indicating successful authorization login to the zero-trust client; if identity information does not exist, sending an authorization query result indicating failed authorization login to the zero-trust client.

[0079] In this embodiment, after receiving the parameter information, the zero-trust client can poll the management server for authorization results. Specifically, the zero-trust client can send an authorization query request to the management server according to a preset sending period, with the authorization query request carrying a device identifier. This device identifier can uniquely identify the zero-trust client within a valid duration. The management server receives the authorization query request sent by the zero-trust client and parses it to obtain the device identifier carried in the authorization query request. Then, the management server can query in the locally cached mapping between user identifiers and device identifiers whether a user identifier corresponding to the device identifier exists. If the user identifier exists, it further queries whether the identity information corresponding to the user identifier is stored. If it exists, it sends an authorization query result indicating successful authorization login and the user's access token back to the zero-trust client; if no identity information exists, or if the user identifier corresponding to the device identifier is not found, it sends an authorization query result indicating failed authorization login to the zero-trust client. After receiving the authorization query result indicating successful authorization login and the user's access token, the zero-trust client can call the relevant zero-trust system API (Application Programming Interface) for the user to access services.

[0080] Based on the above scheme, the zero-trust client can query the authorization query result from the management server and provide feedback to the user on whether the login was successful, thereby realizing offline login of the zero-trust client.

[0081] In one exemplary embodiment, such as Figure 3 As shown, an authorization login method is provided, which is applied to... Figure 1 Taking a zero-trust client as an example, the following steps are included:

[0082] Step 302: In response to the login command, send a parameter retrieval request to the management server.

[0083] The parameter retrieval request is used to instruct the management server to return the parameter information corresponding to the zero-trust client; the parameter information includes at least the access address of the authorization page and the user identifier.

[0084] In this embodiment, when the network is not connected, the zero-trust client can send a parameter acquisition request to the management server. This request may carry a client identifier, which is a pre-configured identifier in the zero-trust client. Upon receiving the parameter acquisition request, the management server can generate a user identifier and a device identifier corresponding to the zero-trust client. The user identifier can be a user code, and the device identifier can be a device code. Both the user identifier and device identifier are one-time temporary identifiers with a validity period shorter than a preset threshold, for example, 10 minutes. The user identifier and device identifier are unique within their validity period. The management server can also obtain the access address of a pre-configured authorization page and send the user identifier, device identifier, and the pre-stored access address of the authorization page as parameter information to the zero-trust client.

[0085] Step 304: Receive parameter information sent by the management and control server, and generate and display graphic codes based on the parameter information.

[0086] The graphic code is used to enable the mobile terminal to obtain the access address and user identifier of the authorization page, and to perform authorization login processing based on the access address and user identifier of the authorization page.

[0087] In this embodiment, the zero-trust client can generate a graphical code based on the obtained parameter information and then display the graphical code. Users can scan the graphical code using a mobile terminal, which can then recognize and parse the code to obtain the access address of the authorized page and the user identifier. The mobile terminal can then send an access request for the authorized page to the management server based on the access address. Upon receiving the access request, the management server sends the page data of the authorized page back to the mobile terminal. The mobile terminal has a third-party application installed.

[0088] After receiving the page data from the authorization page, the mobile terminal can display the authorization page based on that data. This authorization page may contain authorization options. When a user triggers an authorization option on the authorization page, the mobile device responds by sending an authorization request to the third-party platform. This authorization request carries the user's identifier and verification information, and is used to access the login-free authorization URL. The login-free authorization URL is the URL of the login-free function provided by the third-party platform. After the third-party IM platform verifies the IM application user based on the verification information, if the verification is successful, it sends a response message to the mobile terminal. This response message contains the authorization code and a redirection status code.

[0089] After receiving the response message, the mobile terminal parses it to obtain the authorization code redirection status code. Based on this status code, the mobile terminal can send a login authorization request to the management server, carrying the authorization code and user identifier. Upon receiving the login authorization request, the management server parses it to obtain the authorization code and user identifier. The management server can then use the authorization code to call the open interface of the third-party platform to obtain the user's identity information and store this information in relation to the user identifier. The management server can then complete the authorization login based on this identity information. For example, if the management server successfully obtains the identity information, it determines that the user's authorization is successful; otherwise, it determines that the user's authorization has failed.

[0090] This solution allows the zero-trust client to display graphical codes based on parameters provided by the management server, eliminating the need to obtain them from third-party platforms and enabling offline display. Furthermore, the management server can provide an authorization page to mobile terminals, allowing users to log in. Through interaction between the mobile terminal and the third-party platform, an authorization code is obtained, which is then used to retrieve the user's identity information and complete the login authorization. Thus, even when the zero-trust client is offline, authorized login can still be performed, enabling access to business functions.

[0091] Optionally, in response to a login command, a parameter retrieval request is sent to the management server, including: in response to a login command, detecting the current network connectivity status; and if the network connectivity status is not connected, sending a parameter retrieval request to the management server.

[0092] In this embodiment, the user can launch a zero-trust client on the terminal. After launch, the zero-trust client can respond to a login command and perform network connectivity detection to obtain the current network connectivity status. If the current network connectivity status is not connected, a parameter acquisition request is sent to the management server. If the current network connectivity status is connected, a graphical code is obtained from a third-party platform for display. The login command can be a user-triggered command after the zero-trust client is launched, or it can be an automatically triggered command after the zero-trust client is launched.

[0093] This solution allows the zero-trust client to detect network connectivity and achieve offline login when the network is disconnected. When the network is connected, the traditional login process is used. This not only ensures compatibility with the traditional login process but also enables offline login for the zero-trust client, guaranteeing the normal use of business functions.

[0094] Optionally, the parameter information may also include a device identifier, and the method may further include: sending an authorization query request to the management and control server, the query request carrying the device identifier; and receiving the authorization query result sent by the management and control server, the authorization query result being used to indicate whether the authorization login was successful.

[0095] In this embodiment, after receiving the parameter information, the zero-trust client can poll the management server for authorization results. Specifically, the zero-trust client can send an authorization query request to the management server according to a preset sending period, with the authorization query request carrying a device identifier. This device identifier can uniquely identify the zero-trust client within a valid duration. The management server receives the authorization query request sent by the zero-trust client and parses it to obtain the device identifier carried in the authorization query request. Then, the management server can check in the locally cached mapping between user identifiers and device identifiers to see if a user identifier corresponding to the device identifier exists. If the user identifier exists, it further checks whether the identity information corresponding to the user identifier is stored. If it exists, it sends an authorization query result indicating successful authorization login and the user's access token to the zero-trust client; if the identity information does not exist, or if the user identifier corresponding to the device identifier is not found, it sends an authorization query result indicating failed authorization login to the zero-trust client. Optionally, the user's identity information can also be sent to the zero-trust client. In this way, after receiving the authorization query result indicating successful authorization login and the user's access token, the zero-trust client can call the API of the zero-trust system related to the user's identity information for the user to access services.

[0096] Based on the above scheme, the zero-trust client can query the authorization query result from the management server and provide feedback to the user on whether the login was successful, thereby realizing offline login of the zero-trust client.

[0097] like Figure 4 As shown in the figure, this application embodiment provides an example of an authorized login method, including the following steps:

[0098] Step 401: The zero-trust client responds to the startup command by detecting the current network connectivity status.

[0099] If the network connectivity status is not connected, proceed to step 403; if the network connectivity status is connected, proceed with the traditional login process.

[0100] Step 402: The zero-trust client sends a parameter retrieval request to the zero-trust management service.

[0101] The parameter retrieval request includes the client identifier of the zero-trust client.

[0102] Step 403: The zero-trust management server sends parameter information to the zero-trust client.

[0103] The parameter information includes the URL of the authorization page, as well as the user code and device code corresponding to the zero-trust client.

[0104] Step 404: The zero-trust client generates and displays a QR code based on the URL of the authorization page and the user code.

[0105] Step 405: The IM application on the mobile device scans the QR code displayed by the zero-trust client to obtain the URL of the authorization page and the user code.

[0106] Step 406: The IM application sends an access request for the authorization page to the zero-trust management server based on the URL of the authorization page.

[0107] Step 407: The zero-trust management server sends the page data of the authorization page to the IM application.

[0108] Step 408: The IM application displays the authorization page.

[0109] Step 409: In response to the authorization option trigger, the IM application sends an authorization request to the third-party IM platform.

[0110] The authorization request includes a user code and verification information.

[0111] Step 410: After the third-party IM platform verifies the IM application user based on the verification information, it returns the user authorization code.

[0112] Step 411: The IM application sends a login authorization request to the zero-trust management server.

[0113] The login authorization request includes an authorization code and a user code.

[0114] Step 412: The zero-trust management server uses the user authorization code to call the interface of the third-party IM platform to obtain the user's identity information and confirm that the user authorization is successful.

[0115] Step 413: The zero-trust client sends an authorization query request to the management server.

[0116] The query request includes the device code.

[0117] Step 414: The management server returns the authorization query result and access token indicating successful authorization.

[0118] Step 415: The zero-trust client calls the relevant zero-trust system API to allow users to access services.

[0119] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0120] Based on the same inventive concept, this application also provides an authorization login device for implementing the authorization login method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more authorization login device embodiments provided below can be found in the limitations of the authorization login method described above, and will not be repeated here.

[0121] In one exemplary embodiment, such as Figure 5 As shown, an authorization login device is provided for use on a management server, including:

[0122] Feedback module 510 is used to respond to an access request for an authorization page sent by a mobile terminal and to provide feedback of the authorization page to the mobile terminal; the access request is sent by the mobile terminal in response to the graphic code displayed by the zero-trust client, and the graphic code is generated based on parameter information in the management server; the parameter information includes at least the access address of the authorization page and the user identifier, and the authorization page is used to trigger a login authorization request;

[0123] The first receiving module 520 is used to receive a login authorization request sent by a mobile terminal, wherein the login authorization request carries an authorization code provided by a third-party platform and the user identifier;

[0124] The authorization login module 530 is used to obtain the identity information corresponding to the user identifier from the third-party platform based on the authorization code, and complete the authorization login process.

[0125] In one embodiment, the device further includes:

[0126] The generation module is used to generate the user identifier and device identifier corresponding to the zero-trust client in response to the parameter acquisition request sent by the zero-trust client.

[0127] The first sending module is used to send parameter information to the zero-trust client, the parameters including the user identifier, the device identifier, and the access address of the pre-stored authorization page.

[0128] In one embodiment, the device further includes:

[0129] The second receiving module is used to receive the authorization query request sent by the zero-trust client, wherein the authorization query request carries the device identifier;

[0130] The query module is used to determine the user identifier corresponding to the device identifier and to query whether the identity information corresponding to the user identifier exists.

[0131] The second sending module is used to send an authorization query result indicating successful authorization login to the zero-trust client when the identity information exists.

[0132] The second sending module is also used to send an authorization query result indicating that the authorization login failed to the zero-trust client if the identity information does not exist.

[0133] In one exemplary embodiment, such as Figure 6 As shown, an authorization login device is provided for use in zero-trust clients, including:

[0134] The first sending module 610 is used to send a parameter acquisition request to the management server in response to a login command; the parameter acquisition request is used to instruct the management server to return the parameter information corresponding to the zero-trust client; wherein, the parameter information includes at least the access address of the authorization page and the user identifier;

[0135] The first receiving module 620 is used to receive parameter information sent by the control server, generate and display a graphic code based on the parameter information; the graphic code is used to enable the mobile terminal to obtain the access address of the authorization page and the user identifier, and to perform authorization login processing based on the access address of the authorization page and the user identifier.

[0136] In one embodiment, the first sending module is specifically used for:

[0137] In response to a login command, check the current network connectivity status;

[0138] If the network connectivity status is not connected, a parameter acquisition request is sent to the management and control server.

[0139] In one embodiment, the parameter information further includes a device identifier, and the device further includes:

[0140] The second sending module is used to send an authorization query request to the control server, the query request carrying the device identifier;

[0141] The second receiving module is used to receive the authorization query result sent by the management and control server. The authorization query result is used to indicate whether the authorization login was successful.

[0142] Each module in the aforementioned authorized login device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0143] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements an authorization login method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0144] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements an authorization login method.

[0145] Those skilled in the art will understand that Figure 7 and Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0146] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method steps.

[0147] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the above method steps.

[0148] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the above-described method steps.

[0149] It should be noted that the user information (including but not limited to user device identifiers, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0150] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0151] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0152] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An authorization login method, characterized in that, The method is applied to a management and control server, and the method includes: In response to an access request for an authorization page sent by a mobile terminal, the system sends the authorization page back to the mobile terminal. The access request is sent by the mobile terminal in response to the graphical code displayed by the zero-trust client. The graphical code is generated based on parameter information in the management server. The parameter information is requested by the zero-trust client from the management server when the network is not connected, and includes at least the access address of the authorization page and the user identifier. The authorization page is used to trigger a login authorization request. The system receives a login authorization request sent by a mobile terminal. The login authorization request carries an authorization code provided by a third-party platform and the user identifier. The login authorization request is sent by the mobile terminal to the third-party platform in response to the authorization option in the authorization page. The third-party platform sends a response message containing the authorization code and a redirection status code to the mobile terminal if the verification is successful. The mobile terminal then sends the response message to the management server based on the redirection status code. Based on the authorization code, the user identifier's corresponding identity information is obtained from the third-party platform to complete the authorization login process.

2. The method according to claim 1, characterized in that, The method further includes: In response to the parameter acquisition request sent by the zero-trust client, a user identifier and a device identifier corresponding to the zero-trust client are generated; Send parameter information to the zero-trust client. The parameters include the user identifier, the device identifier, and the access address of the pre-stored authorization page.

3. The method according to claim 2, characterized in that, The method further includes: Receive an authorization query request sent by the zero-trust client, the authorization query request carrying the device identifier; Determine the user identifier corresponding to the device identifier, and query whether the identity information corresponding to the user identifier exists; If the identity information exists, an authorization query result indicating successful authorization login is returned to the zero-trust client; If the identity information is not available, the authorization query result indicating that the authorization login failed is sent back to the zero-trust client.

4. An authorization login method, characterized in that, The method is applied to zero-trust clients, and the method includes: In response to a login command, if the network is not connected, a parameter retrieval request is sent to the management server; the parameter retrieval request is used to instruct the management server to return the parameter information corresponding to the zero-trust client; wherein, the parameter information includes at least the access address of the authorization page and the user identifier; The system receives parameter information sent by the management server, generates and displays a graphical code based on the parameter information, and uses the graphical code to enable the mobile terminal to obtain the access address and user identifier of the authorization page. Based on the access address of the authorization page, it displays an authorization page containing authorization options. In response to the triggering operation of the authorization options, it sends an authorization request carrying the user identifier and verification information to a third-party platform. If the third-party platform successfully verifies the information based on the verification information, it sends a response message containing an authorization code and a redirection status code to the mobile terminal, so that the mobile terminal sends a login authorization request to the management server based on the redirection status code. The login authorization request carries the authorization code and the user identifier.

5. The method according to claim 4, characterized in that, The step of responding to the login command by sending a parameter retrieval request to the management server includes: In response to a login command, check the current network connectivity status; If the network connectivity status is not connected, a parameter acquisition request is sent to the management and control server.

6. The method according to claim 4, characterized in that, The parameter information also includes a device identifier, and the method further includes: Send an authorization query request to the control server, the query request carrying the device identifier; The system receives the authorization query result sent by the management server, which is used to indicate whether the authorization login was successful.

7. An authorization login device, characterized in that, The device is used in a management and control server, and the device includes: The feedback module is used to respond to an access request for an authorization page sent by a mobile terminal and to provide feedback of the authorization page to the mobile terminal. The access request is sent by the mobile terminal in response to the identification of the graphic code displayed by the zero-trust client. The graphic code is generated based on parameter information in the management server. The parameter information is requested by the zero-trust client from the management server when the network is not connected, and includes at least the access address of the authorization page and the user identifier. The authorization page is used to trigger a login authorization request. The first receiving module is used to receive a login authorization request sent by a mobile terminal. The login authorization request carries an authorization code provided by a third-party platform and the user identifier. The login authorization request is sent by the mobile terminal to the third-party platform in response to the authorization option triggering operation. The third-party platform sends a response message containing the authorization code and a redirection status code to the mobile terminal if the verification is successful based on the verification information. The mobile terminal sends the response message to the management server based on the redirection status code. The authorization login module is used to obtain the identity information corresponding to the user identifier from the third-party platform based on the authorization code, and complete the authorization login process.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 3 or claims 4 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3 or claims 4 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3 or claims 4 to 6.

Images