Login authentication method, device, equipment, medium and program product

Abstract

The invention relates to the technical field of computers, and provides a login authentication method, device and equipment, a medium and a program product, the login authentication method comprises the following steps: if a one-key login verification request is received, extracting application information and user information according to the one-key login verification request; verifying a device application corresponding to the one-key login verification request according to the application information to obtain a first verification result; generating a login state verification request according to the user information, and sending the login state verification request to a corresponding equipment authentication platform, so that the equipment authentication platform verifies the login state based on the login state verification request to obtain a second verification result; and receiving a second verification result sent by the equipment authentication platform, and performing login authentication according to the first verification result and the second verification result. According to the invention, the login authentication system authenticates the device application, and distributes the application in the login state to the corresponding device authentication platform, thereby simplifying the login authentication process.

Description

Technical Field

[0001] The present invention relates to the field of login authentication technology, and in particular to a login authentication method, device, equipment, medium and program product. Background Art

[0002] With the interconnectivity enabled by 5G technology, smart home IoT devices are experiencing rapid growth. The emergence of these new home devices is driving new application login scenarios. The platform systems of these home devices host platform applications, making application login design a critical aspect of application development and design, requiring a balance between security and usability. Currently, application login methods include traditional username and password login, SMS verification code login, and mobile terminal QR code scanning. However, these login methods are lengthy and cumbersome, and no longer meet user needs. Therefore, one-click login / silent login scenarios have become a new technological focus.

[0003] Existing one-click login / silent login solutions primarily include two approaches. One utilizes device identification information or the device's unique login information on the platform. This approach compromises security and requires the platform to have absolute trust in the application. This compromised security approach struggles to meet system requirements when user permissions and rights are compromised. The other approach relies on standard user authorization and authentication protocols, such as those based on the OIDC protocol.

[0004] Existing OIDC-based authorization and login solutions rely on device authentication platforms to provide authentication capabilities. In the application login scenario for home IoT devices, the device application must register with the device-provided one-click login platform and integrate the corresponding SDK and authentication interface provided by the device authentication platform. The device authentication platform then verifies the login user based on its own authentication, making the existing OIDC-based authorization and login process complex. Summary of the Invention

[0005] The present invention provides a login authentication method, apparatus, device, medium and program product, which are used to solve the defect of complex login authentication process in the prior art and achieve the effect of simplifying the login process based on OIDC.

[0006] The present invention provides a login authentication method, which is applied to a preset login authentication system, and the method comprises:

[0007] If a one-key login verification request is received, extracting application information and user information according to the one-key login verification request;

[0008] Verifying the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result; and

[0009] generating a login status verification request according to the user information, and sending the login status verification request to a corresponding device authentication platform, so that the device authentication platform verifies the login status based on the login status verification request to obtain a second verification result;

[0010] Receive the second verification result sent by the device authentication platform, and perform login authentication according to the first verification result and the second verification result.

[0011] According to a login authentication method provided by the present invention, performing login authentication according to the first verification result and the second verification result includes:

[0012] If both the first verification result and the second verification result indicate that the authentication is successful, receiving user login information returned by the device authentication platform;

[0013] The user login information is processed by a dynamic key to generate a first ID Token, and the first ID Token is signed. The signed first ID Token is returned to the device application, so that the device application generates a login request based on the first ID Token, and sends the login request to the application platform corresponding to the device application for login authentication.

[0014] According to a login authentication method provided by the present invention, generating a login status verification request according to the user information and sending the login status verification request to a corresponding device authentication platform includes:

[0015] Obtaining the device authentication platform ID from the user information, and obtaining the login status verification address corresponding to the device authentication platform according to the device authentication platform ID;

[0016] Generate a login status verification request according to the user information, and send the login status verification request to the login status verification address.

[0017] According to a login authentication method provided by the present invention, verifying the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result includes:

[0018] Extracting application registration information from the application information and obtaining target registration information that has completed registration; wherein the application registration information includes a client account and a client password;

[0019] The application registration information is verified using the target registration information to obtain a first verification result.

[0020] The present invention provides a login authentication method, which is applied to an application platform corresponding to a device application, and the method comprises:

[0021] Receive a login request sent by the device application, and extract a second ID Token in the login request;

[0022] Check whether the KID in the second ID Token matches the local KID;

[0023] If they match, the second ID Token is verified and decrypted using the local JWK, and the decrypted second ID Token is checked to see if it has expired, obtaining a test result.

[0024] Feedback a login authentication result to the device application based on the detection result.

[0025] According to a login authentication method provided by the present invention, after detecting whether the KID in the second ID Token matches the local KID, the method further includes:

[0026] If there is no match, a dynamic JWK is requested from the login authentication system, the second IDToken is verified and decrypted using the requested dynamic JWK, and the decrypted second ID Token is checked to see if it has expired, to obtain a detection result.

[0027] According to a login authentication method provided by the present invention, feeding back a login authentication result to the device application based on the detection result includes:

[0028] If the detection result indicates that the decrypted second ID Token has not expired, detecting whether the device ID in the second ID Token matches the device ID in the first ID Token generated by the login authentication system;

[0029] If they do not match, a login failure is fed back to the device application.

[0030] The present invention also provides a login authentication device, which is applied to a preset login authentication system, and the device includes:

[0031] an extraction module configured to extract application information and user information according to a one-key login verification request upon receiving the one-key login verification request;

[0032] a verification module configured to verify the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result; and

[0033] a generating module configured to generate a login status verification request based on the user information, and send the login status verification request to a corresponding device authentication platform, so that the device authentication platform verifies the login status based on the login status verification request to obtain a second verification result;

[0034] The login authentication module is configured to receive the second verification result sent by the device authentication platform, and perform login authentication according to the first verification result and the second verification result.

[0035] The present invention also provides a login authentication device, which is applied to an application platform corresponding to a device application, and the device includes:

[0036] a receiving module configured to receive a login request sent by the device application and extract a second ID Token from the login request;

[0037] a first detection module configured to detect whether the KID in the second ID Token matches the local KID;

[0038] A second detection module is configured to, if a match is found, verify and decrypt the second ID Token using a local JWK, and detect whether the decrypted second ID Token has expired, thereby obtaining a detection result;

[0039] A feedback module is configured to feed back a login authentication result to the device application based on the detection result.

[0040] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-described login authentication methods is implemented.

[0041] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which implements any of the above-mentioned login authentication methods when executed by a processor.

[0042] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned login authentication methods.

[0043] The present invention provides a login authentication method, apparatus, device, medium and program product. After receiving a one-click login verification request, the method extracts application information and user information according to the one-click login verification request, and then verifies the device application corresponding to the one-click login verification request according to the application information to obtain a first verification result; generates a login status verification request according to the user information, and sends the login status verification request to the corresponding device authentication platform. The device authentication platform completes the verification of the login status based on the login status verification request to obtain a second verification result, and performs login authentication according to the first verification result and the second verification result. Through the technical solution provided by the present invention, the login authentication system completes the verification of the device application, and distributes the verification of the login status to the corresponding device authentication platform, thereby enhancing the authentication capability of the login authentication, stripping away the original Access Token-related issuance and access authorization resource interaction in the OIDC protocol, simplifying the entire login process, and significantly reducing the interaction cost between the device authentication platform and the device application. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 This is a flow chart of a login authentication method provided by the present invention and applied to a preset login authentication system;

[0046] Figure 2 is an interaction diagram in an embodiment of the present invention;

[0047] Figure 3 It is a structural diagram of a login authentication system according to an embodiment of the present invention;

[0048] Figure 4 is a flow chart of step 140 in an embodiment of the present invention;

[0049] Figure 5 is a flow chart of step 130 in an embodiment of the present invention;

[0050] Figure 6 is a flow chart of step 120 in an embodiment of the present invention;

[0051] Figure 7 It is a flowchart of the interaction between the login authentication system and the device authentication platform;

[0052] Figure 8It is a flowchart of a login authentication method provided by the present invention and applied to an application platform corresponding to a device application;

[0053] Figure 9 is a flow chart of step 840 in an embodiment of the present invention;

[0054] Figure 10 Flowchart of the authentication process for a login request received by the application platform.

[0055] Figure 11 It is a structural diagram of a login authentication device provided by the present invention and applied to a preset login authentication system;

[0056] Figure 12 It is a structural diagram of a login authentication device provided by the present invention and applied to an application platform corresponding to a device application;

[0057] Figure 13 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0058] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0059] The following combination Figures 1-10 The login authentication method of the present invention is described.

[0060] Figure 1 FIG. 1 is a flow chart showing a login authentication method according to an exemplary embodiment, which is applied to a preset login authentication system. Figure 1 As shown, in an exemplary embodiment, the login authentication method includes steps 110 to 140, which are described in detail as follows:

[0061] Step 110: If a one-key login verification request is received, extract application information and user information according to the one-key login verification request.

[0062] In the embodiment of the present invention, please refer to Figure 2 , Figure 2This is a schematic diagram of the interaction of the present invention, including users, device applications, login authentication SDK, application platform, login authentication system, and device authentication platform. The device application is the application client installed on the IoT device, and the login authentication SDK is embedded in the device application. When the user requests to log in, the interaction is achieved through the login authentication SDK. The application platform is the application backend or application server corresponding to the device application, and the device authentication platform is the server with authentication capabilities, that is, the login platform corresponding to the IoT device.

[0063] See also Figure 3 The login authentication system is a system with authentication capabilities provided by the present invention, including an application registration subsystem, an OIDC authentication subsystem, and a JWK (JSON Web Key) management subsystem. Each subsystem is responsible for the related functions of application registration, core authentication, and JWK management. The specific functions are divided as follows:

[0064] The Application Registration Subsystem is primarily responsible for registering device applications and the device authentication platform information associated with the device application's login. Successful device application registration returns the client account and password used for application verification, as well as the device authentication platform ID used for user verification and distribution. Furthermore, the Application Registration Subsystem provides interfaces to support the OIDC authentication subsystem in verifying application-related information.

[0065] The OIDC authentication subsystem is primarily responsible for verifying device applications and logged-in users. IoT devices interact with the OIDC authentication subsystem through the Secure Shell (SSH) service to implement the core logic for one-click user login authentication. This authentication relies on the OIDC authentication subsystem interacting with the application registration subsystem to verify application information, and interacting with each device authentication platform to verify the logged-in user. If verification is successful, the user login information is signed and optionally encrypted using the private key provided by the JWK management subsystem to generate an ID token, which is then returned.

[0066] JWK management subsystem: Mainly responsible for the storage and update of JWK, and receiving requests from the application platform. The corresponding public key issued is used for ID Token decryption and signature verification.

[0067] The login authentication system provided in the embodiment of the present invention can reverse proxy multiple device authentication platforms, and through interaction with the device authentication platform, it can proxy the user authentication capabilities of the device authentication platform, and realize the application verification, application registration, application ID Token issuance functions, and application JWK public key update and query functions in the OIDC protocol. It enhances the authentication capabilities of traditional OIDC and enables the login authentication system to serve the one-click login scenario of multiple platforms. It decouples the business system from the authentication login, saves platform resources, and improves the business system's ability to handle business requests. At the same time, it reduces the exposure of the device authentication platform and improves the security and robustness of the system. In addition, when device applications are connected to different device authentication platforms, they can use the unified registration capabilities of the login authentication system. The device application can be connected to a unified login authentication SDK to complete one-click login registration on multiple platforms, significantly reducing the development and maintenance costs on the application side and solving the complexity of device application registration on different platforms.

[0068] like Figure 2 As shown, if the login authentication system receives a one-key login verification request, it extracts application information and user information according to the received one-key login verification request.

[0069] Specifically, the device application initiates a one-click login request based on the login authentication SDK. The one-click login request carries the client account, client password, device authentication platform ID, and relevant verification parameters when the application is registered. After receiving the one-click login request, the login authentication SDK first queries the user authorization information. If the user has not authorized it, the user of the device application is required to perform one-click login authorization. If the user authorization is successful, the user authorization status is stored. The user authorization status is valid for a specified time. If it expires, the user needs to re-authorize. After successful authorization, the login authentication SDK initiates a user one-click login verification request to the login authentication system through the device ID, device authentication platform login identifier, known application information, etc. The verification content mainly includes verification of user information and application information.

[0070] Step 120: Verify the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result.

[0071] In the embodiment of the present invention, the device application corresponding to the one-key login verification request is verified according to the extracted application information, that is, the legitimacy of the device application is verified to obtain a first verification result.

[0072] Step 130: Generate a login status verification request based on the user information, and send the login status verification request to the corresponding device authentication platform, so that the device authentication platform verifies the login status based on the login status verification request to obtain a second verification result.

[0073] In an embodiment of the present invention, a login status verification request is generated based on the extracted user information, and the login status verification request is sent to the corresponding device authentication platform. After the device authentication platform receives the login status verification request, it verifies the user's login status in the device application based on the login status verification request, that is, verifies the authenticity of the user's identity, and obtains a second verification result.

[0074] Step 140: Receive the second verification result sent by the device authentication platform, and perform login authentication according to the first verification result and the second verification result.

[0075] In the embodiment of the present invention, a second verification result sent by the device authentication platform is received, and login authentication is performed according to the first verification result and the second verification result.

[0076] In an embodiment of the present invention, after receiving a one-click login verification request, application information and user information are extracted according to the one-click login verification request, and then the device application corresponding to the one-click login verification request is verified according to the application information to obtain a first verification result; a login status verification request is generated according to the user information, and the login status verification request is sent to the corresponding device authentication platform, and the device authentication platform completes the verification of the login status based on the login status verification request to obtain a second verification result, and login authentication is performed according to the first verification result and the second verification result. Through the technical solution provided by the present invention, the login authentication system completes the verification of the device application, and distributes the verification of the login status to the corresponding device authentication platform, thereby enhancing the authentication capability of the login authentication, stripping away the original Access Token-related issuance and access authorization resource interaction in the OIDC protocol, simplifying the entire login process, and significantly reducing the interaction cost between the device authentication platform and the device application.

[0077] In an exemplary embodiment of the present invention, see Figure 4 In step 140, login authentication is performed according to the first verification result and the second verification result, including steps 410 to 420, which are described in detail as follows:

[0078] Step 410: If both the first verification result and the second verification result indicate that the authentication is successful, the user login information returned by the device authentication platform is received.

[0079] In an embodiment of the present invention, after the device authentication platform passes the login status verification, it will return the user login information to the login authentication system. If the first verification result and the second verification result both indicate that the authentication is successful, that is, the verification of the legitimacy of the device application and the authenticity of the user identity are both passed, the user login information returned by the device authentication platform is received.

[0080] In step 420, the user login information is processed using a dynamic key to generate a first ID Token, and the first ID Token is signed. The signed first ID Token is returned to the device application, so that the device application generates a login request based on the first ID Token, and sends the login request to the application platform corresponding to the device application for login authentication.

[0081] In an embodiment of the present invention, the login authentication system processes the received user login information through a dynamic key, generates a first ID Token, signs the first ID Token, and returns the signed first ID Token to the device application. Specifically, the first ID Token is first returned to the login authentication SDK, and then returned to the device application by the login authentication SDK. The device application generates a login request based on the received first ID Token, and sends the login request to the application platform corresponding to the device application for login authentication.

[0082] In an exemplary embodiment of the present invention, see Figure 5 In step 130, a login status verification request is generated according to the user information, and the login status verification request is sent to the corresponding device authentication platform, including steps 510 to 520, which are described in detail as follows:

[0083] Step 510: Obtain the device authentication platform ID in the user information, and obtain the login status verification address corresponding to the device authentication platform according to the device authentication platform ID.

[0084] In this embodiment of the present invention, the device authentication platform ID in the user information is obtained. Each device authentication platform corresponds to a login status verification address, at which the login status can be verified. After the device authentication platform is determined, the corresponding login status verification address is directly matched based on the device authentication platform ID.

[0085] Step 520: Generate a login status verification request based on the user information, and send the login status verification request to the login status verification address.

[0086] In this embodiment of the present invention, a login status verification request is generated based on user information and then sent to a login status verification address. The device authentication platform then authenticates the login status based on the received login status verification request. Specifically, the login status verification request carries a device authentication platform login identifier. The device authentication platform login identifier is verified to determine whether the user has logged in to the device authentication platform.

[0087] In an exemplary embodiment of the present invention, see Figure 6 In step 120, the device application corresponding to the one-key login verification request is verified according to the application information to obtain a first verification result, including steps 610 to 640, which are described in detail as follows:

[0088] Step 610: extract application registration information from the application information and obtain target registration information that has completed registration; wherein the application registration information includes a client account and a client password.

[0089] In this embodiment of the present invention, application registration information is extracted from the application information. The application registration information includes a client account and a client password, i.e., a user can log in to the device application using the client account and the client password. The target registration information of the registered target is obtained. The target registration information includes at least one target account and a target password, and the target account and the target password correspond to each other.

[0090] Step 620: Verify the application registration information using the target registration information to obtain a first verification result.

[0091] In the embodiment of the present invention, the client account is matched with the target account, and the client password is matched with the target password, and a first verification result is obtained based on the matching result.

[0092] Specifically, the client account number may be matched with the target account. If a target account matches the client account number, the client password may be matched with the target password of the matching target account. If the first verification result indicates that the client account number matches the target account number and the corresponding client password matches the target password, the first verification result may indicate that the verification has passed. Conversely, if the first verification result indicates that either the client account number does not match the target account number or the corresponding client password does not match the target password, the first verification result may indicate that the verification has failed.

[0093] In an exemplary embodiment of the present invention, see Figure 7 , Figure 7 This is a diagram of the interaction between the login authentication system and the device authentication platform. The application registration subsystem in the login authentication system is requested to verify the application registration information. During verification, the application registration information is checked to see if it matches the target registration information. If not, a one-click login failure is reported. If they do match, the login status verification address corresponding to the device authentication platform is requested to verify the login status and whether the user is logged in on the device authentication platform. If not, a one-click login failure is reported. If logged in, the JWK management subsystem in the login authentication system is requested to generate an ID Token and return the ID Token.

[0094] Figure 8This is a flow chart of a login authentication method according to an exemplary embodiment, which is applied to an application platform corresponding to a device application. Figure 8 As shown, in an exemplary embodiment, the login authentication method includes steps 810 to 840, which are described in detail as follows:

[0095] Step 810: Receive a login request sent by the device application, and extract a second IDToken in the login request.

[0096] In the embodiment of the present invention, as described above, after receiving the first ID Token returned by the login authentication system, the device application generates a login request. The application platform receives the login request sent by the device application and extracts the ID Token carried in the login request as the second ID Token.

[0097] Step 820: Check whether the KID in the second ID Token matches the local KID.

[0098] In the embodiment of the present invention, the KID of the JWK is locally cached as the local KID, and whether the KID in the second ID Token matches the local KID is detected.

[0099] Step 830: If there is a match, the second ID Token is verified and decrypted using the local JWK, and the decrypted second ID Token is checked to see if it has expired, obtaining a test result.

[0100] In this embodiment of the present invention, if it is detected that the KID in the second ID Token matches the local KID, the ID Token signature is directly verified and the ID Token payload is decrypted using the local JWK. After decryption, the second ID Token is checked to see if it has expired, and a detection result is obtained.

[0101] Step 840: Feedback the login authentication result to the device application based on the detection result.

[0102] In the embodiment of the present invention, the login authentication result is fed back to the device application based on the obtained detection result. Specifically, if the detection result indicates that the second ID Token has expired, a one-key login failure is directly fed back.

[0103] In an exemplary embodiment of the present invention, after detecting whether the KID in the second ID Token matches the local KID in step 820, the method further includes the following steps, which are described in detail below:

[0104] If there is no match, a dynamic JWK is requested from the login authentication system, the second ID Token is verified and decrypted using the requested dynamic JWK, and the decrypted second ID Token is checked to see if it has expired, to obtain a detection result.

[0105] In this embodiment of the present invention, if it is detected that the KID in the second ID Token does not match the local KID, the latest dynamic JWK is requested from the login authentication system, the ID Token signature is verified and the ID Token payload is decrypted using the requested dynamic JWK, and after decryption, the second ID Token is checked to see if it has expired to obtain a detection result.

[0106] In an exemplary embodiment of the present invention, see Figure 9 In step 840, the login authentication result is fed back to the device application according to the detection result, including steps 910 to 920, which are described in detail as follows:

[0107] Step 910: If the detection result indicates that the decrypted second ID Token has not expired, detect whether the device ID in the second ID Token matches the device ID in the first ID Token generated by the login authentication system.

[0108] In an embodiment of the present invention, if the detection result indicates that the second ID Token has not expired, a further detection is performed to determine whether the device ID in the second ID Token matches the device ID in the first ID Token generated by the login authentication system, thereby preventing security issues caused by the misuse of the ID Token.

[0109] Step 920: If there is no match, feedback login failure is sent to the device application.

[0110] In this embodiment of the present invention, if the device ID in the second ID Token does not match the device ID in the first ID Token generated by the login authentication system, it can be determined that the ID Token in the login request has been stolen. At this time, the second ID Token is the ID Token generated after the theft, and one-click login cannot be performed.

[0111] The existing ID TOKEN only contains device application ID information. However, the embodiment of the present invention adds device ID information to the ID TOKEN. On the application platform side, the correspondence between the ID TOKEN authorized by the user and the device ID is verified by matching the device ID in the first ID TOKEN issued by the device authentication platform with the device ID in the second ID TOKEN in the login request on the application side, thereby enhancing the reliability of the ID TOKEN data source.

[0112] In an exemplary embodiment of the present invention, see Figure 10 , Figure 10 A schematic diagram illustrating authentication of a login request received by an application platform. Upon receiving the login request, the platform retrieves the local JWK from the local cache and checks whether the KID in the second ID Token matches the local KID in the local JWK. If not, the platform calls the JWK management subsystem in the login authentication system to obtain the latest dynamic JWK. The second ID Token is then signed and decrypted, and the decrypted second ID Token is checked to see if it is within its validity period. If not, a one-click login failure is reported. If so, a match is detected between the device ID in the second ID Token and the device ID in the first ID Token generated by the login authentication system. If so, the platform retrieves the information required for login and reports a successful one-click login. If not, a one-click login failure is reported.

[0113] The following describes the login authentication device provided by the present invention. The login authentication device described below can be referenced in conjunction with the login authentication method described above. It should be noted that the device provided in the following embodiments and the method provided in the above embodiments share the same concept. The specific manner in which each module and unit performs its operations has been described in detail in the method embodiments and will not be repeated here.

[0114] In an exemplary embodiment of the present invention, see Figure 11 , Figure 11 A login authentication device applied to a preset login authentication system according to an exemplary embodiment includes:

[0115] The extraction module 1110 is configured to extract application information and user information according to the one-key login verification request upon receiving the one-key login verification request;

[0116] A verification module 1120 is configured to verify the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result; and

[0117] a generating module 1130 configured to generate a login status verification request based on the user information, and send the login status verification request to a corresponding device authentication platform, so that the device authentication platform verifies the login status based on the login status verification request to obtain a second verification result;

[0118] The login authentication module 1140 is configured to receive the second verification result sent by the device authentication platform, and perform login authentication according to the first verification result and the second verification result.

[0119] In an exemplary embodiment of the present invention, the login authentication module 1140 includes:

[0120] a return submodule configured to receive user login information returned by the device authentication platform if both the first verification result and the second verification result indicate that the authentication is successful;

[0121] The processing submodule is configured to process the user login information through a dynamic key, generate a first ID Token, sign the first ID Token, and return the signed first ID Token to the device application, so that the device application generates a login request based on the first ID Token, and sends the login request to the application platform corresponding to the device application for login authentication.

[0122] In an exemplary embodiment of the present invention, the generating module 1130 includes:

[0123] an acquisition submodule configured to obtain the device authentication platform ID in the user information, and obtain a login status verification address corresponding to the device authentication platform according to the device authentication platform ID;

[0124] The generating submodule is configured to generate a login status verification request according to the user information, and send the login status verification request to the login status verification address.

[0125] In an exemplary embodiment of the present invention, the verification module 1120 includes:

[0126] An extraction submodule configured to extract application registration information from the application information and obtain target registration information that has completed registration; wherein the application registration information includes a client account and a client password;

[0127] The verification submodule is configured to verify the application registration information using the target registration information to obtain a first verification result.

[0128] In an exemplary embodiment of the present invention, see Figure 12 , Figure 12 A login authentication apparatus for an application platform corresponding to a device application according to an exemplary embodiment includes:

[0129] The receiving module 1210 is configured to receive a login request sent by the device application and extract a second ID Token from the login request;

[0130] A first detection module 1220 is configured to detect whether the KID in the second ID Token matches the local KID;

[0131] The second detection module 1230 is configured to, if a match is found, verify and decrypt the second ID Token using the local JWK, and detect whether the decrypted second ID Token is expired, and obtain a detection result;

[0132] The feedback module 1240 is configured to feed back a login authentication result to the device application according to the detection result.

[0133] In an exemplary embodiment of the present invention, the login authentication device further includes:

[0134] The third detection module is configured to request a dynamic JWK from the login authentication system if there is a match, verify and decrypt the second ID Token using the requested dynamic JWK, and detect whether the decrypted second ID Token is expired to obtain a detection result.

[0135] In an exemplary embodiment of the present invention, the feedback module 1240 includes:

[0136] a detection submodule configured to, if the detection result indicates that the decrypted second ID Token has not expired, detect whether the device ID in the second ID Token matches the device ID in the first ID Token generated by the login authentication system;

[0137] The feedback submodule is configured to feedback login failure to the device application if there is no match.

[0138] Figure 13 An example of a physical structure diagram of an electronic device is shown below. Figure 13 As shown, the electronic device may include: a processor 1310, a communication interface 1320, a memory 830, and a communication bus 1340, wherein the processor 1310, the communication interface 1320, and the memory 1330 communicate with each other via the communication bus 1340. The processor 1310 may call the logic instructions in the memory 1330 to execute the login authentication method applied to the preset login authentication system and the login authentication method applied to the application platform corresponding to the device application;

[0139] The login authentication method applied to the preset login authentication system includes:

[0140] If a one-key login verification request is received, extracting application information and user information according to the one-key login verification request;

[0141] Verifying the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result; and

[0142] generating a login status verification request according to the user information, and sending the login status verification request to a corresponding device authentication platform, so that the device authentication platform verifies the login status based on the login status verification request to obtain a second verification result;

[0143] receiving the second verification result sent by the device authentication platform, and performing login authentication according to the first verification result and the second verification result;

[0144] The login authentication method applied to the application platform corresponding to the device application includes:

[0145] Receive a login request sent by the device application, and extract a second ID Token in the login request;

[0146] Check whether the KID in the second ID Token matches the local KID;

[0147] If they match, the second ID Token is verified and decrypted using the local JWK, and the decrypted second ID Token is checked to see if it has expired, obtaining a test result.

[0148] Feedback a login authentication result to the device application based on the detection result.

[0149] In addition, the logic instructions in the above-mentioned memory 1330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0150] On the other hand, the present invention further provides a computer program product, comprising a computer program, the computer program being storable on a non-transitory computer-readable storage medium, and wherein when the computer program is executed by a processor, the computer is capable of executing a login authentication method applied to a preset login authentication system and a login authentication method applied to an application platform corresponding to a device application;

[0151] The login authentication method applied to the preset login authentication system includes:

[0152] If a one-key login verification request is received, extracting application information and user information according to the one-key login verification request;

[0153] Verifying the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result; and

[0154] generating a login status verification request according to the user information, and sending the login status verification request to a corresponding device authentication platform, so that the device authentication platform verifies the login status based on the login status verification request to obtain a second verification result;

[0155] receiving the second verification result sent by the device authentication platform, and performing login authentication according to the first verification result and the second verification result;

[0156] The login authentication method applied to the application platform corresponding to the device application includes:

[0157] Receive a login request sent by the device application, and extract a second ID Token in the login request;

[0158] Check whether the KID in the second ID Token matches the local KID;

[0159] If they match, the second ID Token is verified and decrypted using the local JWK, and the decrypted second ID Token is checked to see if it has expired, obtaining a test result.

[0160] Feedback a login authentication result to the device application based on the detection result.

[0161] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute a login authentication method applied to a preset login authentication system and a login authentication method applied to an application platform corresponding to a device application;

[0162] The login authentication method applied to the preset login authentication system includes:

[0163] If a one-key login verification request is received, extracting application information and user information according to the one-key login verification request;

[0164] Verifying the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result; and

[0165] generating a login status verification request according to the user information, and sending the login status verification request to a corresponding device authentication platform, so that the device authentication platform verifies the login status based on the login status verification request to obtain a second verification result;

[0166] receiving the second verification result sent by the device authentication platform, and performing login authentication according to the first verification result and the second verification result;

[0167] The login authentication method applied to the application platform corresponding to the device application includes:

[0168] Receive a login request sent by the device application, and extract a second ID Token in the login request;

[0169] Check whether the KID in the second ID Token matches the local KID;

[0170] If they match, the second ID Token is verified and decrypted using the local JWK, and the decrypted second ID Token is checked to see if it has expired, obtaining a test result.

[0171] Feedback a login authentication result to the device application based on the detection result.

[0172] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0173] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A login authentication method, characterized in that: Applied to a preset login authentication system, the method includes: If a one-key login verification request is received, extracting application information and user information according to the one-key login verification request; Verifying the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result; and generating a login status verification request according to the user information, and sending the login status verification request to a corresponding device authentication platform, so that the device authentication platform verifies the login status based on the login status verification request to obtain a second verification result; Receive the second verification result sent by the device authentication platform, and perform login authentication according to the first verification result and the second verification result.

2. The login authentication method according to claim 1, wherein: The performing login authentication according to the first verification result and the second verification result includes: If both the first verification result and the second verification result indicate that the authentication is successful, receiving user login information returned by the device authentication platform; The user login information is processed by a dynamic key to generate a first ID Token, and the first ID Token is signed. The signed first ID Token is returned to the device application, so that the device application generates a login request based on the first ID Token, and sends the login request to the application platform corresponding to the device application for login authentication.

3. The login authentication method according to claim 1, wherein: Generating a login status verification request according to the user information and sending the login status verification request to a corresponding device authentication platform includes: Obtaining the device authentication platform ID from the user information, and obtaining the login status verification address corresponding to the device authentication platform according to the device authentication platform ID; Generate a login status verification request according to the user information, and send the login status verification request to the login status verification address.

4. The login authentication method according to claim 1, wherein: The verifying the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result includes: Extracting application registration information from the application information and obtaining target registration information that has completed registration; wherein the application registration information includes a client account and a client password; The application registration information is verified using the target registration information to obtain a first verification result.

5. A login authentication method, characterized in that: Applied to an application platform corresponding to a device application, the method includes: Receive a login request sent by the device application, and extract a second ID Token in the login request; Check whether the KID in the second ID Token matches the local KID; If they match, the second ID Token is verified and decrypted using the local JWK, and the decrypted second ID Token is checked to see if it has expired, obtaining a test result. Feedback a login authentication result to the device application based on the detection result.

6. The login authentication method according to claim 5, characterized in that: After detecting whether the KID in the second ID Token matches the local KID, the method further includes: If there is no match, a dynamic JWK is requested from the login authentication system, the second ID Token is verified and decrypted using the requested dynamic JWK, and the decrypted second ID Token is checked to see if it has expired, to obtain a detection result.

7. The login authentication method according to any one of claims 5 and 6, characterized in that: Feedback of a login authentication result to the device application according to the detection result includes: If the detection result indicates that the decrypted second ID Token has not expired, detecting whether the device ID in the second ID Token matches the device ID in the first ID Token generated by the login authentication system; If they do not match, a login failure is fed back to the device application.

8. A login authentication device, characterized in that: Applied to a preset login authentication system, the device includes: an extraction module configured to extract application information and user information according to a one-key login verification request upon receiving the one-key login verification request; a verification module configured to verify the device application corresponding to the one-key login verification request according to the application information to obtain a first verification result; and a generating module configured to generate a login status verification request based on the user information, and send the login status verification request to a corresponding device authentication platform, so that the device authentication platform verifies the login status based on the login status verification request to obtain a second verification result; The login authentication module is configured to receive the second verification result sent by the device authentication platform, and perform login authentication according to the first verification result and the second verification result.

9. A login authentication device, characterized in that: Applied to an application platform corresponding to a device application, the apparatus comprises: a receiving module configured to receive a login request sent by the device application and extract a second ID Token from the login request; a first detection module configured to detect whether the KID in the second ID Token matches the local KID; The second detection module is configured to, if a match is found, verify and decrypt the second ID Token using the local JWK, and detect whether the decrypted second ID Token is expired, and obtain a detection result; A feedback module is configured to feed back a login authentication result to the device application based on the detection result.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the login authentication method according to any one of claims 1 to 7 is implemented.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the login authentication method according to any one of claims 1 to 6 is implemented.

12. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the login authentication method according to any one of claims 1 to 7 is implemented.

Images