Application authentication method and device, storage medium and electronic equipment

Abstract

The invention discloses an application authentication method and device, a storage medium and electronic equipment. The method relates to the field of financial science and technology, and comprises the following steps: when a target application receives an access request of a target object, sending a first authorization token to an authentication platform for authentication through the target application, authenticating the first authorization token through the authentication platform, and sending an authentication result to the target application, the first authorization token is obtained through the authentication platform; and providing a service for the target object through the target application under the condition that the authentication result represents that the authentication is passed. Through the application, the problem of low application access efficiency caused by multiple times of login verification when a user accesses different applications in related technologies is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of financial technology, in particular to an application authentication method and device, a storage medium and an electronic device. BACKGROUND

[0002] In modern enterprise information management, a unified authentication platform has become an important tool for improving user access experience and strengthening network security. However, the traditional unified authentication scheme faces many challenges in the application of C / S architecture (client / server architecture). Enterprise employees need to frequently switch between various client application programs such as security software, email systems, communication tools, etc. in their daily work. The login authentication process of each application is independent and not interconnected, resulting in repeated identity login authentication when switching between different applications, and many defects such as low authentication efficiency, poor user experience, and imperfect security mechanism.

[0003] In view of the problem that the user needs to log in multiple times when accessing different applications in the related art, resulting in low efficiency of accessing applications, an effective solution has not been proposed yet. SUMMARY

[0004] The main purpose of the present application is to provide an application authentication method and device, a storage medium and an electronic device to solve the problem that the user needs to log in multiple times when accessing different applications in the related art, resulting in low efficiency of accessing applications.

[0005] In order to achieve the above purpose, according to one aspect of the present application, an application authentication method is provided. The method comprises: when a target application receives an access request of a target object, sending a first authorization token to an authentication platform for authentication through the target application, wherein the first authorization token is obtained through the authentication platform, and the authentication platform authenticates the first authorization token and sends the authentication result to the target application; in the case that the authentication result indicates that the authentication is passed, providing services for the target object through the target application.

[0006] Further, before sending the first authorization token to the authentication platform for authentication through the target application, the method further comprises: judging whether the first authorization token exists in the target application; if the first authorization token does not exist, sending the site identifier and the address corresponding to the target application to the authentication platform, wherein the authentication platform generates the first authorization token of the target application based on the site identifier and the address; receiving the first authorization token through the target application.

[0007] Further, the sending of the site identifier and the address corresponding to the target application to the authentication platform comprises: sending, by the target application, the site identifier and the address corresponding to the target application to a trusted application, wherein the site identifier and the address corresponding to the target application are sent, by the trusted application, to the authentication platform, and the trusted application is an application authenticated based on the identity information of the target object; after the first authorization token of the target application is generated by the authentication platform based on the site identifier and the address, the method further comprises: receiving, by the target application, the first authorization token returned by the trusted application.

[0008] Further, the method further comprises: in the case that the authentication result indicates that the authentication fails, sending the site identifier and the address corresponding to the target application to the authentication platform to obtain the authorization token of the target application again.

[0009] Further, before the receiving, by the target application, of the first authorization token returned by the trusted application, the method further comprises: receiving, by the trusted application, the identity information of the target object, and sending the identity information to the authentication platform, wherein the identity information is authenticated by the authentication platform, and a second authorization token is generated by the authentication platform after the authentication succeeds; and receiving, by the trusted application, the second authorization token.

[0010] Further, the authentication, by the authentication platform, of the first authorization token comprises: judging whether the first authorization token is within a valid period, to obtain a judgment result; verifying site identifier and address information in the first authorization token, to obtain a verification result; and obtaining the authentication result according to the judgment result and the verification result.

[0011] Further, the trusted application is obtained by the following steps: determining a plurality of applications in a client corresponding to the target object; obtaining running parameter information of each application; and determining the trusted application from the plurality of applications according to the running parameter information.

[0012] To achieve the above object, according to another aspect of the present application, an application authentication device is provided. The device comprises: an authentication unit configured to send a first authorization token to an authentication platform for authentication by a target application when the target application receives an access request of a target object, wherein the first authorization token is authenticated by the authentication platform, and an authentication result is sent to the target application, and the first authorization token is obtained by the authentication platform; and a service unit configured to provide a service for the target object by the target application in the case that the authentication result indicates that the authentication succeeds.

[0013] Further, the apparatus further comprises: a judging unit, configured to judge whether the first authorization token exists in the target application before the target application sends the first authorization token to the authentication platform for authentication; a sending unit, configured to send a site identity and an address corresponding to the target application to the authentication platform if the first authorization token does not exist, wherein the authentication platform generates the first authorization token of the target application based on the site identity and the address; and a first receiving unit, configured to receive the first authorization token by the target application.

[0014] Further, the sending unit comprises: a sending module, configured to send the site identity and the address corresponding to the target application to a trusted application by the target application, wherein the trusted application sends the site identity and the address corresponding to the target application to the authentication platform, and the trusted application is an application authenticated based on the identity information of the target object; and the apparatus further comprises: a second receiving unit, configured to receive the first authorization token returned by the trusted application by the target application after the authentication platform generates the first authorization token of the target application based on the site identity and the address.

[0015] Further, the apparatus further comprises: an obtaining unit, configured to send the site identity and the address corresponding to the target application to the authentication platform to obtain the authorization token corresponding to the target application again if the authentication result indicates that the authentication fails.

[0016] Further, the apparatus further comprises: a third receiving unit, configured to receive the identity information of the target object by the trusted application before the first authorization token returned by the trusted application is received by the target application, and send the identity information to the authentication platform, wherein the authentication platform authenticates based on the identity information, and generates a second authorization token after the authentication succeeds; and a fourth receiving unit, configured to receive the second authorization token by the trusted application.

[0017] Further, the authentication unit comprises: a judging module, configured to judge whether the first authorization token is within its validity period, and obtain a judgment result; a verifying module, configured to verify the site identity and the address information in the first authorization token, and obtain a verification result; and a determining module, configured to obtain the authentication result according to the judgment result and the verification result.

[0018] Further, the trusted application is obtained by the following apparatus: a first determining unit, configured to determine a plurality of applications in a client corresponding to the target object; an obtaining unit, configured to obtain running parameter information of each application; and a second determining unit, configured to determine the trusted application from the plurality of applications according to the running parameter information.

[0019] According to another aspect of the embodiments of the present application, an electronic device is also provided, comprising a memory storing an executable program, and a processor configured to execute the program, wherein the program is configured to perform any of the application authentication methods described above when executed.

[0020] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, the storage medium storing a program, wherein the program is configured to control a device in which the storage medium is located to perform any of the application authentication methods described above when executed.

[0021] In the embodiments of the present application, the following steps are adopted: when a target application receives an access request of a target object, the target application sends a first authorization token to an authentication platform for authentication, wherein the first authorization token is authenticated by the authentication platform, and the authentication result is sent to the target application, and the first authorization token is obtained through the authentication platform; and in the case that the authentication result indicates that the authentication is passed, the target application provides a service for the target object, thereby solving the technical problem of low access application efficiency caused by the need for multiple login verifications when a user accesses different applications in the related art.

[0022] In the present solution, when the target application detects an access request of the target object, the target object does not need to input a login credential, but attempts to directly initiate an authentication request to the authentication platform using the first authorization token. After receiving the first authorization token sent by the target application, the authentication platform performs validity checking, and if the authentication platform confirms that the first authorization token is valid, the authentication platform sends the result of passing the authentication back to the target application. After receiving the notification of passing the authentication, the target application can directly provide a service without the target object inputting any login information again, thereby realizing zero-intervention authentication and improving user experience and access efficiency. By introducing the concept of the first authorization token and the zero-intervention authentication mechanism, the technical bottleneck of frequent login verifications when a user switches between different applications is effectively solved, thereby achieving the technical effect of improving the access application efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings, which form a part of the present application, are intended to provide further understanding of the present application, and are used to interpret the illustrative embodiments of the present application and their descriptions, and do not constitute improper limitations to the present application. In the drawings:

[0024] Figure 1 Fig. 1 shows a hardware structure block diagram of a computer terminal for implementing an application authentication method;

[0025] Figure 2 Fig. 2 is a flowchart of an application authentication method according to an embodiment of the present application;

[0026] Figure 3is a schematic diagram of an application authentication method according to an embodiment of the present application;

[0027] Figure 4 is a schematic diagram of an application authentication device according to an embodiment of the present application;

[0028] Figure 5 is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to enable persons skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by persons skilled in the art without creative labor should fall within the scope of protection of the present application.

[0030] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to the process, method, product or device.

[0031] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present application are information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal. For example, the system and related users or institutions are provided with an interface to provide the user with a corresponding operation portal for the user to choose to agree or refuse the automatic decision result; if the user chooses to refuse, the expert decision process is entered.

[0032] Embodiment 1

[0033] According to the embodiments of the present application, a method for application authentication is also provided. It should be noted that the steps shown in the flowchart can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] The method provided by the embodiment of the present application can be executed in a mobile terminal, a computer terminal or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing the method for application authentication is shown. As shown in the figure, Figure 1 The computer terminal 10 (or mobile device) can include one or more processors 102 (the processor 102 can include but not limited to a microprocessor MCU or a programmable logic device FPGA processing device), a memory 104 for storing data, and a transmission device 106 for communication function. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports in the BUS bus), a network interface, a power supply and / or a camera. Those skilled in the art can understand, Figure 1 The structure shown is only schematic, which does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 can include more or less components than those shown in the figure, or have a different configuration from that shown in the figure. Figure 1 The structure shown is only schematic, which does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 can include more or less components than those shown in the figure, or have a different configuration from that shown in the figure. Figure 1 The structure shown is only schematic, which does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 can include more or less components than those shown in the figure, or have a different configuration from that shown in the figure.

[0035] It should be noted that the one or more processors 102 and / or other data processing circuits described above can be referred to as "data processing circuits" herein. The data processing circuit can be embodied in whole or in part as software, hardware, firmware or any other combination. In addition, the data processing circuit can be a single independent processing module, or all or part of any one of the other elements combined into the computer terminal 10 (or mobile device). As referred to in the embodiments of the present application, the data processing circuit is a processor control (for example, the selection of the variable resistance terminal path connected to the interface).

[0036] The memory 104 can be used to store software programs of application software and modules, such as program instructions / data storage devices corresponding to the application authentication method in the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, i.e. implements the application authentication method described above. The memory 104 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include memories remotely arranged with respect to the processor 102, which can be connected to the computer terminal 10 through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0037] The transmission device 106 is used to receive or send data via a network. Specific examples of the above-mentioned network can include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to be able to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

[0038] The display can be, for example, a touch screen type liquid crystal display (LCD), which can enable a user to interact with the user interface of the computer terminal 10 (or mobile device).

[0039] In the above-mentioned operating environment, the present application provides an application authentication method as shown in Figure 2 Figure 2 is a flowchart of the application authentication method according to Embodiment One of the present application. The application authentication method includes:

[0040] Step S201, when the target application receives an access request of a target object, the target application sends a first authorization token to the authentication platform for authentication, wherein the first authorization token is authenticated by the authentication platform, and the authentication result is sent to the target application, and the first authorization token is obtained through the authentication platform.

[0041] Optionally, when the target application receives an access request of a user (i.e. the above-mentioned target object), the target application does not require the user to input a username and a password, but uses the first authorization token for automatic authentication. It should be noted that the first authorization token can be issued by the authentication platform in the previous trusted application login process of the user and stored in the target application.

[0042] ​The target application sends the first authorization token to the authentication platform to request verification of its validity. The authentication platform authenticates the token, including but not limited to time verification, application identification verification, and client IP verification, to confirm that the token is owned by a legitimate holder and is used in an appropriate environment. If the token passes the authentication platform verification, the authentication platform returns a successful authentication signal and necessary user information to the target application, allowing the target application to immediately serve the user without the user having to manually log in again.

[0043] The first authorization token not only replaces the direct transmission of traditional username and password, reducing the risk of sensitive information spreading on the network, but also increases security through encryption and time-limited design. The authentication process of the authentication platform ensures the legitimacy and validity of the token, preventing unauthorized access and token theft.

[0044] In step S202, if the authentication result indicates that the authentication is passed, the target application provides services for the target object.

[0045] Optionally, after receiving the authentication result returned by the authentication platform, if the result indicates that the authentication is passed (i.e., the first authorization token is valid), the target application will immediately enter the service providing mode without the user needing to perform any additional operations or inputs. The above steps reduce the user's operation complexity in a multi-application environment, reduce the pop-up of the login interface, make the workflow more coherent, and are conducive to improving the user's satisfaction with the system and the frequency of use.

[0046] In summary, when the target application detects an access request from the target object, the target object does not need to input login credentials, but attempts to use the first authorization token to directly initiate an authentication request to the authentication platform. After receiving the first authorization token from the target application, the authentication platform performs validity checks. If the authentication platform confirms that the first authorization token is valid, the authentication platform sends a result indicating that the authentication is passed back to the target application. After receiving the notification that the authentication is passed, the target application can directly provide services without the target object needing to input any login information again, achieving zero-intervention authentication and improving user experience and access efficiency. By introducing the concept of the first authorization token and the zero-intervention authentication mechanism, the technical bottleneck of the user needing to frequently log in and verify when switching between different applications is effectively solved, thereby achieving the technical effect of improving the efficiency of accessing applications.

[0047] Optionally, in the application authentication method provided in the embodiments of the present application, before the first authorization token is sent to the authentication platform by the target application for authentication, the method further comprises: judging whether the first authorization token exists in the target application; if the first authorization token does not exist, sending the site identifier and the address corresponding to the target application to the authentication platform, wherein the first authorization token of the target application is generated by the authentication platform based on the site identifier and the address; and receiving the first authorization token by the target application.

[0048] In an optional embodiment, the target application checks whether an effective first authorization token has been stored in the target application. If the effective first authorization token does not exist in the target application, the site identifier and the address corresponding to the target application are sent to the authentication platform. After receiving the site identifier and the address corresponding to the target application, the authentication platform can identify the specific application identity of the requestor and the current working environment, and then generate the first authorization token of the target application. After receiving the first authorization token from the authentication platform, the target application stores the first authorization token locally for subsequent use.

[0049] By automatically requesting and generating the first authorization token, the need for manual intervention is reduced, the workload of the operation and maintenance personnel is reduced, and the problem of token loss or invalidation caused by improper user operation is avoided, thereby effectively reducing the cost of system maintenance.

[0050] Optionally, in the application authentication method provided in the embodiments of the present application, sending the site identifier and the address corresponding to the target application to the authentication platform comprises: sending the site identifier and the address corresponding to the target application to a trusted application by the target application, wherein the site identifier and the address corresponding to the target application are sent to the authentication platform by the trusted application, and the trusted application is an application that has been authenticated based on the identity information of the target object; and after the first authorization token of the target application is generated by the authentication platform based on the site identifier and the address, the method further comprises: receiving the first authorization token returned by the trusted application by the target application.

[0051] In an optional embodiment, the target application sends the site identifier and the client address information of the target application to the trusted application in the absence of the first authorization token. After receiving the information of the target application, the trusted application, as an application trusted by the user and authenticated by the unified authentication platform, forwards the information to the authentication platform together with the authorization state of the trusted application. It should be noted that the trusted application is a secure bridge, which not only carries the request of the target application, but also provides additional credibility for the request by using the existing authentication state.

[0052] The authentication platform generates a first authorization token of the target application based on the received site identification, address information, and authentication status of the trusted application. This token contains specific information of the target application and encrypted data for authentication and authorization, ensuring its effectiveness and security within the target application. The generated first authorization token is returned to the trusted application, and finally, the first authorization token is forwarded to the target application by the trusted application.

[0053] In an optional embodiment, the target application can also call the authorization interface of the trusted application through the authorization component, and upload the application site identification and client IP to request cross-application authorization. The trusted application uploads the user authorization token, trusted application site identification, trusted application IP, other application site identification, and client IP requesting authorization, calls the authorization token service of the unified authentication platform. The unified authentication platform verifies the validity of the authorization token, trusted application site identification, and trusted application IP, generates an authorization token, records the IP and application site identification granted by the authorization token, and returns the authorization token. The trusted application obtains the authorization token and returns it to the target application through the authorization component.

[0054] By introducing the trusted application as a relay, the target application can indirectly obtain the authorization token through the authentication platform, avoiding direct transmission of authentication information, reducing potential security risks, reducing the complexity of user operations, and improving user experience and convenience.

[0055] Optionally, in the application authentication method provided in the embodiments of the present application, the method further comprises: in the case that the authentication result indicates that the authentication is not passed, the site identification and address corresponding to the target application are sent to the authentication platform to obtain the authorization token corresponding to the target application again.

[0056] In an optional embodiment, when the target application receives the authentication result returned by the authentication platform, and the authentication result indicates that the authentication is not passed, the first authorization token currently held by the target application may have expired, been tampered with, or have other security problems, and cannot be used for access of the target application. In order to solve the problem of authentication failure, the target application re-sends its own site identification and client address information to the authentication platform. By submitting the site identification and address information, the target application is actually initiating a request to the authentication platform, requiring a new and valid authorization token to be generated for the current authentication process. After receiving the request of the target application, the authentication platform will generate a new first authorization token based on the latest user state and environment information, and send it back to the target application. After receiving the newly generated first authorization token, the target application will store and use it in subsequent authentication requests. For the current access request, the target application will also use this new token to initiate an authentication request to the authentication platform again to ensure that the user can successfully log in and start using the application.

[0057] Through the above steps, even if the authentication fails, a new first authorization token can be quickly generated, so that the user regains the access permission to the application in the shortest time, ensuring the continuity of the business process.

[0058] Optionally, in the application authentication method provided in the embodiments of the present application, before receiving the first authorization token returned by the trusted application through the target application, the method further comprises: receiving identity information of a target object through the trusted application, and sending the identity information to an authentication platform, wherein the authentication platform performs authentication based on the identity information, and generates a second authorization token after the authentication is passed; and receiving the second authorization token through the trusted application.

[0059] In an optional embodiment, when there is no valid first authorization token stored in the target application, a trusted application is introduced to assist in completing the user identity authentication process to generate a new authorization token. The trusted application first receives the identity information of the target object (i.e., the user). It should be noted that the user's identity information includes but is not limited to a username and a password, and can also include other verification credentials such as biometric data or a second credential for two-factor authentication.

[0060] The trusted application forwards the identity information of the target object (i.e., the user) to the unified authentication platform. The unified authentication platform, as the core component responsible for user identity verification, can perform an authentication process based on the received identity information. After receiving the user identity information, the authentication platform performs multi-dimensional verification, including but not limited to the accuracy of the identity information, the status check of the user account, and the compliance of the password strength and other security policies. This process aims to ensure the authenticity and security of the user's identity. After confirming the user's identity, the authentication platform generates a second authorization token and sends it to the trusted application for subsequent generation of authorization tokens for other applications by the trusted application.

[0061] Through the combination of the trusted application and the authentication platform, smooth switching of the user between different applications is ensured without interrupting the operation or waiting for a long authentication process, improving the efficiency of accessing the application.

[0062] Optionally, in the application authentication method provided in the embodiments of the present application, the authentication of the first authorization token by the authentication platform comprises: determining whether the first authorization token is within its valid period to obtain a determination result; verifying the site identifier and address information in the first authorization token to obtain a verification result; and obtaining an authentication result according to the determination result and the verification result.

[0063] In an optional embodiment, after the authentication platform receives the first authorization token, it first checks whether the first authorization token is within its set valid period. This is a basic step to ensure the security of the token, because an expired token should not be used to access any system or service, preventing potential security vulnerabilities.

[0064] In addition to checking the validity period of the token, the authentication platform also verifies the site identification (i.e., the unique identifier of the application) and address information (client IP) contained in the token. This process is to confirm the source and intent of the token, ensuring that the token is issued for the specific application being requested for access and its legitimate client location, preventing the token from being misused across applications or across locations. The authentication platform analyzes the results of the above two steps comprehensively, and only when the token is both within the valid period and its site identification and address information completely match (i.e., it passes the validity period check and site / address verification), the authentication platform will determine that the first authorization token is valid, and then allow the user to access the target application.

[0065] By checking the validity period of the token, the potential risk of expired tokens is avoided, reducing the possibility of security threats, verifying the site identification and address information in the token can prevent cross-application misuse and geographical location forgery, further enhancing the security of authentication.

[0066] Optionally, in the application authentication method provided in the embodiments of the present application, the trusted application is obtained by the following steps: determining a plurality of applications in a client corresponding to a target object; obtaining running parameter information of each application; and determining a trusted application from the plurality of applications according to the running parameter information.

[0067] In an optional embodiment, first, all applications installed on the client of the target object are identified, including but not limited to office software, communication tools, professional software, etc. For each application, its running parameter information is collected. The running parameter information includes but is not limited to the application's startup frequency: high-frequency startup means that the application is in more frequent contact with the user and is more likely to be part of the user's natural login process. Usage duration: a longer usage duration indicates that the application may be online for a long time for the user, suitable for continuous authentication needs. Whether it runs independently of the browser: in order to ensure the wide applicability of cross-application authentication, especially for C / S architecture applications that do not run in the browser environment, the system tends to select client applications that can directly communicate with the unified authentication platform without relying on the browser. Interface compatibility: whether the application has an interface to securely communicate with the unified authentication platform for identity verification and token exchange.

[0068] After collecting the running parameter information of all relevant applications, the data is analyzed to determine the trusted application from the plurality of applications. It should be noted that applications with high-frequency startup, long-time running, and the ability to securely access the unified authentication platform through the interface are given priority. In addition, considering security and stability, factors such as application update frequency, market feedback, etc. can also be evaluated.

[0069] By selecting frequently launched applications as trusted applications, the number of times users need to actively enter their identity information can be minimized, resulting in a smoother and faster login experience. Furthermore, applications that do not rely on a browser are better able to resist network attacks and malware threats, thus providing a more secure foundation for cross-application authentication.

[0070] In an alternative embodiment, it can be achieved through, as follows: Figure 3 The diagram illustrates application authentication, specifically including: A trusted application automatically starts upon system boot; after the user enters their username / password, they log in through the unified authentication platform and obtain an authentication token. The unified authentication platform records the application and IP address granted the authentication token, which is valid for the current day. The user opens another application, client A. The other application calls the trusted application's authorization interface through the authorization component, submitting its application site identifier and client IP address to request cross-application authorization. The trusted application submits the user's authentication token, trusted application site identifier, trusted application IP address, other application site identifier, and the requesting client IP address, calling the unified authentication platform's authorization token service. The unified authentication platform verifies the validity of the authentication token, trusted application site identifier, and trusted application IP address, generates an authorization token, records the IP address and application site identifier granted the authorization token, and returns the authorization token. The trusted application obtains the authorization token and returns it to the other application through the authorization component. After obtaining the authorization token, the other application calls the unified authentication platform's authorization token service, submitting the authorization token, application site identifier, and client IP address to verify the authorization. The unified authentication platform successfully verifies the authorization token, application site identifier, and client IP address and returns the verification result and user information. Other applications obtain the verification results and log in to the system based on the returned user information.

[0071] Through the above steps, users only need to authenticate once in trusted applications, achieving zero-intervention login when the associated application starts, and avoiding multiple password transmissions. This realizes a universal single sign-on function for desktop applications of a unified authentication C / S architecture application system.

[0072] The application authentication method provided in this application embodiment sends a first authorization token to an authentication platform for authentication when the target application receives an access request from a target object. The authentication platform authenticates the first authorization token and sends the authentication result to the target application. The first authorization token is obtained through the authentication platform. If the authentication result indicates that the authentication is successful, the target application provides services to the target object. This solves the technical problem in related technologies where users need to log in and verify multiple times when accessing different applications, resulting in low application access efficiency.

[0073] In the scheme, when the target application detects the access request of the target object, the target object does not need to input the login credential, but attempts to directly initiate an authentication request to the authentication platform using the first authorization token. After the authentication platform receives the first authorization token sent by the target application, the authentication platform performs validity check on the first authorization token. If the authentication platform confirms that the first authorization token is valid, the authentication platform sends the result of passing the authentication back to the target application. After the target application receives the notification of passing the authentication, the target application can directly provide the service without the target object inputting any login information again, thereby realizing zero-intervention authentication and improving user experience and access efficiency. By introducing the concept of the first authorization token and the zero-intervention authentication mechanism, the technical bottleneck that the user needs to frequently log in and verify when switching between different applications is effectively solved, and the technical effect of improving the access application efficiency is achieved.

[0074] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0075] Embodiment 2

[0076] The application embodiment further provides an application authentication device. It should be noted that the application authentication device of the application embodiment can be used to execute the application authentication method provided by the application embodiment. The application authentication device provided by the application embodiment is introduced as follows.

[0077] According to the application embodiment, a device for implementing the above-mentioned application authentication method is further provided, as shown in Figure 4 The device includes an authentication unit 401 and a service unit 402.

[0078] The authentication unit 401 is configured to, when the target application receives the access request of the target object, send a first authorization token to the authentication platform for authentication through the target application, wherein the first authorization token is authenticated by the authentication platform, and the authentication result is sent to the target application, and the first authorization token is obtained through the authentication platform.

[0079] The service unit 402 is configured to, in the case that the authentication result represents that the authentication is passed, provide a service for the target object through the target application.

[0080] The application authentication device provided in the embodiments of the present application is configured to, when the target application receives an access request of the target object, send a first authorization token to the authentication platform for authentication through the target application, wherein the first authorization token is authenticated by the authentication platform, and the authentication result is sent to the target application, and the first authorization token is obtained through the authentication platform; and the service unit 402 provides a service for the target object through the target application when the authentication result indicates that the authentication is passed, thereby solving the technical problem of low access application efficiency caused by the need for multiple login verifications of the user when accessing different applications in the related art.

[0081] In the present solution, when the target application detects an access request of the target object, the target object does not need to input a login credential, but attempts to directly initiate an authentication request to the authentication platform using the first authorization token. After receiving the first authorization token sent by the target application, the authentication platform performs validity checking on the first authorization token. If the authentication platform confirms that the first authorization token is valid, the authentication platform sends the result of passing the authentication back to the target application. After receiving the notification of passing the authentication, the target application can directly provide a service without the target object inputting any login information again, thereby realizing zero-intervention authentication and improving user experience and access efficiency. By introducing the concept of the first authorization token and the zero-intervention authentication mechanism, the technical bottleneck of frequent login verifications of the user when switching between different applications is effectively solved, thereby achieving the technical effect of improving the access application efficiency.

[0082] Optionally, in the application authentication device provided in the embodiments of the present application, the device further includes a judgment unit configured to judge whether the first authorization token exists in the target application before sending the first authorization token to the authentication platform for authentication through the target application; a sending unit configured to send a site identifier and an address corresponding to the target application to the authentication platform if the first authorization token does not exist, wherein the authentication platform generates the first authorization token of the target application based on the site identifier and the address; and a first receiving unit configured to receive the first authorization token through the target application.

[0083] Optionally, in the application authentication device provided in the embodiments of the present application, the sending unit includes a sending module configured to send the site identifier and the address corresponding to the target application to a trusted application through the target application, wherein the trusted application sends the site identifier and the address corresponding to the target application to the authentication platform, and the trusted application is an application authenticated based on the identity information of the target object; and the device further includes a second receiving unit configured to receive the first authorization token returned by the trusted application through the target application after the authentication platform generates the first authorization token of the target application based on the site identifier and the address.

[0084] Optionally, in the application authentication device provided by the embodiment of the application, the device further comprises an obtaining unit, configured to, in the case that the authentication result indicates that the authentication fails, send the site identifier and the address corresponding to the target application to the authentication platform, so as to obtain the authorization token corresponding to the target application again.

[0085] Optionally, in the application authentication device provided by the embodiment of the application, the device further comprises a third receiving unit, configured to receive the identity information of the target object through the trusted application before receiving the first authorization token returned by the trusted application through the target application, and send the identity information to the authentication platform, wherein the authentication platform performs authentication based on the identity information, and generates a second authorization token after the authentication passes; and a fourth receiving unit, configured to receive the second authorization token through the trusted application.

[0086] Optionally, in the application authentication device provided by the embodiment of the application, the authentication unit comprises a judging module, configured to judge whether the first authorization token is within its valid period, and obtain a judgment result; a verifying module, configured to verify the site identifier and the address information in the first authorization token, and obtain a verification result; and a determining module, configured to obtain an authentication result according to the judgment result and the verification result.

[0087] Optionally, in the application authentication device provided by the embodiment of the application, the trusted application is obtained by the following device: a first determining unit, configured to determine a plurality of applications in the client corresponding to the target object; an obtaining unit, configured to obtain the running parameter information of each application; and a second determining unit, configured to determine the trusted application from the plurality of applications according to the running parameter information.

[0088] It should be noted that the authentication unit 401 and the service unit 402 correspond to steps S201 to S203 in Embodiment 1, and the two units have the same instances and application scenarios as the corresponding steps, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above-mentioned modules or units can be hardware components or software components stored in the memory (for example, the memory 104) and processed by one or more processors (for example, the processors 102a, 102b, …, 102n), and the above-mentioned modules can also be a part of the device and can run in the computer terminal 10 provided in Embodiment 1.

[0089] Embodiment 3

[0090] The embodiments of the application can provide an electronic device, Figure 5 is a structural block diagram of an electronic device according to an embodiment of the application. As Figure 5 shown, the electronic device can include one or more Figure 5The processor 502, the memory 504, a storage controller, and a peripheral interface are shown in FIG. 5. The peripheral interface is connected with a radio frequency module, an audio module, and a display.

[0091] The memory can be used to store software programs and modules, such as program instructions / modules corresponding to the method and device in the embodiments of the present application. The processor executes various functions and data processing by running the software programs and modules stored in the memory, that is, implements the above method. The memory can include a high-speed random access memory, and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory can further include a memory remotely arranged with respect to the processor, which can be connected to the terminal through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0092] The processor can call information and application programs stored in the memory through the transmission device to execute the following steps: when the target application receives an access request of the target object, the target application sends a first authorization token to the authentication platform for authentication, wherein the first authorization token is authenticated by the authentication platform, and the authentication result is sent to the target application, and the first authorization token is obtained through the authentication platform; in the case that the authentication result represents that the authentication is passed, the target application provides services for the target object.

[0093] The processor can call information and application programs stored in the memory through the transmission device to execute the following steps: before sending the first authorization token to the authentication platform for authentication through the target application, the method further comprises: judging whether the first authorization token exists in the target application; if the first authorization token does not exist, sending the site identification and address corresponding to the target application to the authentication platform, wherein the first authorization token of the target application is generated by the authentication platform based on the site identification and address; receiving the first authorization token through the target application.

[0094] The processor can call information and application programs stored in the memory through the transmission device to execute the following steps: sending the site identification and address corresponding to the target application to the authentication platform comprises: sending the site identification and address corresponding to the target application to the trusted application through the target application, wherein the site identification and address corresponding to the target application are sent to the authentication platform through the trusted application, and the trusted application is an application authenticated based on the identity information of the target object; after the first authorization token of the target application is generated by the authentication platform based on the site identification and address, the method further comprises: receiving the first authorization token returned by the trusted application through the target application.

[0095] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: if the authentication result indicates that the authentication fails, the method further comprises: sending the site identifier and the address corresponding to the target application to the authentication platform to obtain the authorization token corresponding to the target application again.

[0096] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: before receiving the first authorization token returned by the trusted application through the target application, the method further comprises: receiving the identity information of the target object through the trusted application, and sending the identity information to the authentication platform, wherein the authentication platform performs authentication based on the identity information, and generates a second authorization token after the authentication passes; receiving the second authorization token through the trusted application.

[0097] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: the authentication of the first authorization token by the authentication platform comprises: judging whether the first authorization token is within its valid period to obtain a judgment result; verifying the site identifier and the address information in the first authorization token to obtain a verification result; obtaining an authentication result according to the judgment result and the verification result.

[0098] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: the trusted application is obtained by the following steps: determining a plurality of applications in the client corresponding to the target object; obtaining the running parameter information of each application; determining the trusted application from the plurality of applications according to the running parameter information.

[0099] Those skilled in the art can understand that, Figure 5 The structure shown is only schematic, and the electronic device can also be a terminal device such as a smart phone, a tablet computer, a palm computer, a Mobile Internet Device (MID), a PAD, etc. Figure 5 It does not limit the structure of the above-mentioned electronic device. For example, the electronic device can further include more or less components (such as a network interface, a display device, etc.) than those shown in the figure, or have a different configuration from that shown in the figure. Figure 5 It does not limit the structure of the above-mentioned electronic device. For example, the electronic device can further include more or less components (such as a network interface, a display device, etc.) than those shown in the figure, or have a different configuration from that shown in the figure. Figure 5 It does not limit the structure of the above-mentioned electronic device. For example, the electronic device can further include more or less components (such as a network interface, a display device, etc.) than those shown in the figure, or have a different configuration from that shown in the figure.

[0100] Those skilled in the art can understand that all or part of the steps in the above-mentioned embodiments can be instructed by a program to terminal device related hardware, and the program can be stored in a computer readable storage medium, which can include a flash disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, etc.

[0101] Embodiment 4

[0102] The embodiment of the present application further provides a computer readable storage medium. Optionally, in the embodiment, the storage medium can be used to save the program code executed by the application authentication method provided in the embodiment 1.

[0103] Optionally, in the embodiment, the storage medium can be located in any one of the computer terminals in the computer terminal group in the computer network, or in any one of the mobile terminals in the mobile terminal group.

[0104] The present application further provides a computer program product, which, when executed on a data processing device, is adapted to execute the steps of the application authentication method.

[0105] The serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0106] In the above embodiments of the present application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0107] In the several embodiments of the present application, it should be understood that the disclosed technology can be implemented in other ways. Of course, the embodiment described above is only a schematic, for example, the division of units is only a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, unit or module, and can be electrical or other forms.

[0108] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment.

[0109] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware, or in the form of software functional unit.

[0110] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0111] The above is only the preferred embodiment of the present application, and it should be pointed out that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. An application authentication method characterized by, The method comprises the following steps: When a target application receives an access request of a target object, the target application sends a first authorization token to an authentication platform for authentication, wherein the first authorization token is obtained through the authentication platform, the authentication platform authenticates the first authorization token, and sends an authentication result to the target application; If the authentication result indicates that the authentication is passed, the target application provides a service for the target object.

2. The method of claim 1, wherein, Before the target application sends the first authorization token to the authentication platform for authentication, the method further comprises the following steps: It is judged whether the first authorization token exists in the target application; If the first authorization token does not exist, the site identifier and the address corresponding to the target application are sent to the authentication platform, wherein the authentication platform generates the first authorization token of the target application based on the site identifier and the address; The target application receives the first authorization token.

3. The method of claim 2, wherein: sending the site identifier and the address corresponding to the target application to the authentication platform comprises: sending the site identifier and the address corresponding to the target application to a trusted application through the target application, wherein the trusted application sends the site identifier and the address corresponding to the target application to the authentication platform, and the trusted application is an application authenticated based on the identity information of the target object; After the authentication platform generates the first authorization token of the target application based on the site identifier and the address, the method further comprises the following steps: The target application receives the first authorization token returned by the trusted application.

4. The method of claim 1, wherein, The method further comprises the following steps: If the authentication result indicates that the authentication is not passed, the site identifier and the address corresponding to the target application are sent to the authentication platform to obtain the authorization token corresponding to the target application again.

5. The method of claim 3, wherein, Before the target application receives the first authorization token returned by the trusted application, the method further comprises the following steps: The trusted application receives the identity information of the target object and sends the identity information to the authentication platform, wherein the authentication platform authenticates the identity information and generates a second authorization token after the authentication is passed; The trusted application receives the second authorization token.

6. The method of claim 1, wherein, Authenticating the first authorization token through the authentication platform comprises the following steps: It is judged whether the first authorization token is within its valid period, and a judgment result is obtained; The site identifier and the address information in the first authorization token are verified, and a verification result is obtained; According to the judgment result and the verification result, the authentication result is obtained.

7. The method of claim 3, wherein, The trusted application is obtained by the following steps: A plurality of applications in a client corresponding to the target object are determined; The running parameter information of each application is obtained; According to the running parameter information, the trusted application is determined from the plurality of applications.

8. An application authentication apparatus characterized by comprising: The method comprises the following steps: An authentication unit is configured to send a first authorization token to an authentication platform for authentication by a target application when the target application receives an access request of a target object, wherein the first authorization token is authenticated by the authentication platform, and an authentication result is sent to the target application. A service unit is configured to provide a service for the target object by the target application when the authentication result indicates that the authentication is passed.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored executable program, wherein the executable program controls a device where the computer readable storage medium is located to perform the application authentication method in any one of claims 1 to 7 when the executable program is executed.

10. An electronic device, comprising: comprise: a memory storing an executable program; a processor configured to execute the program, wherein the program performs the application authentication method in any one of claims 1 to 7 when the program is executed.

Images