One-key login method and equipment based on authentication code shared by multiple applications, and medium

Abstract

The invention relates to a one-key login method and device based on an authentication code shared by multiple applications, and a medium, and the method applied to an operator SDK of a terminal comprises the steps: reading a digital certificate under the condition that a call request sent by any target application is received; sending an authentication request carrying the digital certificate to the TA application; receiving an authentication result returned by the TA application in response to the authentication request, and acquiring a current cellular network address under the condition that the authentication result is that authentication is passed; generating an authentication code query request according to the current cellular network address, and sending the authentication code query request to the TA application; receiving an authentication code check result returned by the TA application in response to the authentication code query request, and executing a target strategy matched with the authentication code check result to obtain an effective authentication code and a mobile phone mask through the target strategy; and sending the effective authentication code and the mobile phone mask to the target application. The problem of low login efficiency caused by low utilization rate of the authentication code is solved.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a one-click login method, device and medium based on a multi-application shared authentication code. Background Technology

[0002] In the scenario of one-click login with a mobile phone number on a smartphone, the core process is that the application calls the relevant components provided by the operator to initiate a data request to the operator's backend service. The operator obtains the user's mobile phone number from the cellular network connection and calculates the authentication code. The application's backend service then uses the authentication code to obtain the complete mobile phone number from the operator, and finally completes the login.

[0003] However, existing technologies still have significant drawbacks. On the one hand, applications generally do not frequently trigger user logins, and authentication codes have a short validity period, resulting in extremely low utilization rates of authentication codes cached by individual applications, thus having a limited effect on improving the overall efficiency and success rate of one-click login. On the other hand, the authentication code caches of each application are independent of each other. Even if multiple applications run on the same terminal, they cannot share cached valid authentication codes. Each application still needs to send a separate pre-fetch number request to the operator upon its first login, which not only increases network interaction overhead but also increases the probability of pre-fetch number failure due to the complexity of the network environment, reducing login efficiency and affecting the user login experience.

[0004] There is currently no effective solution to the problem of low login efficiency caused by the low usage rate of authentication codes. Summary of the Invention

[0005] This application provides a one-click login method, device, and medium based on a shared authentication code across multiple applications to solve the aforementioned technical problem of "low login efficiency due to low authentication code usage".

[0006] According to one aspect of the embodiments of this application, this application provides a one-click login method based on a shared authentication code across multiple applications, applied to a terminal's operator SDK. The method includes: upon receiving a call request from any target application, reading a digital certificate; sending an authentication request carrying the digital certificate to a Trusted Application (TA); receiving an authentication result returned by the TA in response to the authentication request, and if the authentication result is successful, obtaining the current cellular network address; generating an authentication code query request based on the current cellular network address, and sending the authentication code query request to the TA; receiving an authentication code verification result returned by the TA in response to the authentication code query request, and executing a target policy matching the authentication code verification result to obtain a valid authentication code and a phone mask through the target policy, wherein the valid authentication code can be shared and reused by multiple applications within the terminal; and sending the valid authentication code and the phone mask to the target application, so that the target application performs a one-click login operation based on the valid authentication code and the phone mask.

[0007] Optionally, a target strategy matching the authentication code verification result is executed, including: if the authentication code verification result indicates that a valid authentication code exists in the TA application, then an authentication code reuse strategy is executed; if the authentication code verification result indicates that a valid authentication code does not exist in the TA application, then an authentication code writing strategy is executed.

[0008] Optionally, an authentication code reuse strategy is implemented, including: extracting the valid authentication code and the mobile phone mask from the authentication code verification result.

[0009] Optionally, the authentication code writing strategy includes: sending a pre-fetching request to the backend service so that the backend service can calculate a valid authentication code based on the mobile phone number; receiving pre-fetching data returned by the backend service in response to the pre-fetching request, wherein the pre-fetching data includes a valid authentication code, an authentication code validity period, and a mobile phone mask; generating a write request based on the pre-fetching data using the current cellular network address as the key; and sending a write request to the TA application to write the pre-fetching data to the TA application.

[0010] According to one aspect of the embodiments of this application, this application provides a one-click login method based on a shared authentication code for multiple applications, applied to a TA application in a trusted execution environment of a terminal. The method includes: upon receiving an authentication request sent by an operator SDK, verifying the validity of the digital certificate in the authentication request, obtaining and returning an authentication result to the operator SDK, wherein the operator SDK is invoked by the target application to initiate a one-click login operation; if the authentication result is successful, receiving an authentication code query request sent by the operator SDK; extracting the current cellular network address from the authentication code query request, and querying whether there is a valid authentication code corresponding to the current cellular network address, obtaining an authentication code verification result; if the authentication code verification result is successful, sending the authentication code verification result containing the valid authentication code to the operator SDK, so that the operator SDK can pass the target authentication code to the target application, and the target application completes one-click login through the target authentication code.

[0011] Optionally, query whether a valid authentication code corresponding to the current cellular network address exists, and obtain the authentication code verification result, including: if a first authentication code corresponding to the current cellular network address exists and the first authentication code is valid, the authentication code verification result is verification passed, and the first authentication code is determined as a valid authentication code; if a second authentication code corresponding to the current cellular network address exists and the second authentication code is invalid, or if no authentication code corresponding to the current cellular network address exists, the authentication code verification result is verification failed.

[0012] Optionally, after obtaining the authentication code verification result, the method further includes: if the authentication code verification result is a verification failure, sending the authentication code verification result to the operator SDK; upon receiving a write request sent by the operator SDK, extracting pre-fetched number data from the write request, wherein the pre-fetched number data includes a valid authentication code, an authentication code validity period, and a mobile phone mask; and storing the pre-fetched number data.

[0013] Optionally, after extracting the current cellular network address, the method further includes: comparing the current cellular network address with its own stored cached address; if the current cellular network address is different from the cached address, deleting the cached authentication code data corresponding to the cached address.

[0014] According to another aspect of the embodiments of this application, this application provides a one-click login device based on a shared authentication code for multiple applications, applied to the operator SDK of a terminal. The device includes: a reading module, used to read a digital certificate upon receiving a call request sent by any target application; a first sending module, used to send an authentication request carrying the digital certificate to the TA application; a first receiving module, used to receive the authentication result returned by the TA application in response to the authentication request, and obtain the current cellular network address if the authentication result is successful; a generating module, used to generate an authentication code query request based on the current cellular network address, and send the authentication code query request to the TA application; an execution module, used to receive the authentication code verification result returned by the TA application in response to the authentication code query request, and execute a target policy matching the authentication code verification result to obtain a valid authentication code and a phone mask through the target policy, wherein the valid authentication code can be shared and reused by multiple applications within the terminal; and a second sending module, used to send the valid authentication code and the phone mask to the target application, so that the target application performs a one-click login operation based on the valid authentication code and the phone mask.

[0015] According to another aspect of the embodiments of this application, this application provides a one-click login device based on a shared authentication code for multiple applications, applied to a TA application in a trusted execution environment of a terminal. The device includes: a verification module, used to verify the validity of a digital certificate in an authentication request sent by an operator SDK, and to obtain and return an authentication result to the operator SDK, wherein the operator SDK is called by the target application to initiate a one-click login operation; a second receiving module, used to receive an authentication code query request sent by the operator SDK if the authentication result is successful; an extraction module, used to extract the current cellular network address from the authentication code query request, and to query whether there is a valid authentication code corresponding to the current cellular network address, thereby obtaining an authentication code verification result; and a third sending module, used to send an authentication code verification result containing a valid authentication code to the operator SDK if the authentication code verification result is successful, so that the operator SDK can pass the target authentication code to the target application, and the target application can complete the one-click login using the target authentication code.

[0016] According to another aspect of the embodiments of this application, this application provides an electronic device, including a memory, a processor, a communication interface and a communication bus. The memory stores a computer program that can run on the processor. The memory and the processor communicate with each other through the communication bus and the communication interface. When the processor executes the computer program, it implements the steps of the above method.

[0017] According to another aspect of the embodiments of this application, this application also provides a computer-readable medium having processor-executable non-volatile program code that causes the processor to perform the above-described method.

[0018] Compared with related technologies, the technical solutions provided in this application have the following advantages: This application provides a one-click login method based on a shared authentication code across multiple applications, applied to a terminal's operator SDK. The method includes: upon receiving a call request from any target application, reading a digital certificate; sending an authentication request carrying the digital certificate to the target application; receiving the authentication result returned by the target application in response to the authentication request, and if the authentication result is successful, obtaining the current cellular network address; generating an authentication code query request based on the current cellular network address, and sending the authentication code query request to the target application; receiving the authentication code verification result returned by the target application in response to the authentication code query request, and executing a target policy matching the authentication code verification result to obtain a valid authentication code and a phone mask through the target policy, wherein the valid authentication code can be shared and reused by multiple applications within the terminal; and sending the valid authentication code and the phone mask to the target application, so that the target application performs a one-click login operation based on the valid authentication code and the phone mask.

[0019] After receiving a call request from the target application, the operator's SDK obtains the cellular network address information through authentication, queries the TA application's authentication code, and directly obtains the valid authentication code if one exists, eliminating the need for repeated pre-fetching. This improves the utilization rate of authentication codes, reduces network interactions, and solves the problem of low login efficiency caused by low authentication code utilization. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating an optional one-click login method based on a multi-application shared authentication code for a terminal's operator SDK, according to an embodiment of this application. Figure 2 This is a timing diagram of a single-application-based login process according to an embodiment of this application; Figure 3 This is a timing diagram of an optional login process based on an authentication code reuse strategy provided according to an embodiment of this application; Figure 4 This is a timing diagram of an optional login process based on an authentication code writing strategy provided according to an embodiment of this application; Figure 5 A flowchart illustrating an optional one-click login method based on a multi-application shared authentication code for a TA application applied to a terminal, according to an embodiment of this application; Figure 6 This is a block diagram of an optional one-click login device based on a multi-application shared authentication code for a terminal's operator SDK, provided according to an embodiment of this application. Figure 7 This is a block diagram of a one-click login device based on a multi-application shared authentication code for a TA application applied to a terminal, according to an embodiment of this application. Figure 8 This is a schematic diagram of an optional electronic device structure provided in an embodiment of this application. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] In the following description, the use of suffixes such as "module," "part," or "unit" to denote elements is solely for the purpose of illustration and has no specific meaning in itself. Therefore, "module" and "part" may be used interchangeably.

[0025] In the scenario of one-click login with a mobile phone number on a smartphone, the core process is that the application calls the relevant components provided by the operator to initiate a data request to the operator's backend service. The operator obtains the user's mobile phone number from the cellular network connection and calculates the authentication code. The application's backend service then uses the authentication code to obtain the complete mobile phone number from the operator, and finally completes the login.

[0026] However, existing technologies still have significant drawbacks. On the one hand, applications generally do not frequently trigger user logins, and authentication codes have a short validity period, resulting in extremely low utilization rates of authentication codes cached by individual applications, thus having a limited effect on improving the overall efficiency and success rate of one-click login. On the other hand, the authentication code caches of each application are independent of each other. Even if multiple applications run on the same terminal, they cannot share cached valid authentication codes. Each application still needs to send a separate pre-fetch number request to the operator upon its first login, which not only increases network interaction overhead but also increases the probability of pre-fetch number failure due to the complexity of the network environment, reducing login efficiency and affecting the user login experience.

[0027] To address the problems mentioned in the background art, according to one aspect of an embodiment of this application, a one-click login method based on a multi-application shared authentication code is provided, applied to the terminal's operator SDK (Software Development Kit), such as... Figure 1 As shown, it includes: Step 101: Upon receiving a call request from any target application, read the digital certificate; Step 102: Send an authentication request carrying a digital certificate to the TA application; Step 103: Receive the authentication result returned by the TA application in response to the authentication request, and if the authentication result is successful, obtain the current cellular network address; Step 104: Generate an authentication code query request based on the current cellular network address and send the authentication code query request to the TA application; Step 105: Receive the authentication code verification result returned by the TA application in response to the authentication code query request, and execute the target strategy that matches the authentication code verification result to obtain the valid authentication code and the mobile phone mask through the target strategy. The valid authentication code can be shared and reused by multiple applications in the terminal. Step 106: Send a valid authentication code and a mobile phone mask to the target application so that the target application can perform a one-click login operation based on the valid authentication code and the mobile phone mask.

[0028] Figure 2 The sequence diagram of the one-click login process based on a single application provided in this application is shown in the figure. The steps include: the user initiates a login operation in the application (App); the App calls the pre-fetch number method of the carrier SDK; the SDK queries its local cache: the SDK first checks whether there is already a reusable authentication code cached locally in the application; if not, it sends a pre-fetch number request to the carrier's backend service; the carrier's backend service returns the authentication code and phone mask; the SDK caches these locally in the application (App) and then returns the result to the App; the App launches the authorization page to display the phone mask; after the user agrees to the authorization, the App sends a one-click login request to its own backend service with the authentication code; the application's backend service uses the authentication code to replace the complete phone number with the complete phone number from the carrier's backend service; after verification, the login result is returned to the App, and finally the App sends the result back to the user. In the single-application scenario, the authentication code is only cached locally in a single application and cannot be shared across applications.

[0029] This application is applicable to scenarios where multiple applications (such as App_A and App_B) within the same mobile terminal (such as a mobile phone) call the operator's SDK to initiate one-click login by mobile phone number. Through the collaboration between the SDK and the TA application in the TEE environment (Trusted Execution Environment), the secure sharing and efficient reuse of authentication codes are achieved, solving the problems of low authentication code usage and insufficient login efficiency in the existing technology.

[0030] When any target application within the terminal (such as App_A's first login or App_B's subsequent login) triggers a one-click login operation, it will send a pre-fetch number call request to the integrated carrier SDK. After receiving the request, the SDK will immediately read its built-in digital certificate (a trusted CA (Certificate Authority) digital certificate), which is issued by the carrier or a trusted third-party organization to prove the legitimacy of the SDK.

[0031] The SDK encapsulates the trusted CA digital certificate it reads into an authentication request (i.e., a PKI (Public Key Infrastructure) authentication request) and sends it to the TA application in the terminal TEE environment. The purpose of the PKI authentication request is to allow the TA application to verify the legitimacy of the SDK and only allow compliant SDKs to access the authentication code data stored in the TA.

[0032] After receiving the authentication request, the TA application verifies the validity of the trusted CA digital certificate (e.g., whether the certificate has expired or was issued by a legitimate authority) and returns the authentication result to the SDK. If the authentication result is successful, the SDK immediately obtains the terminal's current "current cellular network address" (i.e., current cellular network IP), which will be used as an index for subsequent queries and storage of authentication codes.

[0033] Using the current cellular network IP as an index, an authentication code query request is generated and sent to the TA application. The authentication code query request is used to check whether the TA application stores an authentication code associated with the current cellular network IP that is still valid.

[0034] After the TA application queries, it returns the authentication code verification result to the SDK. The SDK then executes the matching target strategy based on the result. Regardless of the target strategy executed, the final valid authentication code can be shared and reused by multiple applications within the terminal.

[0035] The obtained valid authentication code and phone mask are returned to the target application. After receiving them, the target application launches an authorization login page to display the phone mask and user agreement. After the user authorizes, the application sends a login request to its own backend service with the authentication code. The application's backend service then uses the authentication code to replace the complete phone number with the operator's backend service, thus completing one-click login.

[0036] This application uses an SDK to encapsulate all core logic and interaction with the TA application. Each application in the terminal does not need to develop complex functions such as TEE interaction and authentication code management. It can achieve one-click login simply by calling the interface, which simplifies development costs and improves application access efficiency.

[0037] As an optional embodiment, the target strategy that matches the authentication code verification result is executed, including: if the authentication code verification result indicates that a valid authentication code exists in the TA application, then an authentication code reuse strategy is executed; if the authentication code verification result indicates that a valid authentication code does not exist in the TA application, then an authentication code writing strategy is executed.

[0038] If the verification result indicates the existence of a valid authentication code, the authentication code reuse strategy is executed. For example, when App_B queries, the authentication code written by App_A during a previous query is already stored in the TA application.

[0039] If the first application in the terminal logs in for the first time, or if the authentication code stored in the TA has expired or been cleared due to a change in the cellular network IP, then there will be no valid authentication code in the TA application.

[0040] If the verification result indicates that no valid authentication code exists, the authentication code writing strategy will be executed. For example, when App_A is querying for the first time, the TA application does not store an authentication code.

[0041] Based on the actual status of the authentication code in the TA application, determine whether a valid authentication code exists and dynamically execute the corresponding target strategy.

[0042] As an optional implementation, an authentication code reuse strategy is implemented, including: extracting a valid authentication code and a mobile phone mask from the authentication code verification result.

[0043] The prerequisite for implementing the authentication code reuse strategy is that a valid authentication code has already been written into the TA application. The writing steps are described below.

[0044] The authentication code reuse strategy involves directly extracting the valid authentication code and phone mask from the authentication code verification result. There's no need to initiate an additional pre-fetching request to the operator's backend service, because this valid authentication code is a shared resource of the TA application, which was previously pre-fetched from the operator via the SDK and written to the TA application using the then-current cellular network IP address as the key. The SDK only needs to extract the existing valid authentication code and phone mask from the verification result to complete the reuse.

[0045] The authentication code reuse strategy eliminates the need for the SDK to send a pre-number request to the operator, the operator to calculate the authentication code, and the SDK to write the code into the TA application. It directly extracts the valid data already in the TA and avoids repeated network interactions and data calculations through shared caching, thereby simplifying the login process.

[0046] The extracted valid authentication code and mobile phone mask are returned to the target application (App_B) that is currently being called. The target application (App_B) launches the authorization login page, displays the mobile phone mask and user agreement. After the user checks the authorization and clicks login, the app sends a one-click login request to its own backend service (application backend service B) with the valid authentication code.

[0047] Application backend service B uses a valid authentication code, its own service ID, and a key to initiate a number replacement request to the operator's backend service. After the operator's backend service verifies the number, it returns the complete mobile number. Application backend service B then completes the login logic verification and returns the login result to App_B, thus completing the login process.

[0048] Figure 3 The login process based on the authentication code reuse strategy provided in this application is shown in the figure. It directly reuses the authentication code already shared in the TA. The specific steps include: the user initiates a number retrieval request in App_B, and App_B calls the number retrieval method of the operator's SDK; the SDK re-establishes a secure connection with the TA in the TEE environment and queries the authentication code cache through the same cellular network IP; the TA directly returns the stored authentication code and phone mask, and the SDK returns the result to App_B; App_B launches the authorization page to display the phone mask; after the user authorizes, App_B sends a login request to the application backend service B with the authentication code; the application backend service B replaces the phone number with the authentication code and returns the login result.

[0049] As an optional embodiment, the authentication code writing strategy includes: sending a pre-fetching request to a backend service so that the backend service calculates a valid authentication code based on the mobile phone number; receiving pre-fetching data returned by the backend service in response to the pre-fetching request, wherein the pre-fetching data includes a valid authentication code, an authentication code validity period, and a mobile phone mask; generating a write request based on the pre-fetching data using the current cellular network address as the key; and sending a write request to the TA application to write the pre-fetching data to the TA application.

[0050] This embodiment applies to scenarios where the terminal operator's SDK receives a verification result returned by the TA application but no valid authentication code exists. In such cases, the terminal operator requests pre-fetched number data from the backend service and writes it into the TA application, laying the foundation for multiple applications within the terminal to subsequently share and reuse the authentication code.

[0051] After confirming that there is no valid authentication code in the TA application, a pre-fetching request is immediately sent to the operator's backend service through the terminal's cellular network. The pre-fetching request carries relevant identification information of the terminal's cellular network, which is used by the operator's backend service to locate the user's mobile phone number. The purpose is to request the operator's backend service to calculate and generate a valid authentication code based on the user's mobile phone number.

[0052] After receiving the number retrieval request, the operator's backend service obtains the user's mobile phone number corresponding to the terminal through the cellular network connection, calculates and generates a valid authentication code based on the mobile phone number, and packages the valid authentication code, the authentication code validity period, and the mobile phone mask into number retrieval data, and returns it to the operator's SDK. The SDK receives and parses the number retrieval data to ensure the integrity of key information.

[0053] Extract the previously obtained current cellular network IP, use this IP as the key for data storage, and encapsulate the received pre-fetched number data (valid authentication code, authentication code validity period, and phone mask) as the value to generate a write request to the TA application. The key-value pair ensures that other applications can query the authentication code through the same cellular network IP.

[0054] The write request is sent to the TA application in the terminal TEE environment. After receiving the request, the TA application securely stores the pre-fetched number data in the isolated storage area of ​​the TEE environment based on the key of the current cellular network IP in the request, thus completing the establishment of the authentication code shared cache.

[0055] The authentication code written this time can be reused by other applications without having to repeatedly initiate a pre-fetching request, reducing the probability of pre-fetching failure due to complex network environments (such as weak networks or network fluctuations) and improving the overall login success rate.

[0056] Figure 4 The sequence diagram of the login process based on the authentication code writing strategy provided in this application is shown in the figure. The user initiates a number retrieval request in App_A, and App_A calls the number retrieval method of the operator's SDK. The SDK first establishes a secure connection with the TA in the TEE environment, queries the authentication code cache via the cellular network IP, and the result is "no available cache". The SDK initiates a number retrieval request to the operator's backend service, receives the returned authentication code and phone mask, and then stores the data in the TA using the cellular network IP as the key, while simultaneously returning the result to App_A. App_A launches an authorization page to display the phone mask. After the user authorizes, App_A sends a login request to the application backend service A with the authentication code. The application backend service A uses the authentication code to replace the phone number with the phone number from the operator's backend service, completes the verification, and returns the login result.

[0057] This application balances data security and SDK encapsulation. The authentication code is stored in the TA application within the TEE environment to ensure data security. Furthermore, the writing process is encapsulated within the SDK, so applications do not need to concern themselves with complex TEE interaction and data storage logic, thus lowering the barrier to entry for applications.

[0058] This application provides a one-click login method based on a shared authentication code across multiple applications, applied to a terminal's operator SDK. The method includes: upon receiving a call request from any target application, reading a digital certificate; sending an authentication request carrying the digital certificate to the target application; receiving the authentication result returned by the target application in response to the authentication request, and if the authentication result is successful, obtaining the current cellular network address; generating an authentication code query request based on the current cellular network address, and sending the authentication code query request to the target application; receiving the authentication code verification result returned by the target application in response to the authentication code query request, and executing a target policy matching the authentication code verification result to obtain a valid authentication code and a phone mask through the target policy, wherein the valid authentication code can be shared and reused by multiple applications within the terminal; and sending the valid authentication code and the phone mask to the target application, so that the target application performs a one-click login operation based on the valid authentication code and the phone mask. After receiving a call request from the target application, the operator's SDK obtains the cellular network address information through authentication, queries the TA application's authentication code, and directly obtains the valid authentication code if one exists, eliminating the need for repeated pre-fetching. This improves the utilization rate of authentication codes, reduces network interactions, and solves the problem of low login efficiency caused by low authentication code utilization.

[0059] According to another aspect of the embodiments of this application, a one-click login method based on a multi-application shared authentication code is provided, applied to a TA application in a trusted execution environment of a terminal, such as... Figure 5 As shown, it includes: Step 501: Upon receiving an authentication request from the operator SDK, verify the validity of the digital certificate in the authentication request, obtain and return the authentication result to the operator SDK. The operator SDK is called by the target application to initiate a one-click login operation. Step 502: If the authentication result is successful, receive the authentication code query request sent by the operator's SDK; Step 503: Extract the current cellular network address from the authentication code query request, and query whether there is a valid authentication code corresponding to the current cellular network address to obtain the authentication code verification result; Step 504: If the authentication code verification result is successful, send the authentication code verification result containing the valid authentication code to the operator SDK so that the operator SDK can pass the target authentication code to the target application, and the target application can complete one-click login through the target authentication code.

[0060] Upon receiving the authentication request from the operator's SDK, the SDK verifies the validity of the digital certificate (a trusted CA digital certificate built into the SDK), checking for things like whether the certificate has expired or was issued by a legitimate authority. After verification, the SDK returns the authentication result. The SDK is called by the target application within the terminal to initiate a one-click login operation.

[0061] The authentication code query request sent by the operator's SDK will only be accepted if the authentication result is successful, ensuring that only compliant SDKs can query the authentication code data.

[0062] Extract the terminal's current cellular network IP from the authentication code query request, use this IP as an index to query whether it stores a valid authentication code that is associated with it and is within its validity period, and generate the authentication code verification result.

[0063] If a valid authentication code exists, the verification result is passed, and the verification result containing the valid authentication code is sent to the SDK, so that the SDK can pass the authentication code to the target application, and the target application can complete one-click login with the authentication code.

[0064] This application's embodiments rely on the isolation features of the TEE environment and certificate verification to prevent unauthorized applications from stealing authentication codes, thus solving the security risks of authentication code storage in existing technologies. Furthermore, it supports multiple applications reusing valid authentication codes from the TA (Authentication Token), reducing duplicate pre-fetching requests and lowering the probability of pre-fetching failures due to network complexity, thereby improving one-click login efficiency.

[0065] As an optional embodiment, querying whether a valid authentication code exists corresponding to the current cellular network address and obtaining the authentication code verification result includes: if a first authentication code exists corresponding to the current cellular network address and the first authentication code is valid, the authentication code verification result is verification passed, and the first authentication code is determined as a valid authentication code; if a second authentication code exists corresponding to the current cellular network address and the second authentication code is invalid, or if no authentication code exists corresponding to the current cellular network address, the authentication code verification result is verification failed.

[0066] From the authentication code query request sent by the operator's SDK, extract the "current cellular network IP". Using this IP as the key, iterate through the authentication code data stored in the device to determine whether there is an authentication code bound to this IP.

[0067] The TA application's own cache can store the authentication code in a key-value pair format: cellular network IP - authentication code - authentication code validity period.

[0068] If a first authentication code corresponding to the current cellular network address is found, the validity period of the authentication code is extracted and compared with the current system time. If the current time is within the validity period, for example, if the validity period is 7 days and the storage time is less than 7 days from the current time, then the first authentication code is determined to be valid, the authentication code verification result is "verification passed", and the first authentication code is identified as a valid authentication code that can be shared.

[0069] If a second authentication code corresponding to the current cellular network address is found, but the current time has exceeded the validity period after comparing the current time with the validity period (e.g., the validity period is 3 days and the storage time has exceeded 3 days), then the second authentication code is determined to be invalid, and the authentication code verification result is verification failure.

[0070] Expired authentication codes are cleaned up to free up storage resources for the TA application and avoid repeated verification of invalid data during subsequent queries, thereby improving query efficiency.

[0071] If no authentication code corresponding to the current cellular network IP is found after traversing all stored data, an authentication code verification result of failure will be generated directly, such as the first login of the first application in the terminal, or the previously stored authentication code has been cleared due to IP change.

[0072] By using a dual logic of cellular network IP association and validity period comparison, it ensures that only authentication codes that match the IP and are within their validity period are deemed valid. This avoids the reuse of authentication codes that do not correspond to the current terminal network and prevents login failures caused by expired authentication codes.

[0073] Using the cellular network IP as a unique index, all applications accessing the SDK obtain the same verification result based on the same IP when querying the authentication code. This ensures that a valid authentication code can be reused by multiple applications, while an invalid authentication code cannot be used by any application, thus avoiding the problem of inconsistent authentication code statuses obtained by different applications.

[0074] As an optional embodiment, after obtaining the authentication code verification result, the method further includes: if the authentication code verification result is a verification failure, sending the authentication code verification result to the operator SDK; upon receiving a write request sent by the operator SDK, extracting pre-fetched number data from the write request, wherein the pre-fetched number data includes a valid authentication code, an authentication code validity period, and a mobile phone mask; and storing the pre-fetched number data.

[0075] After completing the authentication code query and validity verification, if the authentication code verification result is determined to be a failure, the result should be immediately sent to the operator's SDK that initiated the query, informing the SDK that there is currently no available authentication code and that it needs to be obtained again.

[0076] After receiving the verification failure result, the operator SDK sends a pre-fetch number request to the operator's backend service and obtains the pre-fetch number data, and then generates a write request carrying the data.

[0077] The write request will only be accepted if the SDK's digital certificate has been verified in the previous stage, ensuring that only compliant SDKs can write data.

[0078] Upon receiving a write request, the complete pre-fetched number data is extracted from the write request, specifically including a valid authentication code, an authentication code validity period, and a phone mask. The valid authentication code is used for subsequent application login, the authentication code validity period is used to determine whether subsequent reuse is valid, and the phone mask is used by the application to display part of the phone number to the user.

[0079] After extracting the pre-fetched number data, the current cellular network IP is used as the key, and the valid authentication code, authentication code validity period, and mobile phone mask are used as the value to construct key-value pairs and store them in a secure isolated area of ​​the TEE environment.

[0080] When storing the prefetched number data for the current cellular network IP, if there is already old authentication code data corresponding to the current cellular network IP, the old data will be overwritten synchronously to avoid the TA application storing redundant and invalid information, improve the efficiency of subsequent queries, and ensure that all stored data are the latest and valid resources.

[0081] By storing new pre-fetched authentication code data, resources are provided for subsequent applications within the terminal to reuse authentication codes, thus solving the problem of low utilization rate of authentication code caching in a single application and enhancing the value of authentication code caching.

[0082] As an optional embodiment, after extracting the current cellular network address, the method further includes: comparing the current cellular network address with its own stored cached address; if the current cellular network address is different from the cached address, then deleting the cached authentication code data corresponding to the cached address.

[0083] After receiving the authentication code query request sent by the operator's SDK, the terminal's current cellular network IP is extracted from the request. This IP is the identifier of the current terminal's SIM card (Subscriber Identity Module Card) accessing the cellular network and is strongly associated with the SIM card information.

[0084] Extract the cached address (i.e., historical cellular network IP) that was previously bound to the authentication code from the cached authentication code data stored in its own storage, and then compare the current cellular network address with the cached address to determine whether the two are the same.

[0085] Different SIM cards will be assigned different IP addresses when accessing the cellular network. If the comparison result shows that the current cellular network address is different from the cached address, it is determined that the terminal SIM card has been changed. At this time, the cached authentication code data bound to the cached address has become invalid. This authentication code corresponds to the old SIM card's phone number and cannot support the login of the new SIM card. The cached authentication code data will then be deleted.

[0086] Cellular network addresses are important identifiers for terminal SIM cards to access the operator's network. When the same terminal changes its SIM card, the operator will assign a new cellular network IP (i.e., the current cellular network address is different from the cached address). The TA application can indirectly determine whether the SIM card has changed by comparing the addresses, without having to directly read the SIM card hardware information, which complies with terminal security access restrictions.

[0087] This application provides a one-click login method based on a shared authentication code across multiple applications, applied to a Trusted Execution Environment (TA) application on a terminal. The method includes: upon receiving an authentication request from an operator SDK, verifying the validity of the digital certificate in the authentication request, obtaining and returning an authentication result to the operator SDK, wherein the operator SDK is invoked by the target application to initiate a one-click login operation; if the authentication result is successful, receiving an authentication code query request from the operator SDK; extracting the current cellular network address from the authentication code query request, and querying whether a valid authentication code corresponding to the current cellular network address exists, obtaining an authentication code verification result; if the authentication code verification result is successful, sending the authentication code verification result containing the valid authentication code to the operator SDK, so that the operator SDK can pass the target authentication code to the target application, and the target application completes one-click login using the target authentication code.

[0088] By verifying the digital certificate of the operator's SDK, after successful authentication, the system queries the cellular network address and returns a valid authentication code to the SDK for transmission to the target application. This authentication code can be shared and reused, reducing repeated pre-fetching and improving the utilization rate of the authentication code, thus solving the problem of low login efficiency caused by low utilization rate of the authentication code.

[0089] According to another aspect of the embodiments of this application, this application provides a system architecture for one-click login based on a shared authentication code across multiple applications. The system architecture includes a target application within the terminal (such as App_A, App_B), a carrier SDK, a TA application in the TEE environment, a carrier backend service, and application backend services (such as the App_A backend and App_B backend). The target application initiates a login call, and the SDK provides an authentication code acquisition service. The SDK needs to be authenticated with a certificate to access the TA, and the TA provides the SDK with authentication code query and storage services. When there is no valid authentication code, the SDK initiates a pre-fetch number request, and the carrier backend service generates and returns pre-fetch number data. The target application initiates a login request carrying the authentication code, and the application backend service is responsible for connecting with the carrier to complete the number replacement. The application backend service replaces the mobile phone number with the mobile phone number through the authentication code, which is a crucial step in "converting the authentication code into a mobile phone number," ensuring the authenticity and validity of the login identity.

[0090] According to another aspect of the embodiments of this application, this application provides a one-click login device based on a multi-application shared authentication code, applied to the terminal's operator SDK, such as... Figure 6 As shown, it includes: The reading module 601 is used to read the digital certificate upon receiving a call request from any target application; The first sending module 602 is used to send an authentication request carrying a digital certificate to the TA application; The first receiving module 603 is used to receive the authentication result returned by the TA application in response to the authentication request, and to obtain the current cellular network address if the authentication result is successful. The generation module 604 is used to generate an authentication code query request based on the current cellular network address and send the authentication code query request to the TA application. The execution module 605 is used to receive the authentication code verification result returned by the TA application in response to the authentication code query request, and execute the target strategy that matches the authentication code verification result in order to obtain the valid authentication code and the mobile phone mask through the target strategy. The valid authentication code can be shared and reused by multiple applications in the terminal. The second sending module 606 is used to send a valid authentication code and a mobile phone mask to the target application, so that the target application can perform a one-click login operation based on the valid authentication code and the mobile phone mask.

[0091] It should be noted that the reading module 601 in this embodiment can be used to execute step 101 in this application embodiment, the first sending module 602 in this embodiment can be used to execute step 102 in this application embodiment, the first receiving module 603 in this embodiment can be used to execute step 103 in this application embodiment, the generating module 604 in this embodiment can be used to execute step 104 in this application embodiment, the executing module 605 in this embodiment can be used to execute step 105 in this application embodiment, and the second sending module 606 in this embodiment can be used to execute step 106 in this application embodiment.

[0092] Optionally, execution module 605 includes: The first execution submodule is used to execute the authentication code reuse strategy if the authentication code verification result indicates that there is a valid authentication code in the TA application. The second execution submodule is used to execute the authentication code writing strategy if the authentication code verification result indicates that there is no valid authentication code in the TA application.

[0093] Optionally, the first execution submodule extracts the valid authentication code and the mobile phone mask from the authentication code verification result.

[0094] Optionally, the second execution submodule is further configured to send a pre-fetching number request to the backend service so that the backend service can calculate a valid authentication code based on the mobile phone number; receive pre-fetching number data returned by the backend service in response to the pre-fetching number request, wherein the pre-fetching number data includes a valid authentication code, an authentication code validity period, and a mobile phone mask; generate a write request based on the pre-fetching number data using the current cellular network address as the key; and send a write request to the TA application to write the pre-fetching number data to the TA application.

[0095] According to another aspect of the embodiments of this application, this application provides a one-click login device based on a multi-application shared authentication code, applied to the TA application in the trusted execution environment of a terminal, such as... Figure 7 As shown, it includes: The verification module 701 is used to verify the validity of the digital certificate in the authentication request when it receives the authentication request sent by the operator SDK, and to obtain and return the authentication result to the operator SDK. The operator SDK is called by the target application to initiate a one-click login operation. The second receiving module 702 is used to receive the authentication code query request sent by the operator SDK when the authentication result is successful. The extraction module 703 is used to extract the current cellular network address from the authentication code query request, and query whether there is a valid authentication code corresponding to the current cellular network address, and obtain the authentication code verification result. The third sending module 704 is used to send an authentication code verification result containing a valid authentication code to the operator SDK if the authentication code verification result is successful, so that the operator SDK can pass the target authentication code to the target application, and the target application can complete one-click login through the target authentication code.

[0096] It should be noted that the verification module 701 in this embodiment can be used to execute step 501 in this application embodiment, the second receiving module 702 in this embodiment can be used to execute step 502 in this application embodiment, the extraction module 703 in this embodiment can be used to execute step 503 in this application embodiment, and the third sending module 704 in this embodiment can be used to execute step 504 in this application embodiment.

[0097] Optionally, the extraction module 703 is further configured to, if there exists a first authentication code corresponding to the current cellular network address and the first authentication code is in a valid state, then the authentication code verification result is "verification passed" and the first authentication code is determined as a valid authentication code; if there exists a second authentication code corresponding to the current cellular network address and the second authentication code is in an invalid state, or if there is no authentication code corresponding to the current cellular network address, then the authentication code verification result is "verification failed".

[0098] Optionally, the device further includes a first processing module, configured to, after obtaining the authentication code verification result, send the authentication code verification result to the operator SDK if the authentication code verification result is a verification failure; upon receiving a write request sent by the operator SDK, extract the pre-fetched number data from the write request, wherein the pre-fetched number data includes a valid authentication code, an authentication code validity period, and a mobile phone mask; and store the pre-fetched number data.

[0099] Optionally, the device further includes a second processing module, which compares the current cellular network address with its own stored cached address after extracting the current cellular network address; if the current cellular network address is different from the cached address, the cached authentication code data corresponding to the cached address is deleted.

[0100] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments.

[0101] According to another aspect of the embodiments of this application, this application provides an electronic device, such as... Figure 8 As shown, it includes a memory 801, a processor 803, a communication interface 805, and a communication bus 807. The memory 801 stores a computer program that can run on the processor 803. The memory 801 and the processor 803 communicate through the communication interface 805 and the communication bus 807. When the processor 803 executes the computer program, it implements the steps of the above method.

[0102] The memory and processor in the aforementioned electronic devices communicate with each other via a communication bus and a communication interface. The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0103] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0104] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0105] According to another aspect of the embodiments of this application, a computer-readable medium having processor-executable non-volatile program code is also provided.

[0106] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0107] In specific implementation, the embodiments of this application can be referred to the above embodiments and have corresponding technical effects.

[0108] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0109] For software implementation, the techniques described herein can be implemented by units that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented in the processor or external to the processor.

[0110] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0111] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0112] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0113] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0114] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0115] If the aforementioned function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks. It should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. In the absence of further restrictions, an element defined by the phrase "comprising a..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0116] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A one-click login method based on a multi-application shared authentication code, characterized in that, The carrier SDK applied to the terminal includes: Upon receiving a call request from any target application, read the digital certificate; Send an authentication request carrying the digital certificate to the TA application; Receive the authentication result returned by the TA application in response to the authentication request, and if the authentication result is successful, obtain the current cellular network address; An authentication code query request is generated based on the current cellular network address, and the authentication code query request is sent to the TA application. The system receives the authentication code verification result returned by the TA application in response to the authentication code query request, and executes the target strategy that matches the authentication code verification result to obtain a valid authentication code and a mobile phone mask through the target strategy. The valid authentication code can be shared and reused by multiple applications within the terminal. The valid authentication code and the mobile phone mask are sent to the target application so that the target application can perform a one-click login operation based on the valid authentication code and the mobile phone mask.

2. The method according to claim 1, characterized in that, The execution of the target strategy that matches the authentication code verification result includes: If the authentication code verification result indicates that a valid authentication code exists in the TA application, then the authentication code reuse strategy is executed. If the authentication code verification result indicates that the valid authentication code does not exist in the TA application, then the authentication code writing strategy is executed.

3. The method according to claim 2, characterized in that, The execution of the authentication code reuse strategy includes: Extract the valid authentication code and the mobile phone mask from the authentication code verification result.

4. The method according to claim 2, characterized in that, The execution authentication code writing strategy includes: Send a pre-fetch number request to the backend service so that the backend service can calculate the valid authentication code based on the mobile phone number; The system receives pre-fetch data returned by the backend service in response to the pre-fetch request, wherein the pre-fetch data includes the valid authentication code, the validity period of the authentication code, and the mobile phone mask. Using the current cellular network address as the key, a write request is generated based on the pre-fetched number data; Send the write request to the TA application to write the prefetched number data to the TA application.

5. A one-click login method based on a shared authentication code across multiple applications, characterized in that, The method for applying a Trusted Execution Environment (TA) to a terminal includes: Upon receiving an authentication request from the operator's SDK, the validity of the digital certificate in the authentication request is verified, and the authentication result is obtained and returned to the operator's SDK. The operator's SDK is called by the target application to initiate a one-click login operation. If the authentication result is successful, receive the authentication code query request sent by the operator SDK; Extract the current cellular network address from the authentication code query request, and query whether there is a valid authentication code corresponding to the current cellular network address to obtain the authentication code verification result; If the authentication code verification result is successful, the authentication code verification result containing the valid authentication code is sent to the operator SDK so that the operator SDK can pass the target authentication code to the target application, and the target application can complete one-click login using the target authentication code.

6. The method according to claim 5, characterized in that, The query to determine whether a valid authentication code exists corresponding to the current cellular network address, and to obtain the authentication code verification result, includes: If a first authentication code exists corresponding to the current cellular network address and the first authentication code is valid, then the authentication code verification result is successful, and the first authentication code is determined as the valid authentication code. If a second authentication code exists corresponding to the current cellular network address and the second authentication code is invalid, or if no authentication code exists corresponding to the current cellular network address, then the authentication code verification result is a verification failure.

7. The method according to claim 6, characterized in that, After obtaining the authentication code verification result, the method further includes: If the authentication code verification result is a verification failure, then the authentication code verification result is sent to the operator SDK; Upon receiving a write request from the operator's SDK, prefetch number data is extracted from the write request, wherein the prefetch number data includes the valid authentication code, the authentication code validity period, and the mobile phone mask; Store the pre-fetched number data.

8. The method according to claim 5, characterized in that, After extracting the current cellular network address, the method further includes: The current cellular network address is compared with its own stored cached address; If the current cellular network address is different from the cached address, then the cached authentication code data corresponding to the cached address is deleted.

9. An electronic device comprising a memory, a processor, a communication interface, and a communication bus, wherein the memory stores a computer program executable on the processor, and the memory and the processor communicate via the communication bus and the communication interface, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

10. A computer-readable medium having processor-executable non-volatile program code, characterized in that, The program code causes the processor to execute the method of any one of claims 1 to 8.

Images