An account management system, method, device, medium and program product

Abstract

The application discloses an account management system, method, device, medium and program product, and the system comprises an application service platform and a unified authorization platform, the application service platform is in communication connection with the unified authorization platform, the application service platform is used for providing a callback address, receiving credential information fed back by the unified authorization platform and acquiring a number virtual identifier from the unified authorization platform based on the credential information, performing account registration or login according to the number virtual identifier, and the number virtual identifier is globally unique, and the unified authorization platform is used for extracting a corresponding number virtual identifier according to the credential information sent by the application service platform, and returning the number virtual identifier to the application service platform. The above technical features solve the risk of number privacy leakage.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an account management system, method, device, medium, and program product. Background Technology

[0002] Currently, users are required to provide their real mobile phone number when registering for and using various application services. The application service provider stores this number as an account identifier and user contact information.

[0003] However, in existing solutions, if the application service provider's database is attacked or illegally exported, users' real mobile phone numbers will be leaked on a large scale and then used for marketing or resale, leading to a proliferation of harassing calls and spam text messages. Summary of the Invention

[0004] This invention provides an account management system, method, device, medium, and program product to address the risk of account privacy leakage.

[0005] In a first aspect, embodiments of the present invention provide an account management system, including: an application service platform and a unified authorization platform, wherein the application service platform is communicatively connected to the unified authorization platform; The application service platform is used to provide a callback address, receive credential information fed back by the unified authorization platform, obtain a virtual identifier for a number from the unified authorization platform based on the credential information, and register or log in to an account based on the virtual identifier for a number. The virtual identifier for a number is globally unique. The unified authorization platform is used to extract the corresponding virtual identifier of the number based on the credential information sent by the application service platform, and return the virtual identifier of the number to the application service platform.

[0006] Secondly, embodiments of the present invention provide an account management method, applied to the system described in the first aspect, the method comprising: The application service platform provides a callback address to receive credential information from the unified authorization platform and obtains a virtual identifier for the number from the unified authorization platform based on the credential information. The virtual identifier for the number is then used for account registration or login. The virtual identifier for the number is globally unique. Through the unified authorization platform, the corresponding virtual identifier of the number is extracted based on the credential information sent by the application service platform, and the virtual identifier of the number is returned to the application service platform.

[0007] Thirdly, embodiments of the present invention provide an electronic device, including: At least one processor; and A memory that is communicatively connected to at least one processor; wherein, The memory stores a computer program that can be executed by at least one processor, such that the at least one processor can perform an account management method provided in the second aspect embodiment described above.

[0008] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions that are used to cause a processor to execute an account management method provided in the second aspect of the embodiments described above.

[0009] Fifthly, embodiments of the present invention provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements an account management method provided in the second aspect of the embodiments described above.

[0010] The technical solution of this invention includes an application service platform and a unified authorization platform, wherein the application service platform is communicatively connected to the unified authorization platform. The application service platform provides a callback address, receives credential information from the unified authorization platform, obtains a virtual identifier for a phone number based on the credential information, and performs account registration or login based on the virtual identifier, which is globally unique. The unified authorization platform extracts the corresponding virtual identifier for a phone number based on the credential information sent by the application service platform and returns the virtual identifier to the application service platform. This technical feature, by using a virtual identifier for a phone number instead of the user's real phone number for account registration or login, achieves the goal of making the user's real phone number available but invisible to the application service provider, thereby solving the risk of phone number privacy leakage.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of the structure of an account management system provided in an embodiment of the present invention; Figure 2 This is a flowchart of an account management method provided in an embodiment of the present invention; Figure 3This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] It is understood that before using the technical solutions disclosed in the embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the embodiments of the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0017] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium executing the operations of the technical solutions in this embodiment of the invention, based on the prompt message.

[0018] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0019] It is understood that the above notification and user authorization acquisition process is merely illustrative and does not constitute a limitation on the implementation of the embodiments of the present invention. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the embodiments of the present invention.

[0020] It is understood that the data involved in the technical solutions of the present invention (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0021] Existing solutions often suffer from risks such as number privacy leaks, limited user control over their numbers, and the problem of duplicate numbers.

[0022] If an application service provider's database is attacked or exported and sold by internal personnel, users' real mobile phone numbers will be widely leaked and subsequently used for marketing or resale, leading to a proliferation of harassing calls and spam text messages. Users cannot revoke a registered application service provider's storage and usage rights to their numbers without canceling their accounts. Even after uninstalling the application, the application service provider's server retains the user's number information and can continue to send text messages or make calls. Furthermore, users must manually modify their account bindings with application service providers every time they change their phone number, resulting in extremely high operational costs. When a mobile phone number is reclaimed by the operator and reissued to a new user, the new user cannot use that number to register for previously bound application services (resulting in a "already registered" message) and may continue to receive harassing messages intended for the original user. They may also be able to directly log into accounts already bound to the number via SMS verification codes, leading to the leakage of the previous user's information.

[0023] Based on this, embodiments of the present invention provide an account management scheme for privacy protection based on virtual identifiers of numbers, in order to solve the above problems.

[0024] In one embodiment, Figure 1 This is a schematic diagram of an account management system provided in an embodiment of the present invention. This embodiment is applicable to various application service scenarios where account management and communication interaction are based on virtual identifiers of numbers instead of real numbers. The account management system can be implemented in hardware and / or software.

[0025] like Figure 1 As shown, the system includes: an application service platform 101 and a unified authorization platform 102, with the application service platform 101 and the unified authorization platform 102 being communicatively connected; Application service platform 101 is used to provide a callback address, receive credential information fed back by unified authorization platform 102, obtain virtual identifier of number from unified authorization platform 102 based on credential information, and register or log in to account based on virtual identifier of number. Virtual identifier of number is globally unique. The unified authorization platform 102 is used to extract the corresponding virtual identifier of the number based on the credential information sent by the application service platform 101, and return the virtual identifier of the number to the application service platform 101.

[0026] The application service platform 101 can be understood as a provider of various internet, financial, and transportation application services, such as e-commerce platforms, social platforms, banking applications, mini-programs, or websites. It is responsible for providing specific business services to users and acts as the initiator of account registration, login, and communication requests in this solution. The unified authorization platform 102 can be understood as the core of the system responsible for privacy protection, handling user authentication, generation and management of Number Virtual Identifiers (NVIDs), storage of the mapping relationship between the user's real number and NVID, and communication permission verification. The callback address can be understood as a Uniform Resource Locator (URL) address provided by the application service platform to receive information returned by the unified authorization platform. The application service platform informs the unified authorization platform of this address when initiating a request, and the unified authorization platform returns the credential information to the application service platform through this callback address after processing the request. When an application service platform initiates a request, it also carries an application service identifier. This identifier can be understood as a unique identity (AppID) assigned by the unified authorization platform to each registered application service platform. It is used to distinguish different application service providers in subsequent interactions, ensuring a one-to-one correspondence between NVIDs and application service platforms. Credential information can be understood as information returned by the unified authorization platform to the application service platform, used to directly or indirectly obtain the virtual identifier of the number. This credential information can be the virtual identifier of the number itself or an authorization code used to exchange for it. The authorization code is a one-time credential generated by the unified authorization platform 102 after user authorization is approved, used to exchange for an access token. When the credential information is the virtual identifier of the number itself, the application service platform can directly obtain the virtual identifier. When the credential information is an authorization code, the application service platform needs to use the authorization code and client key to exchange for an access token from the unified authorization platform, thereby obtaining the virtual identifier of the number. The virtual identifier of the number can be understood as a unique identifier generated by combining the user's real number with each application service platform using an irreversible encryption algorithm. This identifier cannot be reversed to deduce the user's real number, and different application service platforms obtain different NVIDs, thus preventing cross-application correlation tracking.

[0027] Before interacting with the user, the unified authorization platform 102 receives the registration request from the application service platform 101 in advance, reviews the basic information of the application service platform 101 (including name, provision method and identity information), and assigns a unique application service identifier and client key (AppSecret) to the application service platform 101 after the review is passed.

[0028] When a user initiates registration or login through application service platform 101, application service platform 101 redirects the user to unified authorization platform 102, carrying the application service identifier and callback address. Unified authorization platform 102 identifies the request source based on the application service identifier and guides the user to complete identity authentication (such as SMS verification code, facial recognition, etc.) to ensure that the user has legitimate permissions for the number they hold. After the user passes identity authentication, unified authorization platform 102 displays an authorization page for the user to confirm authorization and configure communication permissions. After the user confirms authorization, unified authorization platform 102 uses an irreversible encryption algorithm to calculate and generate a globally unique virtual identifier for the user and application service pair (application service platform 101), combining the user's real number, application service identifier, and random salt value. This ensures that the user's real number cannot be deduced from the NVID, and that different applications obtain different NVIDs. Simultaneously, the unified authorization platform 102 establishes a mapping relationship, recording the correspondence between the user's real number, the application service identifier of the application service platform 101, and the generated virtual identifier (NVID). It also configures the attribute information of this mapping relationship, including the user's configured communication permissions, registration status, and control status, with the initial value of the registration status being "pending binding." The unified authorization platform 102 returns an authorization code to the application service platform 101 via a callback address as credential information for obtaining the virtual identifier. The application service platform 101 can then use this authorization code and client key to initiate a token acquisition request to the unified authorization platform 102, receive the access token returned by the unified authorization platform 102, and use this access token to call the interface of the unified authorization platform 102 to obtain the virtual identifier.

[0029] After obtaining the virtual identifier of the number, the application service platform 101 uses the virtual identifier as the user's unique identifier within the platform, replacing the user's real number to complete account registration or login, and notifies the unified authorization platform 102 of the successful operation. Upon receiving the success notification, the unified authorization platform 102 updates the registration status of the mapping relationship to "bound". Throughout this process, the application service platform 101 does not store, transmit, or display the user's real number, achieving usability but invisibility of the user's number at the application layer.

[0030] This invention provides an account management system comprising an application service platform and a unified authorization platform, which are communicatively connected. The application service platform provides a callback address, receives credential information from the unified authorization platform, and obtains a virtual identifier (NVID) based on the credential information. It then registers or logs in to an account using the globally unique NVID. The unified authorization platform extracts the corresponding NVID based on the credential information sent by the application service platform and returns the NVID to the application service platform. This technical solution uses a virtual identifier to replace the user's real number for account registration or login. The application service platform only stores the irreversibly derivable NVID, ensuring that even if the database is leaked, attackers cannot reconstruct the user's real number. The user's real number is centrally stored only on the unified authorization platform, reducing the risk of leakage caused by scattered storage across multiple application service providers. This provides a data foundation for subsequent user-managed dynamic functions (such as disabling / enabling authorization) and number migration, achieving the usability but not visibility of the user's real number on the application service provider, thereby solving the risk of number privacy leakage.

[0031] As a first optional embodiment of this example, the unified authorization platform 102 includes: The identity authentication module is used to verify the user's identity and determine the authentication result in response to the user's registration or number change operation. The virtual number identifier management module is used to obtain the user's real number, application service identifier, and random salt value, generate a corresponding globally unique virtual number identifier through an encryption algorithm, and manage the mapping relationship between the user's real number, the application service identifier, and the virtual number identifier, as well as the attribute information of the mapping relationship. The attribute information includes communication permissions, registration status, and control status. The registration status includes pending binding status and bound status, and the control status includes enabled status, disabled status, and deleted status. The application service provider interface module is used to return credential information based on the callback address of the application service platform. The credential information is a credential used to exchange for a virtual identifier for a number, and includes at least an authorization code. The operator interface module is used to connect to the communication dispatch platform, allowing the communication dispatch platform to query the validity of the virtual identifier of the number, the corresponding real user number, and communication permissions.

[0032] The identity authentication module can be understood as a functional unit within the unified authorization platform 102 responsible for verifying the legitimacy of user identities. This module interfaces with official identity authentication and carrier number information authentication, using methods such as SMS verification codes, facial recognition, and document verification to confirm that the user has legitimate ownership of their mobile phone number. The identity verification result (pass or fail) determines whether subsequent processes continue. A number change operation can be understood as the operation where a user needs to update their bound information on the unified authorization platform 102 due to a change in their mobile phone number. When a user changes their number, the identity authentication module verifies the authenticity of the new number to ensure that it belongs to the user. Only after successful verification can subsequent mapping migration proceed.

[0033] The Virtual Number Identifier Management module can be understood as a functional unit within the Unified Authorization Platform 102 responsible for generating virtual number identifiers and managing mapping relationships and their attribute information. The random salt value can be understood as a random string introduced when generating the virtual number identifier. The random salt value, along with the user's real number and application service identifier, serves as input to the encryption algorithm to increase the unpredictability of the NVID and prevent reverse derivation of the real number using methods such as rainbow tables. Different users and different applications use different random salt values. The encryption algorithm can be understood as an irreversible cryptographic hash function, such as SM3 or SHA256. The encryption algorithm takes the user's real number, application service identifier, and random salt value as input and outputs a fixed-length hash value as the virtual number identifier. This algorithm is a one-way irreversible encryption algorithm, meaning it is impossible to calculate the user's real number from the NVID. Communication permissions can be understood as the communication authorization scope configured by the user for each application service platform on the authorization page, used to control the method and purpose of communication initiated by that application service platform to the user. Communication permissions include permitted communication types and permitted communication purposes. Communication types include SMS, voice calls, or both. Communication purposes include service notifications, business verification codes, or commercial marketing. Before routing communication content initiated by the application service platform, the communication scheduling platform must query the unified authorization platform 102 for the corresponding communication permissions for that application. Routing is only permitted if both the communication type and purpose comply with the user's authorized scope. Registration status can be understood as a status indicator of the mapping relationship in the registration process, used to describe whether the user has completed registration with the application service platform, including pending binding and bound status. Pending binding status indicates that the mapping relationship has been established but the user has not yet completed registration; for example, the user has confirmed authorization and generated an NVID, but the application service platform has not yet completed the registration process and notified the unified authorization platform 102. Bound status indicates that the user has completed registration, and the mapping relationship can be used normally for login and communication. Control status can be understood as a status indicator of the mapping relationship in the user's autonomous dynamic management, used to describe the user's control intention regarding the application authorization, including enabled, disabled, and deleted status.The "Enabled" state indicates that the user has authorized the application service platform to use their virtual identifier for login and communication. This is the default control state for the mapping relationship after the initial registration. The "Disabled" state indicates that the user has temporarily revoked their authorization to the application service platform. When in the "Disabled" state, the application service platform cannot use the corresponding virtual identifier to complete the user login, and the communication scheduling platform will also block any communication requests initiated by the application to the user. The user can restore the state to "Enabled" at any time without re-registering or changing the number. The "Deleted" state indicates that the user has permanently revoked their authorization to the application service platform. When in the "Deleted" state, the unified authorization platform 102 deletes the corresponding mapping relationship record and simultaneously notifies the application service platform 101 that the NVID has expired. The application service platform 101 needs to delete the corresponding user record, and the user needs to go through the complete initial registration process again if they need to use the application in the future.

[0034] The application service provider interface module can be understood as a functional unit within the unified authorization platform 102 responsible for connecting with the application service platform 101. This module receives requests initiated by the application service platform 101 and returns credential information based on the callback address of the application service platform 101.

[0035] The operator interface module can be understood as a functional unit within the unified authorization platform 102 responsible for connecting to the communication dispatch platform. This module allows the communication dispatch platform to query the validity of the virtual identifier of a number, the corresponding real user number, and communication permissions, thereby enabling the communication dispatch platform to perform permission verification before routing communication content.

[0036] For initial user registration, the identity authentication module first responds to the user's registration action by initiating an identity verification process. For example, if a user is redirected to the registration page of the unified authorization platform 102 via application service platform 101 and fills in their real mobile phone number and identification information, the identity authentication module verifies the user using methods such as SMS verification code and facial recognition to determine whether the identity verification is successful or not. If the identity verification is successful, the virtual identifier management module obtains the user's real number, the application service identifier that initiated the request, and a randomly generated salt value. These three elements are then input into an irreversible encryption algorithm to calculate and output a globally unique virtual identifier. Due to the introduction of the salt value, even if the same user generates multiple NVIDs for the same application, each generated NVID will be different, further enhancing security. After generation, the virtual identifier generation module sends the generated NVID to application service platform 101. Simultaneously, the virtual identifier management module establishes a mapping relationship between the user's real number, application service identifier, and virtual identifier, and sets the registration status of this mapping relationship to "pending binding" and the control status to "enabled." The application service provider interface module returns credential information based on the callback address of the application service platform 101. This credential information is either the virtual identifier of the number itself or the authorization code (auth_code).

[0037] If the credential information is the virtual identifier of the number itself, the application service platform 101 directly obtains the virtual identifier of the number from the credential information; if the credential information is an authorization code, the application service platform 101 initiates a token acquisition request to the unified authorization platform 102 with the authorization code and the client key, receives the access token returned by the unified authorization platform 102, and uses the access token to call the interface of the unified authorization platform 102 to obtain the virtual identifier of the number.

[0038] After obtaining the virtual identifier of the number, the application service platform 101 uses the virtual identifier as the user's unique identifier within the platform, replacing the user's real number to complete the account registration or login operation, and notifies the unified authorization platform 102 of the successful registration. Upon receiving the registration success notification, the unified authorization platform 102 updates the registration status of the mapping relationship to "bound".

[0039] For subsequent user logins, the application service platform 101 sends another request to the unified authorization platform 102, following the same process as registration. The application service interface module returns credential information (the virtual identifier itself or the authorization code) via a callback address. In response to the user's login operation, the virtual identifier management module no longer executes encryption generation logic but directly queries the stored mapping relationship for the virtual identifier corresponding to the user and the application, along with its registration and control status. If the registration status is "bound" and the control status is "enabled," login is allowed. The application service platform 101 completes the login process after obtaining the NVID. If the registration status is "pending binding" or the control status is "disabled" or "deleted," a login failure indication is returned. Subsequent user logins utilize the Open Authorization 2.0 (OAuth 2.0) mechanism for silent authorization.

[0040] For scenarios involving users changing their phone numbers, the identity authentication module first responds to the user's number change operation by verifying the authenticity of the new phone number (using the same method as in the registration scenario) to ensure that the new number belongs to the user and confirm the identity verification result. If the identity verification result is positive, the virtual identifier management module will batch migrate all mapping relationships corresponding to the original user's real number to the new user's real number, while maintaining the virtual identifier unchanged during the migration process. The virtual identifier management module is responsible for maintaining the integrity of the mapping relationships and their attribute information during this process, ensuring that the mapping relationships are correctly updated after the number change.

[0041] Furthermore, the virtual identifier management module is also used to: receive user's number change instruction, and after obtaining the new user's real number and completing identity verification, batch migrate the mapping relationship corresponding to the original user's real number to the new user's real number, while keeping the virtual identifier unchanged during the migration process.

[0042] The number change instruction can be understood as an operation command issued by the user through the unified authorization platform 102 to transfer the original authorization relationship to the new mobile phone number. The user can receive a verification code using the original mobile phone number (if the original number is still usable), or log in to the unified authorization platform 102 through methods such as face authentication or document verification, and then select the "Migrate Existing Authorization" function to trigger the number change instruction. Batch migration can be understood as a method of transferring all mapping relationships (potentially involving multiple application service platforms) associated with the original user's real number in the account management table to the new user's real number in one go. During the migration process, the user's real number field in each mapping record is updated from the original number to the new number, while the virtual identifier and authorization permission configuration remain unchanged. The fact that the virtual identifier remains unchanged during the migration process can be understood as follows: since the application service platform stores the NVID rather than the user's real number, and the NVID is decoupled from the user's real number, the NVID does not need to be regenerated when the user changes their number, and the NVID record stored on the application service platform does not need any modification. After changing their number, the user can use the original NVID to log in to all authorized application services normally.

[0043] For scenarios where users actively change their phone numbers, the process begins with the user logging into the unified authorization platform 102. Users can log in using their original mobile number (if still valid) to receive a verification code, or through facial recognition or ID verification. Upon entering the number change interface, the user inputs their new mobile number. The unified authorization platform 102 verifies the new number using SMS verification and facial recognition to confirm that it belongs to the user. The identity authentication module responds to the user's number change operation by verifying the authenticity of the new mobile number. After successful verification, the user selects the "Migrate Existing Authorization" function, triggering the number change instruction. The virtual identifier management module receives this instruction, queries all mapping records associated with the original user's real number, and performs a batch migration operation. This updates the user's real number field in these mapping records from the original number to the new number, while maintaining the virtual identifier, application service identifier, and attribute information in each mapping record completely unchanged. After the migration is complete, the user can log in to all authorized application services using their original NVID without needing to modify the binding relationships of each application service platform individually.

[0044] For scenarios involving the reclaiming and redistribution of phone numbers (secondary numbers), the original user's phone number is first reclaimed by the operator. Before redistributing the number to a new user, the operator synchronizes the reclaiming status of the number with the Unified Authorization Platform 102. The Unified Authorization Platform 102 records the status of the real number as "reclaimed" and performs isolation operations on all NVID mapping relationships associated with the number (retaining the mapping relationships but recording the control status as "disabled"). After obtaining a new phone number, the original user logs into the Unified Authorization Platform 102 and completes identity verification through methods such as facial recognition and document verification to prove that they are the compliant holder of the original mapping relationship. After successful verification, the original user uses the "Authorization Retrieval" function of the Unified Authorization Platform 102 to batch migrate the isolated original NVID mapping relationships to their newly registered phone number and reactivate them (updating the control status to "enabled"). After the migration is completed, the original user can use the new number to log in to all authorized application services normally through the original NVID without having to re-register on each application service platform.

[0045] Understandably, if a new user obtains the original user's recycled number and needs to register on the unified authorization platform 102 using that number, they must go through the entire initial registration process again (including identity verification, generating a new NVID, etc.). They will not inherit the original user's isolated mapping relationship. The isolation mechanism ensures that the original user's authorization cannot be obtained by the new user, thus protecting information security.

[0046] With the aforementioned technical features, when a user changes their phone number, there is no need to modify the binding relationships of each application service platform individually. The system automatically completes the batch migration of mapping relationships, resulting in extremely low operation costs. During the migration process, the NVID remains unchanged, and the application service platforms do not need to be aware of the user's number change, achieving transparency of number changes to the application layer. In the case of a second number, the original user's mapping relationship is isolated rather than deleted. After obtaining a new number and completing identity verification, the original user can retrieve the original authorization without re-registering for each application. At the same time, the isolation mechanism ensures that the original user's binding relationship will not interfere with the new user, and the application authorization of the original user cannot be directly used by the new user under the new number, thus ensuring information security.

[0047] As a second optional embodiment of this example, the system further includes application service software; The application service software is used to respond to the user's selection of a virtual identifier for service registration. It carries the callback address of the application service platform and the application service identifier to access the identity authentication module to complete the service registration.

[0048] Application service software can be understood as applications running on user terminal devices, such as e-commerce apps, social apps, banking apps, mini-programs, or web pages. These front-end software programs provide the user interface and act as an intermediary between the user and the application service platform. This software differs from the application service platform 101 deployed on the server side; it is a front-end client directly operated by the user.

[0049] During service registration, the user selects a virtual identifier via the application service software. In response to this user action, the application service software, carrying the callback address of the application service platform 101 and the application service identifier, accesses the identity authentication module of the unified authorization platform 102 to initiate the service registration process.

[0050] After receiving an access request from the application service software, the identity authentication module guides the user to complete identity authentication (such as SMS verification code, facial recognition, etc.) to ensure that the user has legitimate permissions to the number they hold. After successful identity authentication, the unified authorization platform 102 displays an authorization page for the user to confirm authorization and configure communication permissions. After the user confirms authorization, the unified authorization platform 102 generates a virtual identifier for the number and establishes a mapping relationship. It then returns the credential information to the application service platform 101 via a callback address. The application service platform 101 obtains the virtual identifier for the number based on the credential information and completes the registration. During this process, the application service software is only responsible for initiating the registration request and displaying the interactive interface; it does not access or store the user's real number or the virtual identifier for the number, thus ensuring user privacy and security.

[0051] As a third optional embodiment of this example, the application service platform is specifically used for: Receive credential information returned by the unified authorization platform; initiate a token acquisition request to the unified authorization platform based on the credential information, receive the access token returned by the unified authorization platform, and call the interface of the unified authorization platform based on the access token to obtain the virtual identifier of the number; register or log in based on the virtual identifier of the number.

[0052] The token acquisition request can be understood as a request initiated by the application service platform 101 to the unified authorization platform 102 to obtain an access token. This request carries an authorization code and a client key, used to verify the identity of the application service platform. The client key is assigned to the application service platform 101 when the unified authorization platform 102 completes registration and corresponds one-to-one with the application service identifier. The access token can be understood as a temporary credential returned by the unified authorization platform 102 to the application service platform 101 after verifying the validity of the authorization code and the client key. This token has an expiration time and is used for subsequent calls to the interfaces of the unified authorization platform 102.

[0053] In the specific interaction process, the application service platform 101 first receives the credential information returned by the unified authorization platform 102 through the callback address. If the credential information is the virtual identifier of a number itself, the application service platform 101 directly obtains the virtual identifier of the number from the credential information without further interaction; if the credential information is an authorization code, the application service platform 101 initiates a token acquisition request to the unified authorization platform 102 with the authorization code and client key. The unified authorization platform 102 verifies the authorization code and client key, and returns an access token after successful verification. After receiving the access token, the application service platform 101 calls the virtual identifier acquisition interface of the unified authorization platform 102 with the access token. The unified authorization platform 102 verifies the access token, and returns a globally unique virtual identifier of the number for the user on the application service platform after successful verification. The application service platform 101 uses the obtained virtual identifier of the number as the user's unique identifier within the platform, replacing the user's real number to complete account registration or login operations.

[0054] As a fourth optional embodiment of this example, it also includes a communication scheduling platform 103, which is communicatively connected to the application service platform 101 and the unified authorization platform 102 respectively. Application service platform 101 is used to initiate a communication request carrying a virtual identifier of the number and a communication path to communication dispatch platform 103, receive a temporary communication number returned by communication dispatch platform 103, and initiate communication to the temporary communication number; The communication dispatch platform 103 is used to receive communication requests, initiate a verification request carrying a virtual identifier of the number to the unified authorization platform 102, receive the user's real number and communication permissions returned by the unified authorization platform 102 after the verification is successful, generate a temporary communication number based on the user's real number when the communication permissions indicate that the communication path has the permissions, return the temporary communication number to the application service platform 101, receive the communication content routed from the application service platform 101 to the temporary communication number, and route the communication content to the user's real number; The unified authorization platform 102 is used to respond to the verification request of the communication scheduling platform 103 and return the user's real number and communication permissions corresponding to the virtual identifier of the number.

[0055] The communication dispatch platform 103 can be understood as a communication relay dispatcher deployed on the operator's network side, responsible for scheduling communication requests and relaying communication content. A communication request can be understood as an interactive instruction initiated by the application service platform 101 to the communication dispatch platform 103 to trigger sending an SMS message or making a phone call to a user. The communication request carries the target user's virtual identifier and communication path, including the communication type (e.g., SMS or voice) and communication purpose (e.g., service notification, business verification code, commercial marketing, etc.). A verification request can be understood as a query instruction initiated by the communication dispatch platform 103 to the unified authorization platform 102 to query the validity of the virtual identifier and communication permissions. This verification request carries the target user's virtual identifier and is used to verify whether the NVID exists, whether the mapping relationship's control status is "enabled," and whether the current communication path complies with the user's authorized communication permissions. Communication permissions are one of the attribute information in the mapping relationship. They are the authorization scope pre-configured by the user for the application service platform 101, stored in the unified authorization platform 102. This includes the allowed communication types (e.g., SMS only, telephone only, or both) and the allowed uses of various communications (e.g., whether commercial marketing, service notifications, and business verification codes are allowed). Users configure these permissions themselves on the authorization page. A temporary communication number can be understood as a short-term valid number temporarily generated by the communication dispatch platform 103 for this communication after the permission verification is passed. This temporary communication number establishes a temporary binding relationship with the user's real number and the outbound call number or SMS port number registered by the application service platform 101 on the operator's side. The binding is automatically released after the communication ends.

[0056] Privacy communication between the application service platform 101 and the user is achieved through the communication dispatch platform 103. First, when the application service platform 101 needs to send a text message or make a phone call to the user, it initiates a communication request to the communication dispatch platform 103, carrying a virtual identifier for the number and the communication method. The communication method includes the communication type and the communication purpose, so that the communication dispatch platform 103 can perform subsequent permission verification.

[0057] After receiving a communication request, the communication dispatch platform 103 initiates a verification request carrying the virtual identifier of the number to the unified authorization platform 102. The verification request may also include the communication path. The unified authorization platform 102 responds to the verification request, queries the user's real number corresponding to the NVID and the communication permissions granted to the application service platform 101 according to the mapping relationship stored in the account management table, and returns the query results to the communication dispatch platform 103.

[0058] If the verification passes (i.e., the mapping relationship corresponding to the NVID exists, the control status is "enabled," the registration status is "bound," and the communication path complies with the user's authorized communication permissions), the communication dispatch platform 103 generates a temporary communication number based on the user's real number and returns the temporary communication number to the application service platform 101. The temporary communication number establishes a temporary binding relationship with the user's real number and the outbound call number or SMS port number registered by the application service platform 101 on the operator's side, with a binding time window of minutes.

[0059] After receiving the temporary communication number, the application service platform 101 directly initiates communication with the temporary communication number (such as making a phone call or sending a text message). There are two communication paths between the application service platform 101 and the communication dispatch platform 103: one is the control plane path, used for signaling interactions such as communication requests and temporary number returns; the other is the user plane path, which sends communication content to the temporary communication number through the operator's network. The communication content is routed to the communication dispatch platform 103 according to the binding relationship between the temporary number and the real number.

[0060] The communication dispatch platform 103 receives communication content routed from the application service platform 101 to the temporary communication number, and forwards the communication content to the user's real number according to the pre-established temporary binding relationship. When the user replies to an SMS or makes a callback, the communication dispatch platform 103 also routes the reply content back to the application service platform 101 through the temporary communication number, thereby achieving physical isolation of two-way communication.

[0061] The communication scheduling platform 103 also includes a communication log module, which records the communication time, communication type, temporary communication number and communication result of each communication, for permission traceability and anomaly investigation.

[0062] Through the above technical features, the application service platform 101 is unable to obtain the user's real number throughout the process and only uses a temporary communication number for communication, thus achieving physical isolation of the number; the communication dispatch platform 103 verifies the communication permission with the unified authorization platform 102 before forwarding, ensuring that communication forwarding is only carried out within the scope authorized by the user, effectively blocking unauthorized or marketing-related harassing communications; the temporary communication number is valid for a short period of time and automatically expires after the communication ends, preventing the number from being maliciously retained or abused.

[0063] In one embodiment, Figure 2 This is a flowchart of an account management method provided by an embodiment of the present invention. This embodiment can be applied to various application service scenarios where account management and communication interaction are carried out based on virtual identifiers of numbers instead of real numbers. The method can be executed by an account management system, which can be implemented in hardware and / or software.

[0064] like Figure 2 As shown, the method includes: S201. Through the application service platform, a callback address is provided to receive the credential information fed back by the unified authorization platform and obtain the virtual identifier of the number from the unified authorization platform based on the credential information. The virtual identifier of the number is used for account registration or login. The virtual identifier of the number is globally unique.

[0065] S202. Through the unified authorization platform, extract the corresponding virtual identifier of the number based on the credential information sent by the application service platform, and return the virtual identifier of the number to the application service platform.

[0066] The account management method provided in this invention addresses the risk of account privacy leakage.

[0067] Optionally, based on the credential information sent by the application service platform, the corresponding virtual identifier of the number is extracted, and the virtual identifier of the number is returned to the application service platform, including: The identity authentication module responds to user registration or number change operations by authenticating the user and determining the authentication result. The virtual identifier management module obtains the user's real number, application service identifier, and random salt value, generates a corresponding globally unique virtual identifier through an encryption algorithm, and manages the mapping relationship between the user's real number, the application service identifier, and the virtual identifier, as well as the attribute information of the mapping relationship. The attribute information includes communication permissions, registration status, and control status. The registration status includes pending binding status and bound status, and the control status includes enabled status, disabled status, and deleted status. The application service provider interface module returns credential information based on the callback address of the application service platform. The credential information is a credential used to exchange for a virtual identifier for a number, and includes at least an authorization code. Through the operator interface module, it connects to the communication dispatch platform, enabling the communication dispatch platform to query the validity of the virtual identifier of the number, the corresponding real user number, and communication permissions.

[0068] Optionally, the method further includes: The virtual identifier management module receives user number change instructions, obtains the new user's real number and completes identity verification, and then migrates the mapping relationship corresponding to the original user's real number to the new user's real number in batches. During the migration process, the virtual identifier remains unchanged.

[0069] Optionally, the method further includes: In response to a user's choice of a virtual identifier for service registration, the application service software accesses the identity authentication module by carrying the callback address of the application service platform and the application service identifier to complete the service registration.

[0070] Optionally, the system receives credential information from the unified authorization platform and obtains a virtual identifier for the phone number based on the credential information. It then registers or logs in to an account using the virtual identifier, including: Receive the credential information returned by the unified authorization platform; Based on the credential information, a token acquisition request is initiated to the unified authorization platform, an access token is received from the unified authorization platform, and the interface of the unified authorization platform is called based on the access token to obtain the virtual identifier of the number; Register or log in using the virtual identifier of the number.

[0071] Optionally, the method further includes: Through the application service platform, a communication request carrying the virtual identifier of the number and the communication path is initiated to the communication dispatch platform; a temporary communication number is returned by the communication dispatch platform; and communication is initiated to the temporary communication number. The communication scheduling platform receives the communication request, initiates a verification request carrying the virtual identifier of the number to the unified authorization platform, receives the user's real number and communication permissions returned by the unified authorization platform after verification, generates a temporary communication number based on the user's real number when the communication permissions indicate that the communication path has permissions, returns the temporary communication number to the application service platform, receives the communication content routed from the application service platform to the temporary communication number, and routes the communication content to the user's real number. Through the unified authorization platform, in response to the verification request of the communication scheduling platform, the user's real number and communication permissions corresponding to the virtual identifier of the number are returned.

[0072] In one embodiment, Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. For example... Figure 3 The diagram illustrates a schematic representation of an electronic device 30 that can be used to implement embodiments of the present invention. The electronic device 30 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 30 may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0073] like Figure 3As shown, the electronic device 30 includes at least one processor 31 and a memory, such as a read-only memory (ROM) 32 or a random access memory (RAM) 33, communicatively connected to the at least one processor 31. The memory stores computer programs executable by the at least one processor. The processor 31 can perform various appropriate actions and processes based on the computer program stored in the ROM 32 or loaded from storage unit 38 into the RAM 33. The RAM 33 can also store various programs and data required for the operation of the electronic device 30. The processor 31, ROM 32, and RAM 33 are interconnected via a bus 34. An input / output (I / O) interface 35 is also connected to the bus 34.

[0074] Multiple components in electronic device 30 are connected to I / O interface 35, including: input unit 36, such as keyboard, mouse, etc.; output unit 37, such as various types of monitors, speakers, etc.; storage unit 38, such as disk, optical disk, etc.; and communication unit 39, such as network card, modem, wireless transceiver, etc. Communication unit 39 allows electronic device 30 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0075] Processor 31 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 31 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 31 performs the various methods and processes described above, such as account management methods.

[0076] In some embodiments, the account management method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 38. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 30 via ROM 32 and / or communication unit 39. When the computer program is loaded into RAM 33 and executed by processor 31, one or more steps of the account management method described above may be performed. Alternatively, in other embodiments, processor 31 may be configured to perform the account management method by any other suitable means (e.g., by means of firmware).

[0077] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), payload programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0078] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0079] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0080] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube or liquid crystal display) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0081] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0082] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product within the cloud computing service system to address the shortcomings of traditional physical host and virtual machine services, such as high management difficulty and weak business scalability.

[0083] This invention also provides a computer program product, including a computer program that, when executed by a processor, can implement the account management method provided in any embodiment of this invention.

[0084] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including local area networks (LANs) or wide area networks (WANs), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0085] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0086] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An account management system, characterized in that, include: An application service platform and a unified authorization platform, wherein the application service platform and the unified authorization platform are communicatively connected; The application service platform is used to provide a callback address, receive credential information fed back by the unified authorization platform, obtain a virtual identifier for a number from the unified authorization platform based on the credential information, and register or log in to an account based on the virtual identifier for a number. The virtual identifier for a number is globally unique. The unified authorization platform is used to extract the corresponding virtual identifier of the number based on the credential information sent by the application service platform, and return the virtual identifier of the number to the application service platform.

2. The system according to claim 1, characterized in that, The unified authorization platform includes: The identity authentication module is used to verify the identity of the user and determine the identity verification result in response to the user's registration or number change operation. The virtual number identifier management module is used to obtain the user's real number, application service identifier, and random salt value, generate a corresponding globally unique virtual number identifier through an encryption algorithm, and manage the mapping relationship between the user's real number, the application service identifier, and the virtual number identifier, as well as the attribute information of the mapping relationship. The attribute information includes communication permissions, registration status, and control status. The registration status includes pending binding status and bound status, and the control status includes enabled status, disabled status, and deleted status. The application service provider interface module is used to return credential information based on the callback address of the application service platform. The credential information is a credential used to exchange for a virtual identifier for a number, and includes at least an authorization code. The operator interface module is used to connect to the communication dispatch platform, allowing the communication dispatch platform to query the validity of the virtual identifier of the number, the corresponding real user number, and communication permissions.

3. The system according to claim 2, characterized in that, The virtual identifier management module is also used for: Upon receiving a user's number change instruction, after obtaining the new user's real number and completing identity verification, the mapping relationship corresponding to the original user's real number is migrated in batches to the new user's real number. During the migration process, the virtual identifier of the number remains unchanged.

4. The system according to claim 2, characterized in that, The system also includes application service software; The application service software is used to respond to the user's selection of a virtual identifier for service registration by carrying the callback address of the application service platform and the application service identifier, and accessing the identity authentication module to carry out service registration.

5. The system according to claim 1, characterized in that, The application service platform is specifically used for: Receive the credential information returned by the unified authorization platform; Based on the credential information, a token acquisition request is initiated to the unified authorization platform, an access token is received from the unified authorization platform, and the interface of the unified authorization platform is called based on the access token to obtain the virtual identifier of the number; Register or log in using the virtual identifier of the number.

6. The system according to claim 1, characterized in that, The account management system further includes: a communication scheduling platform, which is communicatively connected to both the application service platform and the unified authorization platform; The application service platform is used to initiate a communication request to the communication dispatch platform carrying the virtual identifier of the number and the communication path, receive a temporary communication number returned by the communication dispatch platform, and initiate communication to the temporary communication number; The communication scheduling platform is configured to receive the communication request, initiate a verification request carrying the virtual identifier of the number to the unified authorization platform, receive the user's real number and communication permissions returned by the unified authorization platform after verification, generate a temporary communication number based on the user's real number when the communication permissions indicate that the communication path has permissions, return the temporary communication number to the application service platform, receive communication content routed from the application service platform to the temporary communication number, and route the communication content to the user's real number; The unified authorization platform is used to respond to the verification request of the communication scheduling platform and return the user's real number and communication permissions corresponding to the virtual identifier of the number.

7. An account management method, characterized in that, The method, applied to the system as described in any one of claims 1-6, comprises: The application service platform provides a callback address to receive credential information from the unified authorization platform and obtains a virtual identifier for the number from the unified authorization platform based on the credential information. The virtual identifier for the number is then used for account registration or login. The virtual identifier for the number is globally unique. Through the unified authorization platform, the corresponding virtual identifier of the number is extracted based on the credential information sent by the application service platform, and the virtual identifier of the number is returned to the application service platform.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the account management method of claim 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the account management method of claim 7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements an account management method according to claim 7.

Images