Application authorization method, apparatus and system

Abstract

The present application relates to an application authorization method, apparatus and system. The method comprises: receiving an authorization request for a terminal transmitted by a service provider (S302); performing identity verification on the service provider on the basis of the authorization request, and, when the identity verification of the service provider succeeds, transmitting the authorization request to the terminal (S304); in response to receiving a first authorization result fed back by the terminal on the basis of the authorization request, when the first authorization result is that the authorization has passed, determining a request type of the authorization request (S306); and when it is determined that the request type of the authorization request is a normal authorization request, transmitting sensitive information to the service provider (S308). Using the present method only requires one time of confirmation authorization of a terminal during a process of acquiring an application authorization, and does not need introduction of extra roles, and meanwhile, the method achieves secondary verification of service providers so as to avoid pseudo services and replay attacks, thus improving the convenience and safety of application authorization processes.

Description

Application authorization method, device and system

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on July 26, 2023, with application number 2023109224276 and application name “Application Authorization Method, Device and System”, all contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of network security technology, and in particular to an application authorization method, device, and system. Background Art

[0003] During the interaction between a user and a chatbot, messages are sent through the operator's capability platform to the chatbot platform provider. The chatbot platform provider processes the message through a predefined process and responds, completing a passive interaction. The service provider can also proactively send messages to users through the capability platform, completing an active interaction. The operator plays the role of message transfer and business operation management.

[0004] However, the current traditional solution for obtaining user authorization has the problem of a cumbersome process involving multiple transfers between the terminal, operators, and brand service providers.

[0005] Summary of the Invention

[0006] Based on this, it is necessary to provide an application authorization method, device and system that can easily obtain user authorization to address the above technical issues.

[0007] In a first aspect, the present application provides an application authorization method. The method includes:

[0008] Receive authorization requests for terminals transmitted by service providers; authorization requests are used to request access to sensitive information of terminals;

[0009] authenticating the service provider based on the authorization request, and transmitting the authorization request to the terminal if the service provider authentication is successful;

[0010] In response to receiving a first authorization result fed back by the terminal based on the authorization request, if the first authorization result is authorization passed, determining a request type to which the authorization request belongs;

[0011] When it is determined that the request type of the authorization request is a normal authorization request, the sensitive information is transmitted to the service provider.

[0012] In one embodiment, the method further comprises:

[0013] When it is determined that the request type of the authorization request is an abnormal authorization request, the authorization request is transmitted to the terminal;

[0014] In response to receiving a second authorization result fed back by the terminal based on the authorization request, if the second authorization result is authorization passed, the sensitive information is transmitted to the service provider.

[0015] In one embodiment, authenticating a service provider based on an authorization request includes:

[0016] Obtain the identity information of the service provider and the region to which the service provider belongs;

[0017] When the information matches successfully based on the identity identification information and the region to which the service provider belongs, it is determined that the service provider's identity authentication is successful.

[0018] In one embodiment, determining the request type of the authorization request includes:

[0019] Obtain the corresponding historical authorization information; historical authorization information includes historical feedback information and historical behavior ratio; historical feedback information includes the authorization rate of the terminal for the same type of authorization request feedback, and the historical behavior ratio is the ratio of the number of authorization requests of any type output by the service provider to the total number of authorization requests;

[0020] Based on historical feedback information, historical behavior ratio, and the type of sensitive information, confirm the necessity of sensitive information to determine the request type of the authorization request.

[0021] In one embodiment, the necessity of sensitive information is determined based on historical feedback information, historical behavior ratio, and the type of sensitive information, including:

[0022] Based on the type of sensitive information, an analysis model is used to conduct a necessity analysis of historical feedback information and historical behavior ratios; the analysis model includes at least one of a random forest model, a clustering model, and a decision tree model.

[0023] In one embodiment, the service provider is a Chatbot.

[0024] In a second aspect, the present application also provides an application authorization device. The device includes:

[0025] A request receiving module is used to receive an authorization request for a terminal transmitted by a service provider; the authorization request is used to request access to sensitive information of the terminal;

[0026] An authentication module is used to authenticate the service provider based on the authorization request, and transmit the authorization request to the terminal if the service provider authentication is successful;

[0027] a type determination module, configured to, in response to receiving a first authorization result fed back by the terminal based on the authorization request, determine the request type to which the authorization request belongs if the first authorization result is authorization passed;

[0028] The information output module is used to transmit sensitive information to the service provider when it is determined that the request type of the authorization request is a normal authorization request.

[0029] In a third aspect, the present application further provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned application authorization method when executing the computer program.

[0030] In a fourth aspect, the present application also provides an application authorization system, comprising the above-mentioned computer device, and also comprising a terminal and a service provider; wherein the terminal communicates with the service provider through the computer device.

[0031] In a fifth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the above-mentioned application authorization method when executed by a processor.

[0032] The above-mentioned application authorization method, device and system receive the authorization request for the terminal transmitted by the service provider, and authenticate the service provider based on the authorization request. If the service provider identity authentication is successful, the authorization request is transmitted to the terminal; in response to receiving the first authorization result fed back by the terminal based on the authorization request, if the first authorization result is authorization passed, the request type to which the authorization request belongs is determined; when it is determined that the request type to which the authorization request belongs is a normal authorization request, the sensitive information is transmitted to the service provider; this application realizes that in the process of obtaining application authorization, the terminal only needs to confirm the authorization once by authenticating the service provider and the first authorization result fed back by the terminal based on the authorization request, and there is no need to introduce additional roles. At the same time, secondary verification of the service provider is realized to avoid fake services and replay attacks, thereby improving the convenience and security of the application authorization process. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 is a general flow chart of a traditional application authorization method;

[0034] FIG2 is a diagram illustrating an application environment of an application authorization method according to an embodiment;

[0035] FIG3 is a schematic diagram of a process of applying an authorization method in one embodiment;

[0036] FIG4 is a schematic diagram of a process for determining the request type to which an authorization request belongs in one embodiment;

[0037] FIG5 is a general flow chart of an application authorization method according to an embodiment;

[0038] FIG6 is a structural block diagram of an application authorization device in one embodiment;

[0039] FIG7 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0041] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0042] It should be understood that terms such as "first" and "second" in this application are used only to distinguish similar objects and should not be understood to indicate or imply relative importance or implicitly indicate the number of technical features indicated. The "connection" appearing in the embodiments of this application refers to various connection methods, such as direct connection and indirect connection, to achieve communication between devices, and this embodiment of the application does not impose any limitation on this.

[0043] It will be understood that "at least one" means one or more, and "a plurality of" means two or more.

[0044] As used herein, the singular forms "a," "an," and "the" may also include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "include," "comprising," "having," and the like specify the presence of stated features, integers, steps, operations, components, parts, or combinations thereof, but do not preclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof. Furthermore, the term "and / or" as used in this specification includes any and all combinations of the relevant listed items.

[0045] RCS (Rich Communication Service) messaging is a messaging service defined by the GSMA (Global System for Mobile Communications Association) and is considered a key component of 5G (5th Generation Mobile Communication Technology) messaging. RCS messaging incorporates branded chatbots as a crucial messaging channel between businesses and individuals, making it crucial to prevent spam.

[0046] The existing 5G message transmission mechanism lacks a process for verifying the reliability of authorization, which may lead to the leakage of sensitive user information. For example, in corporate marketing short messages or community epidemic investigations, 5G messages often prompt users to click on the service link to browse or submit information through the link. Application authorization during the interaction process requires further monitoring and control.

[0047] However, the current method for service providers to apply for authorization to obtain sensitive information of users (5G terminal users), as shown in Figure 1, requires operators (CSP platforms) to add additional authorization roles (authorization services) to construct multiple scheme combinations (such as issuing a one-time authorization code and generating a token). The process involves multiple transfers between the terminal, the operator, and the brand service provider, and the process is cumbersome.

[0048] Furthermore, the industry currently uses authentication cards, one-click authentication and other methods combined with 5G message supporting hidden return functions such as Postback_data (the current return value) to hide the operator's basic return to the application system background. The operator only transfers messages and has less control over authorization policies. In addition, traditional methods cannot guarantee the legitimacy of the service provider's Chatbot, and introduce authorization services based on standardized message architecture, resulting in message bottlenecks and increased attack exposure.

[0049] The application authorization method provided in the embodiment of the present application can be applied to the application environment shown in Figure 2. In which, the terminal 102 communicates with the server 104 through the network, and the server 104 communicates with the service provider 106 through the network. The server 104 authenticates the service provider 106 based on the authorization request transmitted by the service provider 106 for the terminal 102. If the authentication is successful, the server 104 transmits the authorization request to the terminal 102; the terminal 102 feeds back a first authorization result to the server 104. If the first authorization result is authorization passed, the server 104 determines the request type to which the authorization request belongs. If it is determined that the request type to which the authorization request belongs is a normal authorization request, the server 104 transmits the sensitive information to the service provider 106.

[0050] The terminal 102 may be, but is not limited to, various personal computers, laptops, smartphones, tablet computers, IoT devices, and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc.

[0051] Exemplarily, server 104 can be used to run the operator's MaaP (Messaging as a Platform) platform (capability platform) or CSP (Certified Service Partner) platform. In the embodiment of the present application, server 104 is used as a CSP platform as an example for illustration; further, server 104 can be implemented as an independent server or a server cluster consisting of multiple servers.

[0052] In one embodiment, the service provider 106 may refer to a service provider of each brand, and the embodiment of the present application does not limit the category of the brand service provider. For example, the service provider may be a Chatbot.

[0053] In one embodiment, as shown in FIG3 , an application authorization method is provided. The method is described by taking the application of the method to the server in FIG2 as an example, including the following steps:

[0054] S302: Receive an authorization request for the terminal transmitted by the service provider; the authorization request is used to request to obtain sensitive information of the terminal.

[0055] Among them, the authorization request may refer to a request issued by the service provider to apply for authorization to obtain user sensitive information; in one embodiment, the authorization request may also refer to a request issued by the service provider to obtain other types of information of the terminal, which is not limited in this embodiment of the present application.

[0056] Specifically, taking the server as a CSP platform as an example, when a user uses a terminal to obtain services provided by a service provider, when the service provider needs to obtain user authorization to obtain sensitive information of the corresponding user, the service provider can output an authorization request for the terminal to the CSP platform.

[0057] S304: Authenticate the service provider based on the authorization request. If the service provider authentication is successful, transmit the authorization request to the terminal.

[0058] Specifically, when the server receives an authorization request, it can authenticate the service provider, thereby reducing the number of authorization service roles in which the service provider's application authorization participates, reducing the risk of bottlenecks, and thus solving the problem that traditional solutions cannot guarantee the legitimacy of brand service providers.

[0059] Furthermore, when the service provider's identity authentication is successful, the server may transmit an authorization request to the terminal to instruct the terminal to perform an authorization operation.

[0060] For example, taking the server as a CSP platform, the CSP platform can authenticate the service provider based on the authorization request. When the CSP platform determines that the service provider authentication is successful, the authorization request is transmitted to the terminal. The terminal can respond to the received authorization request and display an authorization page for the user to select.

[0061] In one embodiment, authenticating a service provider based on an authorization request includes:

[0062] Obtain the identity information of the service provider and the region to which the service provider belongs;

[0063] When the information matches successfully based on the identity identification information and the region to which the service provider belongs, it is determined that the service provider's identity authentication is successful.

[0064] The identity identification information may refer to the merchant ID (Identity Document) corresponding to the service provider; the region to which the service provider belongs may refer to the message region where the service provider is located.

[0065] Specifically, the server may store the identity identification information (legal identity identification information) and the region to which it belongs (legal region to which it belongs) of a legitimate service provider. When the server obtains the identity identification information corresponding to the service provider and the region to which the service provider belongs, it matches it with the stored identity identification information and the region to which it belongs of the legitimate service provider. When the identity identification information matches the legal identity identification information and the region to which the service provider belongs matches the legal region to which it belongs, the server determines that the service provider's identity authentication is successful.

[0066] For example, taking the server as a CSP platform, the CSP platform can match the obtained identity identification information corresponding to the service provider and the region to which the service provider belongs with the stored identity identification information and region to which the legitimate service provider belongs, thereby determining the service provider identity authentication result.

[0067] In one embodiment, the server can also authenticate the service provider based on other registration information of the service provider. In this embodiment of the application, the identity identification information and the region to which the service provider belongs are used as an example for explanation. Other registration information of the service provider is not limited in this embodiment of the application.

[0068] For example, the authorization request may carry the identity identification information corresponding to the service provider and the region to which the service provider belongs. The CSP platform may match the identity identification information and the region to which the service provider belongs in the authorization request with the stored legal identity identification information and the legal region to which it belongs. If the match is successful, it is determined that the identity authentication is successful.

[0069] In the embodiment of the present application, by adding an identity authentication link for the service provider, the legitimacy of the service provider is effectively guaranteed and the security of the application authorization process is improved.

[0070] S306: In response to receiving the first authorization result fed back by the terminal based on the authorization request, if the first authorization result is authorization passed, determine the request type to which the authorization request belongs.

[0071] Specifically, the server transmits the authorization request to the terminal. Upon receiving the authorization request, the terminal displays an authorization page, on which the user can confirm whether authorization has been granted. Furthermore, when the user completes the authorization operation, the terminal returns a first authorization result to the server. If the first authorization result indicates authorization has been granted, the server determines the request type to which the authorization request belongs.

[0072] The server determines the request type of the authorization request, which may refer to performing authorization necessity verification on the authorization request and, based on the result of the necessity verification, confirming whether the authorization request is a normal authorization request or an abnormal authorization request. For example, taking the server as a CSP platform, if the first authorization result is authorization approval, the CSP platform can perform authorization necessity analysis on the authorization request, completing highly reliable application authorization while satisfying the data subject rights in the GDPR and avoiding authorization abuse.

[0073] In one embodiment, determining the request type of the authorization request includes:

[0074] Obtain the corresponding historical authorization information; historical authorization information includes historical feedback information and historical behavior ratio; historical feedback information includes the authorization rate of the terminal for the same type of authorization request feedback, and the historical behavior ratio is the ratio of the number of authorization requests of any type output by the service provider to the total number of authorization requests;

[0075] Based on historical feedback information, historical behavior ratio, and the type of sensitive information, confirm the necessity of sensitive information to determine the request type of the authorization request.

[0076] Specifically, the server may store corresponding historical authorization information, and the server may determine the authorization rate corresponding to the terminal for authorization requests of this type based on the historical feedback information in the historical authorization information and the type of sensitive information; the server may also determine the ratio of the type of authorization request output by the service provider to the sum of the total number of authorization requests output by the service provider based on the historical behavior ratio and the type of sensitive information in the historical authorization information, so as to confirm the necessity of the sensitive information according to the corresponding authorization rate and ratio, and then determine the request type to which the authorization request belongs.

[0077] For example, taking the server as a CSP platform, the CSP platform can determine the ratio of the type of authorization request output by the service provider to the total number of authorization requests output by the service provider based on the historical behavior ratio and the type of sensitive information in the historical authorization information. The CSP platform can confirm the necessity of sensitive information based on the corresponding authorization rate and ratio, and then determine the request type to which the authorization request belongs.

[0078] In one embodiment, the data source that can confirm the necessity of sensitive information may also include, but is not limited to, industry information such as the region to which the service provider belongs, requests and rich media cards, and content template chatbot data, conversation data structure data, and base personalitiy data.

[0079] In the embodiment of the present application, based on the GSMA standardized message architecture, there is no need to introduce additional roles to achieve necessity confirmation based on the historical authorization information corresponding to the service provider. On the premise of meeting the rights of the data subject in the GDPR, highly reliable application authorization is completed, authorization abuse is avoided, and the security of the application authorization process is improved.

[0080] In one embodiment, the necessity of sensitive information is determined based on historical feedback information, historical behavior ratio, and the type of sensitive information, including:

[0081] Based on the type of sensitive information, an analysis model is used to conduct a necessity analysis of historical feedback information and historical behavior ratios; the analysis model includes at least one of a random forest model, a clustering model, and a decision tree model.

[0082] Among them, the analysis model may refer to a model that can be used to perform necessity analysis. In the embodiments of the present application, a random forest model, a clustering model, and a decision tree model are used as examples for illustration.

[0083] Specifically, the server may perform a necessity analysis on the corresponding authorization rates and ratios according to the analysis model to confirm the necessity of the sensitive information.

[0084] For example, taking the server as a CSP platform, the CSP platform can use an analysis model to perform a necessity analysis on historical feedback information and historical behavior ratios based on the type of sensitive information, obtain an authorization necessity value, and compare the authorization necessity value with a preset value. Based on the comparison result, the necessity of the sensitive information is confirmed, that is, whether the request type of the authorization request is a normal authorization request or an abnormal authorization request.

[0085] In the embodiment of the present application, by inheriting the existing message system architecture and the convenience of its verification process, utilizing the global perspective of the CSP platform, and based on the type of sensitive information, adopting an analysis model to perform necessity analysis on historical feedback information and historical behavior ratio, the hidden verification is invisible to both the terminal and the service provider, thereby improving the reliability of application authorization.

[0086] S308: When it is determined that the request type of the authorization request is a normal authorization request, the sensitive information is transmitted to the service provider.

[0087] Specifically, the server may store sensitive information of the user. When it is determined that the request type of the authorization request is a normal authorization request, the server transmits the sensitive information to the service provider.

[0088] In the above-mentioned operation application authorization method, secondary verification of the service provider is achieved by authenticating the service provider and the first authorization result fed back by the terminal based on the authorization request to avoid fake services and replay attacks; at the same time, based on the standard message system architecture, there is no need to introduce additional roles, which improves the convenience and security of the application authorization process.

[0089] In one embodiment, as shown in FIG4 , the method further includes:

[0090] S402, when it is determined that the request type of the authorization request is an abnormal authorization request, the authorization request is transmitted to the terminal;

[0091] S404: In response to receiving a second authorization result fed back by the terminal based on the authorization request, if the second authorization result is authorization passed, transmit the sensitive information to the service provider.

[0092] Specifically, the CSP platform can determine the request type of the authorization request by performing a necessity analysis on the authorization request. When the CSP platform determines that the request type of the authorization request is an abnormal authorization request, the terminal is required to confirm the authorization request again. If the second authorization result is authorization passed, the CSP platform transmits the sensitive information to the service provider.

[0093] In an embodiment of the present application, when it is determined that the request type to which the authorization request belongs is an abnormal authorization request, the authorization request is transmitted to the terminal to confirm the authorization request again, thereby improving the security of the application authorization process.

[0094] In one embodiment, the service provider is a Chatbot.

[0095] Specifically, service providers of different brands can be different Chatbots.

[0096] For example, the service provider may refer to a Chatbot Platform Provider.

[0097] To facilitate understanding by those skilled in the art, the application authorization method is described below with reference to a specific example. As shown in FIG5 , the 5G terminal user may refer to a terminal, and the service provider may refer to a Chatbot Platform Provider. The application authorization process for a Chatbot in a messaging service may include:

[0098] Step 1: The user accesses the service provider's service through a text message via a terminal. The access request (service request message) is sent to the CSP platform.

[0099] Step 2: After receiving the access request, the CSP platform forwards the user ID and the user's request content to the service provider;

[0100] Step 3: During the service process, if the Chatbot (service provider) requires user authorization (for example, the service provider needs to obtain the user's sensitive information), it sends a request (requesting sensitive information) to the CSP platform, and the CSP platform conducts an identity review of the Chatbot (Chatbot ID);

[0101] Step 4: After completing the Chatbot's identity verification, the CSP platform forwards the request to the user, and the user receives an authorization page.

[0102] Step 5: After the user confirms the authorization, access the authorization service;

[0103] Step 6: After receiving the user's authorization confirmation, the CSP platform conducts an authorization necessity analysis. For example, it analyzes the necessity of the information (confirming the necessity of sensitive information) based on the user's historical feedback (historical feedback information) and the Chatbot's historical behavior (historical behavior ratio).

[0104] Step 7: When the CSP platform determines that the behavior is normal (normal authorization request), it authorizes the Chatbot (for example, returning sensitive information);

[0105] Step 8: When the CSP platform determines that it is an abnormal authorization request, it forwards it back to the client (5G terminal user) again to request authorization;

[0106] Step 9: After receiving the user's reconfirmation of the authorization response, the CSP platform authorizes the Chatbot (for example, returning sensitive information);

[0107] Step 10: The Chatbot receives authorization (for example, sensitive information) and initiates a message request to the CSP platform.

[0108] Step 11: The CSP platform sends a message to the user (5G terminal user).

[0109] As mentioned above, in this application, by omitting the construction of authorization and authorization code that repeatedly requires user confirmation, the terminal only needs to confirm the authorization once, thereby improving the convenience of obtaining user authorization and eliminating the need for users to repeatedly operate; at the same time, by performing secondary verification on the service provider to avoid fake services and replay attacks; further, based on the standard message system architecture, the authorization service roles involved in application authorization are reduced, and the operator is used to perform necessity analysis, and the 5G message supporting hidden return function is called to complete the authorization, thereby improving the security of the authorization, and the data source of the analysis process meets the compliance requirements of foreign jurisdictions such as GDPR (General Data Protection Regulation) or domestic personal information privacy protection.

[0110] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0111] Based on the same inventive concept, the embodiments of the present application also provide an application authorization device for implementing the aforementioned application authorization method. The implementation solution provided by this device is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations in one or more application authorization device embodiments provided below can be found in the above-mentioned limitations on the application authorization method and will not be repeated here.

[0112] In one embodiment, as shown in FIG6 , an application authorization device 600 is provided, the device including:

[0113] The request receiving module 601 is used to receive an authorization request for a terminal transmitted by a service provider; the authorization request is used to request to obtain sensitive information of the terminal;

[0114] The authentication module 602 is configured to authenticate the service provider based on the authorization request and transmit the authorization request to the terminal if the authentication of the service provider is successful;

[0115] A type determination module 603 is configured to, in response to receiving a first authorization result fed back by the terminal based on the authorization request, determine the request type to which the authorization request belongs if the first authorization result is authorization passed;

[0116] The information output module 604 is configured to transmit the sensitive information to the service provider when it is determined that the request type of the authorization request is a normal authorization request.

[0117] In one embodiment, the information output module 604 is further configured to transmit the authorization request to the terminal when it is determined that the request type to which the authorization request belongs is an abnormal authorization request;

[0118] In response to receiving a second authorization result fed back by the terminal based on the authorization request, if the second authorization result is authorization passed, the sensitive information is transmitted to the service provider.

[0119] In one embodiment, the identity authentication module 602 is further configured to obtain the identity identification information corresponding to the service provider and the region to which the service provider belongs;

[0120] When the information matches successfully based on the identity identification information and the region to which the service provider belongs, it is determined that the service provider's identity authentication is successful.

[0121] In one embodiment, the type determination module 603 is further configured to obtain corresponding historical authorization information; the historical authorization information includes historical feedback information and historical behavior ratio; the historical feedback information includes the authorization rate of the terminal for authorization requests of the same type, and the historical behavior ratio is the ratio of the number of authorization requests of any type output by the service provider to the total number of authorization requests;

[0122] Based on historical feedback information, historical behavior ratio, and the type of sensitive information, confirm the necessity of sensitive information to determine the request type of the authorization request.

[0123] In one embodiment, the type determination module 603 is further used to perform necessity analysis on historical feedback information and historical behavior ratios using an analysis model based on the type of sensitive information; the analysis model includes at least one of a random forest model, a clustering model, and a decision tree model.

[0124] In one embodiment, the service provider is a Chatbot.

[0125] Each module in the aforementioned application authorization device may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0126] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in Figure 7. The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, memory, and I / O interface are connected via a system bus, and the communication interface is connected to the system bus via the I / O interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device can be used to store identity identification information and sensitive information of legitimate service providers. The I / O interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an application authorization method.

[0127] Those skilled in the art will understand that the structure shown in FIG7 is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0128] In one embodiment, the present application further provides an application authorization system, comprising the aforementioned computer device, a terminal, and a service provider; wherein the terminal communicates with the service provider via the computer device.

[0129] Exemplarily, the system adopts any of the application authorization methods described in the above embodiments, and realizes the functions of the system through the application authorization method, as well as other corresponding applications performed by the application authorization method. It should be noted that the embodiment of the present application is based on the user sensitive information authorization and authentication design in the Chatbot (service provider) in the 5G messaging environment.

[0130] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned application authorization method is implemented.

[0131] In one embodiment, a computer program product is provided, including a computer program, which implements the above-mentioned application authorization method when executed by a processor.

[0132] It should be noted that the sensitive information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0133] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0134] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0135] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. An application authorization method, comprising: receiving an authorization request for the terminal transmitted by a service provider; The authorization request is used to request to obtain sensitive information of the terminal; authenticating the service provider based on the authorization request, and transmitting the authorization request to the terminal if the service provider's identity authentication is successful; In response to receiving a first authorization result fed back by the terminal based on the authorization request, if the first authorization result is authorization passed, determining the request type to which the authorization request belongs; When it is determined that the request type to which the authorization request belongs is a normal authorization request, the sensitive information is transmitted to the service provider.

2. The method according to claim 1, further comprising: When it is determined that the request type to which the authorization request belongs is an abnormal authorization request, transmitting the authorization request to the terminal; In response to receiving a second authorization result fed back by the terminal based on the authorization request, if the second authorization result is authorization passed, transmitting the sensitive information to the service provider.

3. The method according to claim 1, wherein: The authenticating the service provider based on the authorization request includes: Obtaining the identity information corresponding to the service provider and the region to which the service provider belongs; When it is confirmed that the information matches successfully based on the identity identification information and the region to which the service provider belongs, it is determined that the identity authentication of the service provider is successful.

4. The method according to claim 1, wherein: The determining the request type to which the authorization request belongs includes: Obtaining corresponding historical authorization information; the historical authorization information includes historical feedback information and historical behavior ratio; the historical feedback information includes the authorization rate fed back by the terminal for the authorization request of the same type, and the historical behavior ratio is the ratio of the number of the authorization requests of any type output by the service provider to the sum of the total number of the authorization requests; According to the historical feedback information, the historical behavior ratio and the type of sensitive information, the sensitive information is confirmed. The necessity of sensing information is used to determine the request type to which the authorization request belongs.

5. The method according to claim 4, wherein: The confirming the necessity of the sensitive information based on the historical feedback information, the historical behavior ratio and the type of the sensitive information includes: According to the type of the sensitive information, an analysis model is used to perform a necessity analysis on the historical feedback information and the historical behavior ratio; the analysis model includes at least one of a random forest model, a clustering model, and a decision tree model.

6. The method according to claim 5, wherein: According to the type of the sensitive information, the necessity analysis of the historical feedback information and the historical behavior ratio is performed using an analysis model, including: Get the authorization necessity value; Comparing the authorization necessity value with a preset value; The necessity of the sensitive information is confirmed based on the comparison result to determine whether the request type of the authorization request is a normal authorization request or an abnormal authorization request.

7. The method according to any one of claims 1 to 6, wherein: The service provider is Chatbot.

8. The method according to any one of claims 1 to 6, wherein: The sensitive information includes device information of the terminal and / or user information of the terminal.

9. The method according to claim 1, wherein: The step of, in response to receiving a first authorization result fed back by the terminal based on the authorization request, determining, when the first authorization result is authorization passed, a request type to which the authorization request belongs, includes: transmitting the authorization request to the terminal; When the terminal receives the authorization request, displaying the authorization page; Confirming whether the authorization is passed on the authorization page displayed on the terminal and feeding back the first authorization result; When the first authorization result is authorization passed, determine the request type to which the authorization request belongs.

10. The method according to claim 3, wherein: The determining that the identity authentication of the service provider is successful, based on the identity identification information and the region to which the service provider belongs, when confirming that the information matches successfully, includes: Obtaining the stored legal identity information and legal region of the service provider; Matching the identity information and the region to which the service provider belongs with the legal identity information and the legal region to which it belongs respectively; In the case where the identity identification information matches the legal identity identification information, and the region to which the service provider belongs matches the legal region to which it belongs, it is determined that the identity authentication of the service provider is successful.

11. An application authorization device, comprising: A request receiving module, used for receiving an authorization request for a terminal transmitted by a service provider; The authorization request is used to request to obtain sensitive information of the terminal; An identity authentication module, configured to authenticate the service provider based on the authorization request, and transmit the authorization request to the terminal if the service provider identity authentication succeeds; a type determination module, configured to, in response to receiving a first authorization result fed back by the terminal based on the authorization request, determine the request type to which the authorization request belongs when the first authorization result is authorization passed; The information output module is used to transmit the sensitive information to the service provider when it is determined that the request type to which the authorization request belongs is a normal authorization request.

12. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

13. An application authorization system, comprising the computer device according to claim 12, and further comprising a terminal and a service provider; wherein: The terminal communicates with the service provider through the computer device.

14. A computer-readable storage medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images