Account login

Abstract

Embodiments of the present description disclose an account login method and apparatus, a storage medium, and an electronic device. User equipment has a trusted execution environment, and the trusted execution environment stores an encryption key agreed on by an application party and a communication operator. An application party client sends a token application request to a communication operator server in response to an account login request, so as to cause the communication operator server to return an authentication token, and an association between the authentication token and a communication identifier bound to the user equipment is established. The trusted execution environment is called to generate encrypted data, the encrypted data being obtained by encrypting the authentication token with the encryption key. An authorization request carrying the encrypted data is sent to an application party server, so that the application party server sends the encrypted data to the communication operator server, and the communication operator server decrypts the encrypted data on the basis of a decryption key, and returns the communication identifier associated with the authentication token, ultimately causing the application party server to determine an application account associated with the communication identifier and authorize login to the application account.

Description

Account Login Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an account login method, device, storage medium and electronic device. Background Art

[0002] Currently, communication-based quick login technologies are quite popular. This technology can save users from tedious operations (such as entering identity authentication information) when logging into their accounts on the application client, achieving quick account login. A common communication-based quick login technology can be mobile phone one-click login technology.

[0003] Specifically, the user device can be bound to the communication identifier assigned by the communication operator. The application client installed on the user device can respond to the account login request and apply for an authentication token from the communication operator server. The communication operator server generates an authentication token associated with the communication identifier and returns the authentication token to the application client. The application client then sends the authentication token to the application server, which further sends the authentication token to the communication operator server. The communication operator server returns the communication identifier associated with the received authentication token to the application server. The application server can then confirm that the application client wants to log in to the application account corresponding to this communication identifier and issue a login authorization for this application account to the application client.

[0004] However, the above-mentioned quick login technology based on communication identification is not secure enough. Summary of the Invention

[0005] An embodiment of the present specification provides an account login method, wherein a user device has a trusted execution environment, wherein the trusted execution environment stores an encryption key agreed upon by an application party and a communication operator, and the method is applied to an application party client on the user device, and the method comprises: in response to an account login request, sending a token application request to a communication operator server, so that the communication operator server returns an authentication token and establishes an association between the authentication token and a communication identifier bound to the user device; calling the trusted execution environment to generate encrypted data, wherein the encrypted data is obtained by encrypting the authentication token with the encryption key; sending an authorization request carrying the encrypted data to an application party server, so that the application party server sends the encrypted data to the communication operator server, and then the communication operator server decrypts the encrypted data based on a decryption key, returns the communication identifier associated with the decrypted authentication token, and finally enables the application party server to determine the application account associated with the communication identifier and authorize login to the application account.

[0006] An embodiment of the present specification provides an account login method, wherein a user device has a trusted execution environment, wherein the trusted execution environment stores an encryption key agreed upon by an application party and a communication operator, and the method is applied to a communication operator server, and the method comprises: receiving a token application request sent by an application party client on the user device in response to an account login request; returning an authentication token, and establishing an association between the authentication token and a communication identifier bound to the user device, so that the application party client calls the trusted execution environment to generate encrypted data, wherein the encrypted data is obtained by encrypting the authentication token with the encryption key, and then the application party client sends an authorization request carrying the encrypted data to the application party server, and finally the application party server sends the encrypted data to the communication operator server; decrypting the encrypted data based on a decryption key, and returning the communication identifier associated with the decrypted authentication token, so that the application party server determines the application account associated with the communication identifier and authorizes login to the application account.

[0007] An embodiment of this specification also provides an account login method, wherein a user device has a trusted execution environment, and the trusted execution environment stores an encryption key agreed upon by an application party and a communication operator, and the method is applied to an application party server, and the method comprises: receiving an authorization request carrying encrypted data; wherein the application party client of the user device sends a token application request to the communication operator server in response to the account login request; the communication operator server returns an authentication token and establishes an association between the authentication token and a communication identifier bound to the user device; the application party client calls the trusted execution environment to generate the encrypted data, and the encrypted data is obtained by encrypting the authentication token with the encryption key; the encrypted data is sent to the communication operator server, so that the communication operator server decrypts the encrypted data based on the decryption key and returns the communication identifier associated with the decrypted authentication token; determines the application account associated with the communication identifier, and authorizes login to the application account.

[0008] An embodiment of this specification also provides an account login device, wherein a user device has a trusted execution environment, and the trusted execution environment stores an encryption key agreed upon by an application party and a communication operator, and the device is applied to an application party client on the user device, and the device includes: a first sending module, which sends a token application request to a communication operator server in response to an account login request, so that the communication operator server returns an authentication token and establishes an association between the authentication token and a communication identifier bound to the user device; a calling module, which calls the trusted execution environment to generate encrypted data, and the encrypted data is obtained by encrypting the login scenario identifier and the authentication token with the encryption key; a second sending module, which sends an authorization request carrying the encrypted data to the application party server, so that the application party server sends the encrypted data to the communication operator server, and then the communication operator server decrypts the encrypted data based on the decryption key, returns the communication identifier associated with the decrypted authentication token, and finally enables the application party server to determine the application account associated with the communication identifier and authorize login to the application account.

[0009] An embodiment of this specification also provides an account login device, wherein a user device has a trusted execution environment, and the trusted execution environment stores an encryption key agreed upon by an application party and a communication operator, and the device is applied to a communication operator server, and the device includes: a receiving module, which receives a token application request sent by an application party client on the user device in response to an account login request; an establishing module, which returns an authentication token and establishes an association between the authentication token and a communication identifier bound to the user device, so that the application party client calls the trusted execution environment to generate encrypted data, and the encrypted data is obtained by encrypting the authentication token with the encryption key, thereby enabling the application party client to send an authorization request carrying the encrypted data to the application party server, and finally enabling the application party server to send the encrypted data to the communication operator server; a returning module, which decrypts the encrypted data based on a decryption key, and returns the communication identifier associated with the decrypted authentication token, so that the application party server determines the application account associated with the communication identifier and authorizes login to the application account.

[0010] An embodiment of this specification also provides an account login device, wherein a user device has a trusted execution environment, and the trusted execution environment stores an encryption key agreed upon by an application party and a communication operator, and the device is applied to an application party server, and the device includes: a receiving module, which receives an authorization request carrying encrypted data; wherein the application party client of the user device sends a token application request to the communication operator server in response to the account login request; the communication operator server returns an authentication token and establishes an association between the authentication token and a communication identifier bound to the user device; the application party client calls the trusted execution environment to generate the encrypted data, and the encrypted data is obtained by encrypting the authentication token with the encryption key; a sending module, which sends the encrypted data to the communication operator server, so that the communication operator server decrypts the encrypted data based on the decryption key and returns the communication identifier associated with the decrypted authentication token; an authorization module, which determines the application account associated with the communication identifier and authorizes login to the application account.

[0011] An embodiment of this specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is suitable for being loaded by a processor and executing the above method steps.

[0012] An embodiment of this specification further provides a storage medium, wherein the storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing the steps of the above method.

[0013] An embodiment of this specification further provides an electronic device, comprising: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the steps of the above method.

[0014] In the embodiments of this specification, a root of trust is added to the quick login process based on the communication identifier to improve the security of the login process. Specifically, the encryption key agreed upon by the application party and the communication operator can be used as the root of trust, and the encryption key can be stored and used by the trusted execution environment of the user device. In this way, the encryption key will not be leaked, and the encryption process using the encryption key will not be exposed. After the application party client applies for an authentication token from the communication operator server, on the one hand, the communication operator server needs to establish an association between the authentication token and the communication identifier bound to the user device. On the other hand, the application party client will call the trusted execution environment and use the encryption key to encrypt the authentication token to obtain encrypted data. Then, when the application party client applies for login authorization to the application party server, it needs to upload encrypted data to the application party server. In this way, the application party server can send the encrypted data to the communication operator server, and the communication operator server will determine the communication identifier associated with the application account to be logged in on the application party client by decrypting the encrypted data. For the communication operator's server, it is clear that even if a Trojan program that is not an application party obtains the authentication token, it is unable to call the encryption key belonging to the application party in the trusted execution environment for encryption. This means that the authentication token decrypted by the communication operator's server using the decryption key corresponding to the encryption key must be the authentication token used by the application party's client, and it cannot be the authentication token impersonated by a Trojan program that is not an application party. Therefore, the communication operator's server can safely feedback the communication identifier associated with the authentication token to the application party's server, and the application server can trust the feedback from the communication operator's server, determine the application account associated with the communication identifier as an application account that can be safely logged in, and authorize login to this application account.

[0015] Through the embodiments of this specification, it is possible to effectively prevent a Trojan horse program that is not an application party from illegally logging in by using the authentication token used to log in to the application party's application account. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] FIG1 is a flow chart showing a typical quick login technology based on communication identification.

[0017] FIG2 is a flow chart of an account login method provided by the present disclosure.

[0018] FIG3 is a flow chart of another account login method provided by the present disclosure.

[0019] FIG4 is a flow chart of another account login method provided by the present disclosure.

[0020] FIG5 is a flow chart of another account login method provided by the present disclosure.

[0021] FIG6 is a flow chart of another account login method provided by the present disclosure.

[0022] FIG7 is a schematic structural diagram of an account login device provided by the present disclosure.

[0023] FIG8 is a schematic structural diagram of another account login device provided by the present disclosure.

[0024] FIG9 is a schematic structural diagram of another account login device provided by the present disclosure.

[0025] FIG10 is a schematic structural diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0026] To make the objectives, technical solutions, and advantages of this specification more clear, the following will clearly and completely describe the technical solutions of this specification in conjunction with the specific embodiments of this specification and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this specification.

[0027] The communication identifier-based quick login technology described in this disclosure can be, for example, a one-click login technology using a mobile phone. In this example, the user device is a mobile phone, the communication identifier is a mobile phone number, and the communication operator is a telecom operator such as China Mobile or China Unicom. Furthermore, the user device can also be a mobile device other than a mobile phone, or a non-mobile device, while the communication identifier (such as a mobile phone number) is bound to the user device. As long as the user device is connected to a communication network, the communication operator can obtain the communication identifier bound to the user device through the communication network.

[0028] Figure 1 shows a typical quick login technology process based on communication identification. As shown in Figure 1, the user operates the application client installed on the user device and wants to log in to his application account on the application client. The application client can enter the quick login mode actively or according to the user's choice (generally speaking, the user's application account is associated with the communication identification used by the user, and the user also binds this communication identification to the user device he uses). In the quick login mode, the application client applies to the communication operator server for an authentication token. The communication operator server can, on the one hand, return an authentication token to the application client, and on the other hand, use the communication network to obtain the communication identification bound to the user device and establish an association between the communication identification and the authentication token. Then, the application client sends this authentication token to the application server. Based on this authentication token, the application server further requests the communication operator server to obtain the associated communication identification. The communication operator's server finds the associated communication identifier based on the authentication token provided by the application server, and then feeds the communication identifier back to the application server. The application server further determines the application account that the user wants to log in based on the communication identifier, and can then perform login authorization for the application account, such as issuing an authorization token associated with the application account to the application client.

[0029] During the aforementioned quick login process, users are unaware of the process and do not need to perform operations such as entering a password or verifying their face. However, there are security vulnerabilities in the aforementioned quick login process. If a Trojan program that is not the identity of the application party is installed on the user's device, the Trojan program can steal the authentication token requested by the application party's client, or it can impersonate the application party's client and apply for an authentication token from the communication operator's server. The Trojan program can then impersonate the application party's client and use the authentication token to request authorization from the application party's server to log in to the application account. This is obviously a major threat to the user's application account security.

[0030] To this end, in one or more embodiments of the present disclosure, a root of trust is added to the quick login process based on the communication identifier to improve the security of the login process. Specifically, the encryption key agreed upon by the application party and the communication operator can be used as the root of trust, and the encryption key can be stored and used in the trusted execution environment of the user device. In this way, the encryption key will not be leaked, and the encryption process using the encryption key will not be exposed. After the application party client applies for an authentication token from the communication operator server, on the one hand, the communication operator server needs to establish an association between the authentication token and the communication identifier bound to the user device. On the other hand, the application party client will call the trusted execution environment and use the encryption key to encrypt the authentication token to obtain encrypted data. Then, when the application party client applies for login authorization to the application party server, it needs to upload encrypted data to the application party server. In this way, the application party server can send the encrypted data to the communication operator server, and the communication operator server will determine the communication identifier associated with the application account to be logged in on the application party client by decrypting the encrypted data. For the communication operator's server, it is clear that even if a Trojan program that is not an application party obtains the authentication token, it is unable to call the encryption key belonging to the application party in the trusted execution environment for encryption. This means that the authentication token decrypted by the communication operator's server using the decryption key corresponding to the encryption key must be the authentication token used by the application party's client, and it cannot be the authentication token impersonated by a Trojan program that is not an application party. Therefore, the communication operator's server can safely feedback the communication identifier associated with the authentication token to the application party's server, and the application server can trust the feedback from the communication operator's server, determine the application account associated with the communication identifier as an application account that can be safely logged in, and authorize login to this application account.

[0031] Through the embodiments of this specification, it is possible to effectively prevent a Trojan horse program that is not an application party from illegally logging in by using the authentication token used to log in to the application party's application account.

[0032] FIG2 is a flow chart of an account login method provided by the present disclosure, which includes the following steps.

[0033] S200: In response to the account login request, the application client sends a token application request to the communication operator server.

[0034] The application provider can be the individual or organization that provides application services to users. The application provider client is a client developed by the application provider and installed on the user's device. Accordingly, in a client-server architecture, the application provider client interacts with the application provider server through the network. When a user logs into an application account on the application provider client, the application provider server must provide login authorization.

[0035] A user device can be a user's mobile phone, tablet computer, desktop computer, or other device. A user device can access a communication network as a communication identifier. For example, a user device can be equipped with a Subscriber Identity Module (SIM) card provided by a communication operator (such as China Unicom or China Mobile). The communication number associated with the SIM card can be used as the communication identifier bound to the user device. The communication operator's server is able to obtain the communication identifier bound to the user device through the communication network.

[0036] Before implementing the technical solution provided by the present disclosure, the application party and the communication operator need to agree on an encryption key and a corresponding decryption key. It is easy to understand that the key agreed upon by the application party and the communication party can only be mastered and used by both parties. The application party can communicate with the manufacturer of the user device or use other technical means to write the encryption key into the trusted execution environment (TEE) of the user device. Accordingly, the communication operator's server needs to store the decryption key corresponding to the encryption key.

[0037] In some embodiments, the encryption key and the decryption key may be a symmetric key pair. In other embodiments, the encryption key may be a private key and the decryption key may be a public key. Thus, encrypting data using the encryption key may be considered as signing the data.

[0038] S202: The communication operator's server returns an authentication token.

[0039] S204: The communication operator server establishes an association between the authentication token and the communication identifier bound to the user equipment.

[0040] When the communication operator's server returns the authentication token to the application client, it can also return the communication identification mask (such as the mobile phone number mask) so that the application client can display the communication identification mask to the user.

[0041] S206: The application client calls the trusted execution environment to generate encrypted data.

[0042] The encryption key is stored within the trusted execution environment and is not disclosed to the outside world. This means that even a Trojan horse program not affiliated with the application cannot obtain the encryption key. Furthermore, the encryption operation using the encryption key to encrypt the authentication token is also performed within the trusted execution environment, and the trusted execution environment returns the encrypted data to the application client.

[0043] It should be noted that even if a non-application Trojan program installed on the user's device can intercept the plaintext authentication token, since the Trojan program does not have the ability to call the trusted execution environment to encrypt the authentication token using the encryption key belonging to the application's identity, the Trojan program cannot actually use legally generated encrypted data to request the application server to authorize itself to log in to the application account.

[0044] S208: The application client sends an authorization request carrying the encrypted data to the application server.

[0045] S210: The application server sends the encrypted data to the communication operator server.

[0046] S212: The communication operator server decrypts the encrypted data based on the decryption key.

[0047] The communication operator's server can use the decryption key corresponding to the encryption key agreed upon with the application to decrypt the encrypted data and obtain an authentication token used to request this login authorization. Moreover, it can be confirmed that this encrypted data cannot be generated by a Trojan program that is not the identity of the application party and provided to the application party's server. It must be generated by the application party's client based on a legitimate account login request and provided to the application party's server.

[0048] S214: The communication operator server returns the communication identifier associated with the decrypted authentication token.

[0049] The communication operator's server returns the communication identifier to the application's server.

[0050] S216: The application server determines the application account associated with the communication identifier.

[0051] It should be noted that users usually pre-associate the application account they register on the application server with the communication identifier bound to the user device they use, so that they can directly use the communication identifier to log in to the application account, eliminating the trouble of entering the account name and password.

[0052] S218: The application server authorizes the application account to log in.

[0053] It's easy to understand that the application server's authorization to log into the application account actually involves issuing an authorization token to the client that sent the authorization request to the application server (in each embodiment of the present disclosure, the client must be the application client, not a non-application Trojan horse program). During the validity period of the authorization token, the application client can remain logged into the application account.

[0054] In some embodiments, the token application request may carry a login scenario identifier specified by the account login request. The login scenario can be understood as the application function area that the user wants to access through the application account. For an application client with a relatively simple application function, the login scenario is the application client itself, so the login scenario identifier can be the application client identifier (or package name). For an application client with a relatively diverse application function, the login scenario is the different internal function areas of the application client, so the login scenario identifier can be "client identifier + application client internal function entry identifier (or application id)". If you want to treat the same internal function areas of the same application client on different user devices as different login scenarios, then the login scenario identifier can be "client identifier + application client internal function entry identifier + user device device identifier".

[0055] For the communication operator's server, if it needs to provide quick login services for multiple different application parties, then this requires that any application party client must carry a login scenario identifier when sending a token application request to the communication operator's server, indicating for which login scenario the authentication token needs to be applied for to quickly log in to the application account.

[0056] The communication operator's server establishes an association between the login scenario identifier, the authentication token, and the communication identifier bound to the user device. Accordingly, in step S206, the encrypted data is obtained by encrypting the authentication token and the login scenario identifier using the encryption key. In step S214, the communication operator's server returns the communication identifier associated with the authentication token and the login scenario identifier.

[0057] In some embodiments, if the application party client includes multiple functional areas, then the application scenario identifier can be the application party client identifier + internal function entry identifier, and the application scenario identifier can be carried in the authorization request so that the application party server can issue authorization for application account login for the application scenario corresponding to the application scenario identifier.

[0058] In some embodiments, the application and the communication operator can agree on different encryption keys for different login scenario identifiers. In this way, the encrypted data is the encryption key corresponding to the login scenario identifier, obtained by encrypting the login scenario identifier and the authentication token. In step S212, the communication operator's server can decrypt the encrypted data using the decryption key corresponding to the login scenario identifier.

[0059] In addition, it is necessary to consider the following situation that may occur in practice: the authentication token applied for by the application client on the user's device to the communication operator's server is intercepted by a Trojan program with a non-application identity on the user's device. The Trojan program sends the intercepted authentication token to a malicious user, allowing the malicious user to log in using the application client on other user devices.

[0060] In order to prevent the risks caused by the above situation, the same internal functional area of ​​the same application client on different user devices can be regarded as different login scenarios. Then, the login scenario identifier can be "client identifier + application client internal function entry identifier + user device device identifier". In this way, for the above situation, even if a malicious user intercepts the authentication token on the user device and uses the application client on other user devices to log in based on the authentication token, when the application client on the other user device calls the trusted execution environment on the other device to generate encrypted data, the encryption key used is not the encryption key corresponding to the original login scenario identifier. When such encrypted data is subsequently submitted to the communication operator server, the communication operator server cannot use the decryption key corresponding to the original login scenario identifier to successfully decrypt it. Therefore, the communication operator server will not feedback the communication identifier associated with the authentication token and the original login scenario identifier to the application server, and the application server will not be able to authorize the application client on the other user device used by the malicious user to log in. Please refer to Figure 3, which is a schematic diagram of an account login method provided by the present disclosure.

[0061] It is easy to understand that in the embodiment shown in Figure 3, not only can the non-application Trojan program on the user device be prevented from intercepting the authentication token on the user device and impersonating the application client to log in to the user account, but also the non-application Trojan program on the user device can be prevented from intercepting the authentication token on the user device and helping malicious users to log in to the application client on other user devices.

[0062] In addition, in some embodiments, before the application client calls the trusted execution environment to generate encrypted data, the application client may also call the trusted execution environment to execute: generate a random number, and encrypt the random number using the encryption key. The application client may send the encrypted random number to the communication operator server, so that the communication operator server decrypts the encrypted random number based on the decryption key. In step S204, the communication operator server may establish an association between the authentication token, the login scenario identifier, the communication identifier bound to the user device, and the random number. In this way, in step S206, the application client subsequently calls the trusted execution environment to generate encrypted data, which may be obtained by encrypting the login scenario identifier, the authentication token, and the random number using the encryption key. And in step S214, the communication operator server may return the communication identifier associated with the login scenario identifier, the authentication token, and the random number. Please refer to Figure 4, which is a schematic diagram of another account login method provided by the present disclosure.

[0063] It is easy to understand that in the embodiment shown in Figure 4, a random number is essentially used as a trust root. The random number generated for each account login request is usually different. Therefore, the application party and the communication operator can agree on different encryption keys for different login scenario identifiers, or they can agree on the same encryption key without affecting security.

[0064] In some embodiments, the application client includes an application module and a communication operator's software development kit (SDK). The application module is primarily responsible for the application functionality of the application client, interacting with the application server on the back end and with users on the front end, and may also be responsible for invoking the trusted execution environment. The SDK, on ​​the other hand, is primarily responsible for interacting with the communication operator's server and may also be responsible for invoking the trusted execution environment.

[0065] In this way, in step S200, the application module may specifically respond to the account login request by notifying the SDK of the account login request, and then the SDK may send a token application request to the communication operator's server. In step S208, the application module may send an authorization request carrying encrypted data to the application server.

[0066] Furthermore, in step S206, the SDK may call the trusted execution environment to generate encrypted data, and the SDK may then send the encrypted data to the application module. Alternatively, the application module may call the trusted execution environment to generate encrypted data. Furthermore, in the aforementioned embodiment, the application module or SDK may also call the trusted execution environment to generate a random number and encrypt the random number using the encryption key.

[0067] Therefore, based on Figure 3, if the application client includes an application module and an SDK, it can be shown as Figure 5. Based on Figure 4, if the application client includes an application module and an SDK, it can be shown as Figure 6.

[0068] In addition, the present disclosure provides an account login device, as shown in Figure 7, wherein the user device has a trusted execution environment, wherein the trusted execution environment stores an encryption key agreed upon by the application party and the communication operator, and the device is applied to the application party client on the user device, and the device includes: a first sending module 701, which sends a token application request to the communication operator server in response to an account login request, so that the communication operator server returns an authentication token and establishes an association between the authentication token and the communication identifier bound to the user device; a calling module 702, which calls the trusted execution environment to generate encrypted data, wherein the encrypted data is obtained by encrypting the login scenario identifier and the authentication token with the encryption key; a second sending module 703, which sends an authorization request carrying the encrypted data to the application party server, so that the application party server sends the encrypted data to the communication operator server, and then the communication operator server decrypts the encrypted data based on the decryption key and returns the communication identifier associated with the decrypted authentication token, so that the application party server finally determines the application account associated with the communication identifier and authorizes login to the application account.

[0069] The present disclosure provides an account login device, as shown in Figure 8, wherein a user device has a trusted execution environment, wherein the trusted execution environment stores an encryption key agreed upon by an application party and a communication operator, and the device is applied to a communication operator server, and the device includes: a receiving module 801, which receives a token application request sent by an application party client on the user device in response to an account login request; an establishing module 802, which returns an authentication token and establishes an association between the authentication token and a communication identifier bound to the user device, so that the application party client calls the trusted execution environment to generate encrypted data, wherein the encrypted data is obtained by encrypting the authentication token with the encryption key, thereby enabling the application party client to send an authorization request carrying the encrypted data to the application party server, and finally enabling the application party server to send the encrypted data to the communication operator server; a returning module 803, which decrypts the encrypted data based on a decryption key and returns the communication identifier associated with the authentication token, so that the application party server determines the application account associated with the communication identifier and authorizes login to the application account.

[0070] The present disclosure provides an account login device, as shown in Figure 9, a user device has a trusted execution environment, the trusted execution environment stores an encryption key agreed upon by an application party and a communication operator, the device is applied to an application party server, the device includes: a receiving module 901, receiving an authorization request carrying encrypted data; wherein, the application party client of the user device sends a token application request to the communication operator server in response to the account login request; the communication operator server returns an authentication token and establishes an association between the authentication token and a communication identifier bound to the user device; the application party client calls the trusted execution environment to generate the encrypted data, and the encrypted data is obtained by encrypting the authentication token with the encryption key; a sending module 902, sending the encrypted data to the communication operator server, so that the communication operator server decrypts the encrypted data based on the decryption key and returns the communication identifier associated with the authentication token; an authorization module 903, determining the application account associated with the communication identifier, and authorizing login to the application account.

[0071] The above-mentioned device embodiments correspond to the method embodiments. For detailed descriptions, please refer to the description of the method embodiments, which will not be repeated here. The device embodiments are obtained based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments. For detailed descriptions, please refer to the corresponding method embodiments.

[0072] The embodiments of this specification also provide a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded by a processor to execute the method of the embodiments of this disclosure.

[0073] This specification also provides a computer program product, which stores at least one instruction. The at least one instruction is loaded by the processor and executes the method of the embodiment of the present disclosure.

[0074] The embodiments of this specification also provide a schematic diagram of the electronic device shown in Figure 10. As shown in Figure 10, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, memory, and non-volatile storage, and may also include other necessary hardware. The processor reads the corresponding computer program from the non-volatile storage into the memory and then executes it to implement the above-mentioned voice activity detection method.

[0075] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0076] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0077] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0078] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0079] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0080] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0081] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0082] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0083] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0084] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0085] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0086] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0087] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0088] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Thus, this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0089] This specification may be described in the general context of computer-executable instructions, such as program modules, executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media, including storage devices.

[0090] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0091] The foregoing is merely an example of the present invention and is not intended to limit the present invention. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be included within the scope of the claims of the present invention.

Claims

1. An account login method, wherein the user device has a trusted execution environment, and an encryption key agreed upon by the application party and the communication operator is stored in the trusted execution environment. The method is applied to the application party client on the user device, and the method includes: In response to an account login request, sending a token application request to the communication operator server, so that the communication operator server returns an authentication token, and establishing an association between the authentication token and the communication identifier bound to the user device; Invoking the trusted execution environment to generate encrypted data, where the encrypted data is obtained by encrypting the authentication token with the encryption key; Sending an authorization request carrying the encrypted data to the application party server, so that the application party server sends the encrypted data to the communication operator server, and further enabling the communication operator server to decrypt the encrypted data based on the decryption key, return the communication identifier associated with the decrypted authentication token, and finally enabling the application party server to determine the application account associated with the communication identifier and authorize the login to the application account.

2. The method according to claim 1, wherein the token application request carries a login scenario identifier specified by the account login request; Establishing an association between the authentication token and the communication identifier bound to the user device includes: Establishing an association between the login scenario identifier, the authentication token, and the communication identifier bound to the user device; The encrypted data is obtained by encrypting the authentication token with the encryption key, including: The encrypted data is obtained by encrypting the authentication token and the login scenario identifier with the encryption key; Returning the communication identifier associated with the decrypted authentication token includes: Returning the communication identifier associated with the decrypted authentication token and the login scenario identifier.

3. The method according to claim 2, wherein the login scenario identifier includes: The client identifier of the application party client; Alternatively, the login scenario identifier includes: the client identifier and the internal function entry identifier of the application party client; Alternatively, the login scenario identifier includes: the device identifier of the user device, the client identifier, and the internal function entry identifier.

4. The method according to claim 1, wherein the user device includes a user mobile device, and the communication identifier includes a mobile communication number.

5. The method according to claim 1, wherein the encryption key and the decryption key are a symmetric key pair; Alternatively, the encryption key is a private key, and the decryption key is a public key.

6. The method according to any one of claims 2-5, wherein the application party and the communication operator agree on different encryption keys for different login scenario identifiers; The encrypted data is obtained by encrypting the login scenario identifier and the authentication token with the encryption key, including: The encrypted data is obtained by encrypting the login scenario identifier and the authentication token with the encryption key corresponding to the login scenario identifier; Decrypting the encrypted data based on the decryption key includes: Decrypting the encrypted data based on the decryption key corresponding to the login scenario identifier.

7. The method according to claim 6, before invoking the trusted execution environment to generate encrypted data, the method further includes: Invoke the trusted execution environment to execute: generate a random number, and encrypt the random number using the encryption key; Send the encrypted random number to the communication operator's server, so that the communication operator's server decrypts the encrypted random number based on the decryption key; Establish an association among the login scenario identifier, the authentication token, and the communication identifier bound to the user device, including: Establish an association among the authentication token, the login scenario identifier, the communication identifier bound to the user device, and the random number; The encrypted data is obtained by encrypting the authentication token and the login scenario identifier with the encryption key, including: The encrypted data is obtained by encrypting the login scenario identifier, the authentication token, and the random number with the encryption key; Return the communication identifier associated with the decrypted authentication token and the login scenario identifier, including: Return the communication identifier associated with the decrypted login scenario identifier, the authentication token, and the random number.

8. The method according to claim 1, wherein the application client includes an application module and a software development kit (SDK) of the communication operator; In response to an account login request, send a token application request to the communication operator's server, including: In response to the account login request, the application module notifies the SDK of the account login request; The SDK sends a token application request to the communication operator's server; Send an authorization request carrying the encrypted data to the application server, including: The application module sends an authorization request carrying the encrypted data to the application server.

9. The method according to claim 8, wherein invoking the trusted execution environment to generate encrypted data includes: The SDK invokes the trusted execution environment to generate encrypted data; The method further includes: The SDK sends the encrypted data to the application module.

10. An account login method, wherein the user device has a trusted execution environment, and an encryption key agreed upon by the application party and the communication operator is stored in the trusted execution environment. The method is applied to the communication operator's server, and the method includes: Receive the token application request sent by the application client on the user device in response to the account login request; Return an authentication token, and establish an association between the authentication token and the communication identifier bound to the user device, so that the application client invokes the trusted execution environment to generate encrypted data, which is obtained by encrypting the authentication token with the encryption key, and further enables the application client to send an authorization request carrying the encrypted data to the application server, and finally enables the application server to send the encrypted data to the communication operator's server; Decrypt the encrypted data based on the decryption key, and return the communication identifier associated with the decrypted authentication token, so that the application server determines the application account associated with the communication identifier and authorizes the login to the application account.

11. The method according to claim 10, wherein returning the authentication token includes: Return a mask of the authentication token and the communication identifier, so that the application client displays the mask to the user.

12. An account login method. The user device has a trusted execution environment, and an encryption key agreed upon by the application party and the communication operator is stored in the trusted execution environment. The method is applied to the application party server, and the method includes: Receiving an authorization request carrying encrypted data; wherein, the application party client of the user device sends a token application request to the communication operator server in response to an account login request; the communication operator server returns an authentication token and establishes an association between the authentication token and the communication identifier bound to the user device; the application party client calls the trusted execution environment to generate the encrypted data, and the encrypted data is obtained by encrypting the authentication token with the encryption key; Sending the encrypted data to the communication operator server, so that the communication operator server decrypts the encrypted data based on the decryption key and returns the communication identifier associated with the decrypted authentication token; Determining the application account associated with the communication identifier and authorizing the login to the application account.

13. An account login device. The user device has a trusted execution environment, and an encryption key agreed upon by the application party and the communication operator is stored in the trusted execution environment. The device is applied to the application party client on the user device, and the device includes: A first sending module, which sends a token application request to the communication operator server in response to an account login request, so that the communication operator server returns an authentication token and establishes an association between the authentication token and the communication identifier bound to the user device; A calling module, which calls the trusted execution environment to generate encrypted data, and the encrypted data is obtained by encrypting the login scenario identifier and the authentication token with the encryption key; A second sending module, which sends an authorization request carrying the encrypted data to the application party server, so that the application party server sends the encrypted data to the communication operator server, and further enables the communication operator server to decrypt the encrypted data based on the decryption key and return the communication identifier associated with the decrypted authentication token, and finally enables the application party server to determine the application account associated with the communication identifier and authorize the login to the application account.

14. An account login device. The user device has a trusted execution environment, and an encryption key agreed upon by the application party and the communication operator is stored in the trusted execution environment. The device is applied to the communication operator server, and the device includes: A receiving module, which receives the token application request sent by the application party client on the user device in response to an account login request; A establishing module, which returns an authentication token and establishes an association between the authentication token and the communication identifier bound to the user device, so that the application party client calls the trusted execution environment to generate encrypted data, and the encrypted data is obtained by encrypting the authentication token with the encryption key, and further enables the application party client to send an authorization request carrying the encrypted data to the application party server, and finally enables the application party server to send the encrypted data to the communication operator server; A return module decrypts the encrypted data based on a decryption key and returns the communication identifier associated with the authentication token obtained by decryption, so that the application server can determine the application account associated with the communication identifier and authorize the login to the application account.

15. An account login device, where the user device has a trusted execution environment, and an encryption key agreed upon by the application party and the communication operator is stored in the trusted execution environment. The device is applied to the application server and includes: A receiving module that receives an authorization request carrying encrypted data; wherein, the application client of the user device sends a token application request to the communication operator server in response to an account login request; the communication operator server returns an authentication token and establishes an association between the authentication token and the communication identifier bound to the user device; the application client invokes the trusted execution environment to generate the encrypted data, and the encrypted data is obtained by encrypting the authentication token with the encryption key. A sending module that sends the encrypted data to the communication operator server, so that the communication operator server decrypts the encrypted data based on the decryption key and returns the communication identifier associated with the authentication token obtained by decryption. An authorization module that determines the application account associated with the communication identifier and authorizes the login to the application account.

16. A storage medium, on which a computer program is stored, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-12.

17. An electronic device, characterized in that, including: A processor and a memory; wherein, the memory stores a computer program, and the computer program is adapted to be loaded and executed by the processor to implement the steps of the method according to any one of claims 1-12.

18. A computer program product having at least one instruction stored thereon, characterized in that, When the at least one instruction is executed by the processor, it implements the steps of the method according to any one of claims 1-12.

Images