WO2017157177A1 - 一种网站登录方法和装置 - Google Patents

一种网站登录方法和装置 Download PDF

Info

Publication number
WO2017157177A1
WO2017157177A1 PCT/CN2017/075459 CN2017075459W WO2017157177A1 WO 2017157177 A1 WO2017157177 A1 WO 2017157177A1 CN 2017075459 W CN2017075459 W CN 2017075459W WO 2017157177 A1 WO2017157177 A1 WO 2017157177A1
Authority
WO
WIPO (PCT)
Prior art keywords
website
token
login
page
proxy
Prior art date
Application number
PCT/CN2017/075459
Other languages
English (en)
French (fr)
Inventor
范晓锋
Original Assignee
阿里巴巴集团控股有限公司
范晓锋
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 范晓锋 filed Critical 阿里巴巴集团控股有限公司
Priority to SG11201807845QA priority Critical patent/SG11201807845QA/en
Priority to JP2018549223A priority patent/JP6749409B2/ja
Priority to KR1020187029719A priority patent/KR102148590B1/ko
Priority to EP17765719.4A priority patent/EP3432541B1/en
Priority to MYPI2018703227A priority patent/MY189956A/en
Publication of WO2017157177A1 publication Critical patent/WO2017157177A1/zh
Priority to US16/128,277 priority patent/US10721231B2/en
Priority to PH12018502007A priority patent/PH12018502007A1/en
Priority to US16/897,412 priority patent/US10868813B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/22—Indexing; Data structures therefor; Storage structures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/957—Browsing optimisation, e.g. caching or content distillation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/41—User authentication where a single sign-on provides access to a plurality of computers
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/12—Payment architectures specially adapted for electronic shopping systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0609—Buyer or seller confidence or verification
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0633—Lists, e.g. purchase orders, compilation or processing
    • G06Q30/0635—Processing of requisition or of purchase orders
    • G06Q30/0637—Approvals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G06F21/6263—Protecting personal data, e.g. for financial or medical purposes during internet communication, e.g. revealing personal data from cookies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/76—Proxy, i.e. using intermediary entity to perform cryptographic operations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present application relates to network technologies, and in particular, to a website login method and apparatus.
  • the user first visits a website through a browser, and in order to complete an operation process, it is necessary to jump from the website to another website for operation.
  • the user accesses the shopping website through a browser, and the shopping website displays a list of products to be selected for purchase.
  • the user selects the product to be settled, it is necessary to jump to the payment website for payment.
  • a login is required when the website jumps.
  • the shopping website is used to pay the website, the user name and password of the payment website need to be input. Waiting for login information, the process is cumbersome.
  • the present application provides a website login method and apparatus, so as to improve the security of the passwordless login in a scenario where multiple websites cooperate.
  • a website login method comprising:
  • the first website when receiving the website jump trigger, acquires a first token stored in a cookie of a browser where the first website is running, where the first token includes the first indication indicated by the website jump trigger a website identifier of one of the second websites of the second website list page, and a device fingerprint for indicating the login of the second website without the secret proxy;
  • the second token corresponding to the first token is obtained, and the second token is an access token that the second website grants the passwordless login permission after the user successfully logs in. ;
  • the first website sends a passwordless login request to the second website corresponding to the website identifier according to the website identifier in the first token, and carries a third token, where the third token includes the second order a card, and when the second website succeeds in verifying that the second token is successful, the password is not logged into the second website.
  • a second aspect provides a website login method, where the method is used to log in to a second website without a secret from a first website; the method includes:
  • the first website displays a website jump trigger identifier on the page, and the website jump trigger identifier is used to trigger the first website to jump to a website list page including a plurality of second websites for selection upon selection;
  • the first website jumps to display the logged-in page of one of the plurality of second websites of the plurality of second websites in the website listing page.
  • a third aspect provides a website login method, where the method is used to log in to a second website without a secret from a first website; the method includes:
  • the second website receives the passwordless login request sent by the first website, the passwordless login request carries a third token, the third token includes a second token, and the second token is a second
  • the website grants an access token with no secret login permission after the user logs in successfully;
  • a website login device where the device is applied to a first website, so that the first website has no secret agent to log in to the second website; the device includes:
  • a token obtaining module configured to acquire, when receiving a website jump trigger, a first token stored in a cookie of a browser where the first website is running, where the first token includes the website jump trigger indication a website identifier of one of the second websites of the second website list page, and a device fingerprint for indicating the login of the second website without the secret proxy;
  • a token verification module configured to determine, according to the fingerprint of the device, that the current operating environment is the same as the operating environment of the second website without a proxy proxy login setting, and acquiring the first token a second token, where the second token is an access token that the second website grants the passwordless login permission after the user logs in successfully;
  • the passwordless login module is configured to send a passwordless login request to the second website corresponding to the website identifier according to the website identifier in the first token, and carry a third token, where the third token includes the Two tokens, and when the second website succeeds in verifying that the second token is successful, the password is not logged into the second website.
  • a website login device where the device is applied to a first website, so that the first website has no secret agent to log in to the second website; the device includes:
  • An identifier display module configured to display a website jump trigger identifier on the page, where the identifier is used to trigger the first website to jump to a website list page including a plurality of second websites for selection upon selection;
  • the page jump module is configured to respond to the user's selection of the website jump trigger identifier, and jump to display the logged-in page of one of the second websites of the plurality of second websites in the website list page.
  • a website login device where the device is applied to a second website, so that the first website has no secret agent to log in to the second website; the device includes:
  • a request receiving module configured to receive a passwordless login request sent by the first website, where the passwordless login request carries a third token, where the third token includes a second token, and the second token is a
  • the second website grants an access token with no secret login permission after the user logs in successfully;
  • the login execution module is configured to perform a passwordless login when the second token is successful.
  • the website login method and device provided by the present application enable the first website and the second website to participate in the security check when logging in without a secret agent, thereby improving the security of the first website without a secret login to the second website.
  • FIG. 1 is a schematic diagram of a payment website login page according to an exemplary embodiment of the present application
  • FIG. 2 is a schematic diagram of a registered page shown in an exemplary embodiment of the present application.
  • FIG. 3 is a flow chart of setting a proxyless login according to an exemplary embodiment of the present application.
  • FIG. 4 is a flowchart of canceling a proxyless login according to an exemplary embodiment of the present application.
  • FIG. 5 is an application flow of a confidential proxy login according to an exemplary embodiment of the present application.
  • FIG. 6 is a schematic diagram showing a multi-site display according to an exemplary embodiment of the present application.
  • FIG. 7 is a schematic diagram showing an intermediate station display according to an exemplary embodiment of the present application.
  • FIG. 8 is a schematic diagram of a lower site of an intermediate site according to an exemplary embodiment of the present application.
  • FIG. 9 is a schematic diagram of a login page according to an exemplary embodiment of the present application.
  • FIG. 10 is a schematic diagram of a registered page according to an exemplary embodiment of the present application.
  • FIG. 11 is a structural diagram of a website login apparatus according to an exemplary embodiment of the present application.
  • FIG. 12 is a structural diagram of another website login apparatus according to an exemplary embodiment of the present application.
  • FIG. 13 is a structural diagram of still another website login apparatus according to an exemplary embodiment of the present application.
  • FIG. 14 is a structural diagram of still another website login apparatus according to an exemplary embodiment of the present application.
  • FIG. 15 is a structural diagram of still another website login apparatus according to an exemplary embodiment of the present application.
  • FIG. 16 is a structural diagram of still another website login apparatus according to an exemplary embodiment of the present application.
  • some websites can provide passwordless login. If there is no secret login, the user can directly log in to the account of one website without entering the user name and password.
  • the payment website can be set to be a non-secure login, so that when the user jumps from the shopping website to the payment website, the user name and password are no longer required to log in directly to the payment website.
  • non-secure login is not necessarily secure. If you only rely on the payment website to ensure the security of confidential login, it also has certain security risks.
  • the present disclosure provides a website login method, which can be applied to jump login between websites. For example, when a user jumps to a payment website at a shopping website, the method can be logged in using the method of the present disclosure. Payment website.
  • the method of the present disclosure is not limited to the example of a shopping scenario, and can be used in other similar processes between websites.
  • no secret proxy login In the following description of the website login method of the present disclosure, a concept word "no secret proxy login" is used, and the use of the word is intended to explain that the website login method of the present disclosure also requires a secret login to a jump website, such as payment. Website, but the difference from the usual non-secure login is that the two websites involved in the jump between the websites are involved in the security check. For example, in the example of a shopping scene, the shopping website jumps to the payment website, the shopping website performs security verification, and the payment website also performs security verification, so that the website can be finally registered without a secret registration. This is a dual authorization.
  • the secret proxy login can be automatically redirected by the shopping website to one of the payment websites for login (multiple payment websites can be linked under the shopping website), without requiring the user to select which payment website to log in without, which is equivalent to shopping.
  • the website knows which payment website to choose to go to the private directory.
  • the website login method of the present disclosure will be described below with an application example of a shopping website (which may be referred to as a first website) and a payment website (which may be referred to as a second website).
  • the description of the website login method of the present disclosure includes a process of setting a passwordless proxy login, and setting How to perform the process of login without secret proxy, these processes require cooperation between the shopping website and the payment website.
  • the settlement button may be referred to as a website jump trigger identifier, and the website jump triggers the role of the identifier.
  • the shopping website is triggered to jump to a website list page including a plurality of payment websites for selection.
  • the website list page can display the payment website A, the payment website B, the payment website C, etc., and the user can choose which payment method to use.
  • the shopping website may display the login page of the payment website selected by the user in the form of an embedded page. It should be noted that, at this time, the setting of the confidential proxy login has not been performed, and the shopping website still displays the website list page mentioned above when the user clicks the settlement button, and when the user selects a payment website, the display will be displayed.
  • the login page of the payment website is provided for the user to input the user name and password. See the page display example shown in FIG. 1.
  • the login page of the payment website A selected by the user may be displayed on the page of the shopping website in the form of an embedded page.
  • a payment website A may be displayed separately.
  • the page display related to the website jump is exemplified by the display form of the embedded page, and the embedded page display can facilitate the user to switch to another payment website at any time.
  • the selection identifier of the payment website B, the selection identifier of the payment website C, and the like displayed on the shopping website page together with the embedded page are displayed.
  • the user does not want to log in to the payment website A, it is convenient to select other sites such as the payment website B.
  • the login of the payment website A above is taken as an example.
  • the login page of the payment website A is loaded by the payment website A, and is transmitted by the server to the payment website client in the browser where the S is running for display.
  • the login page of the payment website A also displays the option of “Enable the login without proxy proxy” for the user to select whether to enable or not. If the user selects the option, the user wants to automatically jump to the logged-in page of the payment website after clicking the settlement button on the shopping website.
  • the logged-in page can be seen in Figure 2, as opposed to the original user operation.
  • the user no longer needs to select the payment website A in the website list page, and no longer needs to input the user name and password in FIG. 1 , but directly enters the display page after the login of the payment website A is successful, and performs payment confirmation. If the user does not select this option, it indicates that the user does not wish to achieve the simplification of the above operational flow.
  • the payment website A will receive the login information (for example, the user name and password entered by the user on the login page of Figure 1) And an instruction to request to set a non-secure login (when the user selects the above option, the indication is sent to the payment website A).
  • the login information for example, the user name and password entered by the user on the login page of Figure 1
  • an instruction to request to set a non-secure login when the user selects the above option, the indication is sent to the payment website A).
  • the payment website A After verifying the login information, the payment website A knows that the user needs to enable the non-secure proxy login after the login process, and the payment website A will start the setting process of the secretless proxy login, and the setting process will be paid.
  • the interaction between the website A and the shopping website S requires the payment website A to send a secret proxy login setting request to the shopping website, and requests the shopping website side to perform the setting of the non-secure proxy login, and after the shopping website is successfully set, The payment website A will also be notified that the confidential proxy login setting is successful.
  • Figure 3 illustrates the setup flow for a silent proxy login.
  • step 301 the payment website A creates a token a, which is used to indicate an access token granting a passwordless login authority.
  • the token a may be referred to as a second token (this second is only for distinguishing from the first token, the third token, etc. in the subsequent embodiments), and is the payment website A in verifying the user in the map.
  • the user name and password entered in 1 are created successfully.
  • the token a may include three aspects: a website identifier (which may be a website name) signed by the payment website A with the private key of the website, a current time signed by the website private key, and a user name in the login information, the user The name is encrypted separately by the public key of the payment website A and is signed by the website private key.
  • a website identifier (which may be a website name) signed by the payment website A with the private key of the website
  • a current time signed by the website private key a current time signed by the website private key
  • a user name in the login information
  • the respective roles of the three kinds of information in the above token a are: paying the website A in the subsequent steps
  • the token a will be carried, and the website identifier signed by the private key can be used to guarantee the authenticity of the setting request to the shopping website S; the private key signature therein
  • the current time can change the tokens created at different times over time to avoid repeated theft;
  • the encrypted and signed user name is mainly used for the user name by S when triggering the non-secure proxy login in the subsequent embodiment. Pass back to A to specify the user to perform the silent login.
  • the token involved in the embodiment of the present application in addition to encrypting the key, further includes a fingerprint of the key, so that when the corresponding website updates the key certificate, the old and new keys exist at the same time, and may be based on the token.
  • Other tokens involved in the following embodiments all contain corresponding key fingerprints and will not be repeated.
  • step 302 the payment website A sends a passwordless proxy login setting request to the shopping website S, carrying the token a.
  • the interaction communication between the payment website A and the shopping website S may be implemented by embedding the hidden page, and the communicated information is carried in the url of the embedded hidden page.
  • S can receive the setting request sent by A and the token a.
  • step 303 the shopping website S creates a token b containing the device fingerprint and the website identification of the payment website A.
  • the shopping website S will first verify the authenticity of the confidential proxy login setting request, and may use the public key of the payment website A to view the authenticity of the website name of the payment website A included in the token a.
  • the token b is created in this step, and the token b may be referred to as a first token.
  • the token b may include the following three aspects: one is a device fingerprint, and the device fingerprint is mainly used as an identifier of an operating environment indicating the current passwordless proxy login setting, and the operating environment may include, for example, a current computer and A browser that runs a shopping website and a payment website.
  • a client code that can be used by a browser for example JavaScript or Flash
  • server-side code such as Java or Python
  • actively collects field information from various layers of network protocols such as HTTP and TCP/IP, such as operating system code
  • the information is the website identifier of the payment website A encrypted by the S public key, such as the website name.
  • the information is the current time encrypted with the S public key.
  • the respective functions of the three types of information in the token b are: the device fingerprint may be used by the shopping website S to perform security verification when subsequently triggering the non-secure proxy login, so as to view the user computer and the browser accordingly. Set whether the same is true when the proxy is not registered.
  • the current time of the S signature may be used by the S internal policy to determine whether the token expires. For example, if the preset length of time (for example, three months) is exceeded, the proxyless login fails.
  • the website name of the payment website A can be used to make it known that the token b is for A, and A has enabled the proxyless login.
  • the shopping website S stores the token b to the browser cookie and can store the correspondence between the token b and the token a in the back-end database of the website.
  • step 305 the shopping website S notifies the payment website A that the confidential agent registration setting is successful.
  • the passwordless proxy login setting is successful.
  • the token b has been stored in the browser cookie, and the password can be jumped to no secret.
  • the proxy login setting success page notifies the payment website A that the setting is successful.
  • the payment website A loads the secret proxy login setting success page with the inner layer iframe, and can modify the parent iframe to display that the secret proxy login has been enabled. As shown in FIG. 2, the login page of the payment website A displays that the password is enabled. The name of the proxy login. When the user clicks on the confirmation payment on the page shown in FIG. 2, the user can continue to display the page prompt for successful payment.
  • the interaction process between the shopping website S and the payment website A when setting up the secretless agent login is described. It can be seen that in the process, the shopping website S creates the S execution security school. The required token b containing the device fingerprint is checked, and the payment website A also creates a token a required for the silent login, including the username specifying the passwordless login.
  • the payment website A receives an option to trigger the exit of the non-secure proxy login.
  • the payment website A will initiate a cancellation process of the secretless agent login, and the cancellation process will also be implemented between the payment website A and the shopping website S, and the payment website A needs to send the confidential proxy cancellation request to the shopping website S.
  • the shopping website is requested to perform the cancel operation of the confidential proxy login, and after the cancellation of the shopping website, the payment website A can be selected to cancel the login without the secret proxy.
  • Figure 4 illustrates the cancellation process for a silent proxy login. It should be noted that when canceling the non-secure proxy login, the automatic jump from the shopping website to the payment website may be canceled, but the confidential login on the payment website side may still be retained. For example, a feasible scenario is that after canceling the login without the secret proxy, when the user clicks the settlement button on the shopping website S, the website list page including the plurality of payment websites is still displayed, for example, the payment website A, the payment website B, and the like.
  • the user can click to select to use the payment website A for settlement; and after selecting the payment website A, the user can still log in to A without secret, that is, without entering the user name and password, directly enter the registered page of A, or, alternatively, After selecting payment site A, enter the username and password and enter the logged in page. That is, the cancellation of the non-secure proxy login may be to cancel the automatic selection and jump of the shopping website S to the payment website A.
  • step 401 the payment website A creates a token c for instructing the shopping website S to cancel the non-secure proxy login to the payment website A.
  • the token c may be referred to as a fourth token, and the token c may include: a website identifier of the payment website A, a current time, and an operation identifier indicating deletion, which may be used by the payment website A. Encrypt and sign.
  • step 402 the payment website A sends a secret agent registration cancellation request to the shopping website S, carrying the token c.
  • step 403 the shopping website S acquires the token b including the website identifier of the payment website A according to the token c, deletes the token b, and deletes the token a corresponding to the token b.
  • the shopping website S may find the token b including the website identifier in the browser cookie according to the website identifier of the payment website A included in the token c, delete the token b, and delete the corresponding relationship in the background database. Token b and token a. In this way, the subsequent user clicks the settlement button in the shopping website S again.
  • S cannot find the token b in the browser cookie, and cannot know.
  • the payment website A no longer automatically requests the payment website A to register without a secret, but only displays the website list page, and the user clicks and selects the payment website A to request a jump.
  • FIG. 3 and FIG. 4 illustrate the setting and canceling process of the non-secure proxy login.
  • FIG. 5 how to perform the proxyless login when the user clicks the settlement button after the setting is completed without the secret proxy login. The process is described, still in the example of online shopping.
  • step 501 the shopping website S receives a website jump trigger.
  • the S receives the website jump trigger, that is, requests to jump to the payment website to make payment.
  • the usual way is to click on the settlement button, a website list page including a plurality of payment websites for selection (if the payment website is referred to as a second website, the website list page may be referred to as a second website list page),
  • the website list page is not displayed again, but the shopping website S directly jumps to one of the plurality of payment websites in the display website list page.
  • the logged in page For example, after the user clicks the settlement button, the login page of one of the payment websites A is directly displayed, similar to the page of FIG.
  • the specific implementation process refer to the following steps in Figure 5.
  • step 502 the shopping website S obtains the token b stored in the cookie of the browser in which the browser is running, and performs verification of the device fingerprint.
  • the token b stored in the browser cookie includes the website name of the payment website A, and the device fingerprint of the operating environment when the S-to-A secret proxy login is set.
  • the shopping website S determines whether the running environment represented by the current running environment and the device fingerprint is the same according to the device fingerprint in the token b, for example, whether it is the same computer and the same browser. If the verification of the fingerprint of the device is passed, proceed to step 503; otherwise, it indicates that there may be a security risk in the login of the confidential proxy, and the shopping website may stop executing. Subsequent steps, and the user can be prompted for the risk. Moreover, in this step, since the token b also includes the website name of the payment website A, the shopping website S can know that A has enabled the proxyless login.
  • step 503 the shopping website S acquires the token a corresponding to the token b.
  • the token a may be an access token that the payment website A grants the passwordless login authority after the user logs in successfully. S can obtain the token a corresponding to the token b from the background database.
  • step 504 the shopping website S sends a passwordless login request to the payment website A according to the website identifier in the token b, carrying the token a.
  • d may be referred to as a third token
  • the third token may include at least a second token, that is, an S-signed token a, for A verification, and A may decrypt the token a and obtain the user name therein.
  • the user's passwordless login is specified; in addition, the third token may also include an S-signed S name to guarantee the authenticity of the request to the payment website A, and may also include the current time of the S private key signature.
  • step 505 payment website A verifies that token a is successful.
  • the payment website A verifies the token d, ensuring the authenticity of the request sent by the shopping website S, and also verifying the authenticity and integrity of the token a. If the verification is passed, step 506 is executed, and the login to the payment website A is not performed. In this case, the login page shown in FIG. 2 can be jumped, and the identifier of the passwordless proxy login can be displayed on the page.
  • step 506 the user is not logged into the payment website A.
  • FIG. 3 to FIG. 5 respectively describe the process of setting, canceling, and triggering execution of the secretless proxy login.
  • the shopping website S can know that the payment website A has enabled the secretless proxy. Log in, and can actively request A passwordless login to A, without requiring the user to select A from the list of multiple payment websites, and directly jump to the logged-in page of A, which speeds up the shopping speed and improves the operation efficiency;
  • both S and A participate in the security check, S verifies the device fingerprint, and A verifies the access token, which improves the security of the passwordless login to A.
  • the token involved in the embodiment of the present application may be designed according to the OAuth protocol, and encrypted or signed by the asymmetric key of the website to ensure confidentiality and true integrity.
  • the verification of S is bound to the computer (and browser software) set by the user, and cannot be forged, copied, or denied. Because the token of S is unforgeable due to the protection of the asymmetric key, all The underlying communication of the browser is through the HTTPS protocol.
  • the HTTPS protocol guarantees that they are on the network and cannot be intercepted and stolen by plaintext.
  • S and A have reached the functional contract and construction of the secretless proxy login, and the services of S and A, the asymmetric key and the database are all safely operated, stored, not stolen or tampered with.
  • the execution flow of the confidential proxy login between the shopping website S and a certain payment website A is taken as an example.
  • the shopping website S can set a secret proxy with multiple payment websites.
  • Log in for example, S can log in to A without a secret agent, or can log in to the payment website B without a secret agent, or log in to the payment website C without a secret agent.
  • each payment website and S's secret proxy login relationship may be the same, and from the perspective of the shopping website S, S may store multiple tokens b in the browser's cookie, each token b corresponds to different payment websites, and each token b and the corresponding token a are also stored in the background database, and the token a is a non-secure login access token created by the corresponding payment website.
  • S can select one of the payment websites that have enabled the proxyless login according to the preset selection rule, and execute the secretless manner.
  • Agent login for example, selects the recently registered payment website, or selects the website with the highest login frequency, and the like.
  • Website A but the user actually wants to log in to B, the user can click on the payment website B in the page, and trigger S to change to B for confidential proxy login.
  • the payment websites B and C may also display an identifier that has enabled the proxyless login, for example, "fast" indicates that it has been enabled, and the payment website D in the page does not display "fast”. , indicating that it has not set a silent proxy login.
  • S will create a third token requesting the payment website C to perform a secretless login, the third token carrying the S-signed S name and the token A corresponding to the website C. And the current time, and carrying the token to send a passwordless login request to the payment website C, and after C passes the verification, the location of the embedded page is switched to the registered page of the payment website C.
  • the implementation manner shown in FIG. 6 can provide a way for S to select a login when multiple websites are enabled with a non-secure proxy login, and it is also convenient for the user to perform selection switching.
  • the above example illustrates the confidential proxy login between the shopping website S and the payment website.
  • the shopping website S and the payment website can directly jump to each other.
  • the shopping website S provides a website list page, as long as the user selects With the payment website A, you can log in to the payment website A to make a payment.
  • an "intermediate site" is also needed.
  • the shopping website S and the payment website cannot directly jump between.
  • the first website can It is the intermediate site mentioned above, which may also be called a payment network site, and the second website may be a payment website linked under the payment network site.
  • a website list page may be displayed, which may include: payment website A, payment website B, payment website C And a payment network site N as an intermediate site, if clicked on the payment network site N, a plurality of payment websites N1, N2 and N3 are also provided for user selection (these payment websites and the aforementioned payment websites A, B and C) It is a parallel peer relationship), that is, the payment websites N1, N2, and N3 are the next-level sites that access the payment network site N. If the user wants to use the payment website N1, it is more complicated to select the payment network site N after selecting the settlement in S, and then select the payment website N1 under N.
  • the flow of FIG. 3 to FIG. 5 is executed, wherein the payment network site N is equivalent to the shopping website S in the process.
  • the payment website N1 is equivalent to the payment website A in the process.
  • the payment network site N can directly jump to the logged-in page displaying the payment website N1, similar to jumping from the shopping website S to displaying the payment website A.
  • the logged in page is executed, wherein the payment network site N is equivalent to the shopping website S in the process.
  • the payment website N1 is equivalent to the payment website A in the process.
  • the page shown in FIG. 7 may be displayed, which may include the payment website A, the payment website B, the payment website C, and the payment network station N.
  • the figure 8 is displayed, and the payment websites N1, N2, and N3 are also linked for selection by the user; specifically, when N is clicked, the page of N is displayed in the form of an embedded page of S. N1, N2, and N3 are displayed in the page of the N.
  • the inline display can make it convenient for the user to switch to select another website when the user does not want to use N, for example, the payment website A can be selected.
  • the non-secure proxy login between N and N1 is set for the first time, when the user selects the payment website N1 on the N page, the user can continue to display the login page of N1, as shown in FIG. 9, the N1 shown in FIG.
  • the login page is similar to the page shown in Figure 1.
  • the login page of the N1 can also be displayed in the form of an embedded page, and N2 and N3 are displayed in the page of N to facilitate the user to switch.
  • the user selects "Enable Unsecured Proxy Login" on the page and clicks Next, the N1 website will receive an instruction to request to set a non-secure login, and create a second token to start with the payment network site N.
  • the process of setting up the proxyless login is performed. For the specific process, refer to the process between S and A in Figure 3, and the details are not described in detail.
  • the cancel operation of the confidential proxy login can also be performed between N and N1 according to the flow of FIG. 4.
  • N selects the list of payment websites N1 to N3 in FIG. 8 for the user to select according to the website jump trigger, but since the above example has set a non-secure proxy login, then N triggers according to the website jump.
  • the token stored in the cookie of the browser in which the browser is running is obtained, the fingerprint of the device is verified, and the passwordless login request is automatically sent to the payment website N1 when the verification is passed, that is, the flow shown in FIG. 5 is executed.
  • the user clicks on the payment network site N it can directly display FIG. 10, jump to the logged-in page of the payment website N1, and display the identifier that the privileged proxy login has been enabled.
  • the N pages can also display the payment websites N1 and N2 for the user to switch.
  • the payment network site N is a site that is logged in without a password.
  • the list of N1 to N3 can be directly displayed for the user to select.
  • the payment network site N may also be a site that requires a password to log in.
  • the login page of the N may be displayed in an embedded manner, and the user needs to input N.
  • the user name and password can be used to log in to N.
  • the list of N1, N2, and N3 is displayed.
  • the setting and triggering process of the non-secure proxy login in this scenario is the same as the foregoing.
  • N when setting, there is no secret proxy login, the user first logs in N, then selects N1 for setting; and after the setting is completed, the trigger is triggered.
  • N can first input the user name and password, and after verifying the login success, N executes the process of FIG. 5, and automatically performs a silent login request to N1, and still jumps to FIG.
  • the page is just the front that requires the user to log in to N first.
  • the passwordless proxy login is set only between S and N, and the method is the same.
  • a brief description is as follows: When the user clicks the settlement button in the shopping website S, a page similar to that of FIG. 7 is displayed, and the user can select the payment network site N. Similarly, N can have a password or a password. When N needs a password, the user enters the user name and password to log in N, similar to the login payment website A in FIG. 1, and selects to enable the non-secure proxy login, then N will start to perform the setting with the S. Process.
  • the shopping website S is referred to as the first website
  • the payment network site N is referred to as the second website
  • the payment website N1 is referred to as the third website
  • the operation of the above example is And in response to the user selecting the website jump trigger identifier, the first website displays the logged-in page of one of the third websites (ie, N1) of the second website (ie, N) of the plurality of second websites.
  • the payment network site N After performing the passwordless login, the payment network site N obtains the fifth token stored in the cookie of the browser where the server is running, and the fifth token includes a website identifier of one of the payment websites, such as the payment website N1, and is used to indicate The device fingerprint of the running environment when N1's non-secure proxy is logged in.
  • the payment network site N obtains the sixth token corresponding to the fifth token according to the fingerprint of the device, and determines that the current running environment is the same as the operating environment when the N1 has no proxy proxy login setting.
  • the sixth token is an access token that the payment website N1 grants the passwordless login authority after the user logs in successfully.
  • the payment network site N sends a passwordless login request to the corresponding payment website N1 according to the website identifier in the fifth token, carries the sixth token, and when the payment website N1 verifies that the sixth token is successful, Pay no password registration for website N1.
  • the method of the present disclosure is described by taking the non-secure proxy login between three websites (S-N-N1) as an example.
  • more layers of websites may be used for the website.
  • Collision-free proxy login for example, four layers (eg, S-N--N1-N11), five or more layers, the implementation of the method is the same as the above three websites, no longer Detailed.
  • the website login method of the embodiment of the present application may be executed by a website, and may specifically be a server or a client of the website.
  • the payment website as the second website may be a second token created by the server of the payment website when executing the method; for example, the payment network station as the first website may perform the method when The client of the payment network site verifies the device fingerprint according to the first token.
  • the website login method of the present application if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium.
  • the portion of the technical solution of the present disclosure that contributes in essence or to the prior art or the portion of the technical solution may be embodied in the form of a software product stored in a storage medium, including
  • the instructions are used to cause a computing device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like.
  • the device may be applied to a first website, such that the first website has no secret agent to log in to the second website; the device may include: a token acquisition module 1101, a token verification module 1102 and no secret login module 1103.
  • the token obtaining module 1101 is configured to acquire, when receiving a website jump trigger, a first token stored in a cookie of a browser where the first website is running, where the first token includes The website jump triggers the website identifier of one of the second websites of the indicated second website list page, and the device fingerprint used to indicate the non-secure agent login when setting the second website;
  • the token verification module 1102 is configured to determine, according to the fingerprint of the device, that the current operating environment is the same as the operating environment of the second website without the proxy proxy login setting, and obtain the second token corresponding to the first token.
  • the second token is an access token that the second website grants the passwordless login permission after the user logs in successfully;
  • the passwordless login module 1103 is configured to send a passwordless login request to the second website corresponding to the website identifier according to the website identifier in the first token, and carry a third token, where the third token includes the second The token, and when the second website succeeds in verifying that the second token is successful, the password is not logged into the second website.
  • the apparatus may further include: a setting receiving module 1201 and a setting processing module 1202.
  • the setting receiving module 1201 is configured to receive a non-secure proxy login setting request sent by the second website, where the non-secure proxy login setting request carries the second token;
  • a setting processing module 1202 configured to create the first token that includes the device fingerprint, store the first token to a browser cookie where the computer is running, and store the first token and the second token Corresponding relationship of the card, notifying the second website that the confidential proxy login setting is successful.
  • the apparatus may further include: a page display module 1203 and a login switching module 1204.
  • the page display module 1203 is configured to display the logged-in page of the second website in the form of an embedded page after the password is not logged into the second website; when the cookie of the browser stores the corresponding second website respectively.
  • the plurality of first tokens are used, according to the website identifier in the first token, in the same page as the embedded page, another second website that has enabled the proxyless login on the first website is displayed.
  • the login switching module 1204 is configured to: when detecting that the user selects the other second website, send a passwordless login request to the other second website, and carry the other second website in the third token A token corresponding to the second token.
  • page display module 1203 is configured to store in a browser cookie A plurality of first tokens respectively corresponding to different second websites are stored, and when a website jump trigger is received, one of the second websites is selected according to a preset selection rule, and the non-secure agent login is performed.
  • the apparatus further includes a cancel receiving module 1205 and a cancel processing module 1206.
  • the cancel receiving module 1205 is configured to receive a secret proxy login cancellation request sent by the second website, where the secret proxy login cancellation request carries a third token, and the third token is used to cancel the indication created by the second website.
  • the secret proxy login, and the third token includes the website identifier of the second website;
  • the cancel processing module 1206 is configured to acquire, according to the website identifier in the third token, a first token that includes the second website, delete the first token, and the second token corresponding to the first token .
  • the first website is a shopping website
  • the second website is a payment website
  • the first website is a payment network website
  • the second website is linked under the payment website site.
  • Payment website is a purchase website
  • FIG. 13 provides a website login device, which may be applied to a first website, such that the first website has no secret agent to log in to the second website; the device may include: an identifier display module 1301 and a page jump module 1302.
  • the identifier display module 1301 is configured to display a website jump trigger identifier on the page, where the website jump trigger identifier is used to trigger the first website to jump to a website list page including a plurality of second websites for selection upon selection;
  • the page jump module 1302 is configured to, in response to the user selecting the website jump trigger identifier, jump to display the logged-in page of one of the second websites of the plurality of second websites in the website list page.
  • the second website is displayed on the first website in the form of an embedded page, and an indication that the confidential proxy login has been enabled is displayed on the logged-in page of the second website.
  • the apparatus may further include: a page display module 1401 and a page switching module 1402.
  • the page display module 1401 is configured to display another second that has enabled the proxyless login. website;
  • the page switching module 1402 is configured to switch to the logged-in page of the other second website at the location of the embedded page in response to the user selecting the other second website.
  • the second website further links a plurality of third websites for selection;
  • the page jump module 1302 is further configured to display the plurality of second websites in response to the user selecting the website jump trigger identifier A logged-in page of one of the third sites under a second website.
  • the apparatus can include: a request receiving module 1501 and a login execution module 1502.
  • the request receiving module 1501 is configured to receive a passwordless login request sent by the first website, where the passwordless login request carries a third token, where the third token includes a second token, and the second token is The second website grants an access token with no secret login permission after the user logs in successfully;
  • the login execution module 1502 is configured to perform a passwordless login when the second token is successful.
  • the apparatus may further include: a setting indication module 1601, a setting transmitting module 1602, and a setting result module 1603.
  • a setting indication module 1601 configured to receive login information requesting login, and an instruction to request to set a passwordless login;
  • the setting sending module 1602 is configured to create the second token after verifying the login information according to the indication, and send a secret proxy login setting request to the first website, carrying the second token So that the first website creates a first token containing the device fingerprint according to the passwordless proxy login setting request, and stores the correspondence between the first token and the second token;
  • the setting result module 1603 is configured to receive a notification that the non-secure proxy login setting sent by the first website is successful, and display that the non-secure proxy login is enabled in the logged-in page of the second website.
  • the apparatus can also include a cancellation indication module 1604 and a cancellation processing module 1605.
  • the cancel indication module 1604 is configured to perform on the logged in page after performing the passwordless login. Display: option for the user to opt out of the login without secret proxy;
  • the cancel processing module 1605 is configured to: when receiving an option to exit the passwordless proxy login, create a fourth token for instructing to cancel the proxyless login, where the fourth token includes the website identifier of the second website Sending a secret proxy login cancellation request to the first website, carrying the fourth token, so that the first website cancels the non-secure proxy login of the second website according to the fourth token.
  • the second website also links a plurality of third websites for selection; the apparatus may further include: a token acquisition module 1606, a fingerprint verification module 1607, and a login request module 1608.
  • the token obtaining module 1606 is configured to obtain, after performing the passwordless login, a fifth token stored in a cookie of a browser where the second website is running, where the fifth token includes a website identifier of one of the third websites, And a device fingerprint used to indicate when the third-party website is configured to log in without a secret proxy;
  • the fingerprint verification module 1607 is configured to determine, according to the fingerprint of the device, that the current running environment is the same as the operating environment of the third website without the proxy proxy login setting, and obtain the sixth token corresponding to the fifth token.
  • the six tokens are the access tokens granted by the third website to the non-secure login permission after the user logs in successfully;
  • the login requesting module 1608 is configured to send a passwordless login request to the third website corresponding to the website identifier according to the website identifier in the fifth token, carry the sixth token, and verify the third website. When the six tokens succeed, no password is logged into the third website.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Finance (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Development Economics (AREA)
  • Databases & Information Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Power Engineering (AREA)
  • Information Transfer Between Computers (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请提供一种网站登录方法和装置，其中方法包括：第一网站在接收到网站跳转触发时，获取第一网站运行所在的浏览器的cookie中存储的第一令牌，第一令牌包括网站跳转触发所指示的第二网站列表页面的其中一个第二网站的网站标识、以及用于表示在设定第二网站的无密代理登录时的设备指纹；第一网站根据设备指纹，确定当前运行环境与第二网站无密代理登录设定时的运行环境相同，获取所述第一令牌对应的第二令牌；第一网站根据第一令牌中的网站标识，向第二网站发送无密登录请求，携带第三令牌，第三令牌中包括第二令牌，并在第二网站验证所述第二令牌成功时，无密登录至所述第二网站。本申请提高了由第一网站无密登录至第二网站的安全性。

Description

一种网站登录方法和装置 技术领域
本申请涉及网络技术，特别涉及一种网站登录方法和装置。
背景技术
用户在上网过程中，经常遇到如下情况：用户先通过浏览器访问一个网站，为了完成某个操作流程，还需要从该网站再跳转到另一个网站进行操作。比如，网上购物时，用户通过浏览器访问购物网站，该购物网站上展示待选择购买的商品列表，当用户选定商品要结算时，需要跳转到支付网站进行付款。现有技术中，对于这种多网站间配合实现的操作流程，在进行网站跳转时需要进行登录，比如上述的例子中，由购物网站到支付网站时，还需要输入支付网站的用户名和密码等登录信息，流程较为繁琐。即使支付网站可以实现无密登录，不输入登录信息即可直接跳转到支付网站，但是这种无密登录方式的安全性就完全依赖支付网站，由于并不是所有支付网站都具有较高的自防护能力，部分网站无法保证无密登录的安全性，存在安全隐患。
发明内容
有鉴于此，本申请提供一种网站登录方法和装置，以使得在多网站间配合的场景下提高无密登录的安全性。
具体地，本申请是通过如下技术方案实现的：
第一方面，提供一种网站登录方法，所述方法用于由第一网站无密代理登录至第二网站；所述方法包括：
所述第一网站在接收到网站跳转触发时，获取第一网站运行所在的浏览器的cookie中存储的第一令牌，所述第一令牌包括所述网站跳转触发所指示的第二网站列表页面的其中一个第二网站的网站标识、以及用于表示在设定第二网站的无密代理登录时的设备指纹；
所述第一网站根据所述设备指纹，确定当前运行环境与第二网站无 密代理登录设定时的运行环境相同，则获取所述第一令牌对应的第二令牌，所述第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
所述第一网站根据第一令牌中的网站标识，向所述网站标识对应的第二网站发送无密登录请求，携带第三令牌，所述第三令牌中包括所述第二令牌，并在第二网站验证所述第二令牌成功时，无密登录至所述第二网站。
第二方面，提供一种网站登录方法，所述方法用于由第一网站无密登录至第二网站；所述方法包括：
所述第一网站在页面显示网站跳转触发标识，所述网站跳转触发标识用于在选择时触发第一网站跳转到包括供选择的多个第二网站的网站列表页面；
响应于用户对网站跳转触发标识的选择，所述第一网站跳转至显示所述网站列表页面中多个第二网站的其中一个第二网站的已登录页面。
第三方面，提供一种网站登录方法，所述方法用于由第一网站无密登录至第二网站；所述方法包括：
所述第二网站接收第一网站发送的无密登录请求，所述无密登录请求携带第三令牌，所述第三令牌中包括第二令牌，所述第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
所述第二网站验证所述第二令牌成功时，执行无密登录。
第四方面，提供一种网站登录装置，所述装置应用于第一网站，使得所述第一网站无密代理登录至第二网站；所述装置包括：
令牌获取模块，用于在接收到网站跳转触发时，获取第一网站运行所在的浏览器的cookie中存储的第一令牌，所述第一令牌包括所述网站跳转触发所指示的第二网站列表页面的其中一个第二网站的网站标识、以及用于表示在设定第二网站的无密代理登录时的设备指纹；
令牌校验模块，用于根据所述设备指纹，确定当前运行环境与第二网站无密代理登录设定时的运行环境相同，则获取所述第一令牌对应的 第二令牌，所述第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
无密登录模块，用于根据第一令牌中的网站标识，向所述网站标识对应的第二网站发送无密登录请求，携带第三令牌，所述第三令牌中包括所述第二令牌，并在第二网站验证所述第二令牌成功时，无密登录至所述第二网站。
第五方面，提供一种网站登录装置，所述装置应用于第一网站，使得所述第一网站无密代理登录至第二网站；所述装置包括：
标识显示模块，用于在页面显示网站跳转触发标识，该标识用于在选择时触发第一网站跳转到包括供选择的多个第二网站的网站列表页面；
页面跳转模块，用于响应于用户对网站跳转触发标识的选择，跳转至显示所述网站列表页面中多个第二网站的其中一个第二网站的已登录页面。
第六方面，提供一种网站登录装置，所述装置应用于第二网站，使得第一网站无密代理登录至第二网站；所述装置包括：
请求接收模块，用于接收第一网站发送的无密登录请求，所述无密登录请求携带第三令牌，所述第三令牌中包括第二令牌，所述第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
登录执行模块，用于验证所述第二令牌成功时，执行无密登录。
本申请提供的网站登录方法和装置，通过在无密代理登录时，使得第一网站和第二网站均参与安全校验，提高了由第一网站无密登录至第二网站的安全性。
附图说明
图1是本申请一示例性实施例示出的一种支付网站登录页面示意图；
图2是本申请一示例性实施例示出的一种已登录页面示意图；
图3是本申请一示例性实施例示出的无密代理登录的设定流程；
图4是本申请一示例性实施例示出的无密代理登录的取消流程；
图5是本申请一示例性实施例示出的无密代理登录的应用流程；
图6是本申请一示例性实施例示出的多网站显示示意图；
图7是本申请一示例性实施例示出的中间站点显示示意图；
图8是本申请一示例性实施例示出的中间站点的下层站点示意图；
图9是本申请一示例性实施例示出的一种登录页面示意图；
图10是本申请一示例性实施例示出的一种已登录页面示意图；
图11是本申请一示例性实施例示出的一种网站登录装置的结构图；
图12是本申请一示例性实施例示出的另一种网站登录装置的结构图；
图13是本申请一示例性实施例示出的又一种网站登录装置的结构图；
图14是本申请一示例性实施例示出的又一种网站登录装置的结构图；
图15是本申请一示例性实施例示出的又一种网站登录装置的结构图；
图16是本申请一示例性实施例示出的又一种网站登录装置的结构图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
在很多网络应用中，都存在需要网站间配合实现的操作流程，这种网站间配合可以是，用户先在一个网站进行操作，然后需要由该网站跳 转到另一个网站进行操作，才能完成一次应用。常见的一种场景是网络购物，例如，用户通过浏览器访问购物网站，该购物网站上展示待选择购买的商品列表，当用户选定商品要结算时，需要跳转到支付网站进行付款，即用户的本次网络购物需要购物网站和支付网站的配合，进行这两个网站间的跳转。
有些网站为了方便用户的应用体验，可以提供无密登录，无密登录即允许用户不输入用户名和密码，而直接登录自己在一个网站的账户。比如，在上述的网络购物的例子中，支付网站就可以设置为无密登录，这样当用户由购物网站向支付网站跳转时，就不再需要输入用户名和密码而直接登录支付网站。但是，无密登录也不一定是安全的，如果只依赖支付网站保证无密登录的安全性，也是具有一定的安全风险。
为了提高安全性，本公开提供了一种网站登录方法，该方法可以应用于网站间的跳转登录，比如，当用户在购物网站向支付网站跳转时，就可以使用本公开的方法登录到支付网站。当然，本公开的方法并不限制于购物场景的例子，其他类似的网站间配合执行的流程中都可以使用该方法。
在如下对本公开的网站登录方法的说明中，使用了一个概念词“无密代理登录”，该词语的使用是想说明，本公开的网站登录方法也是要无密登录到跳转网站，例如支付网站，但与通常的无密登录的区别在于，网站间跳转所涉及到的两个网站都参与了安全方面的校验。比如，在购物场景的例子中，由购物网站向支付网站跳转，购物网站要执行安全校验，支付网站也要进行安全校验，才能最终无密登录支付网站，这是一种双重授权的方式；并且，无密代理登录可以由购物网站自动跳转到其中一个支付网站进行登录(购物网站下可以链接多个支付网站)，而不需要用户选择要无密登录哪个支付网站，相当于购物网站知道自己要选择哪个支付网站去无密登录。
如下以购物网站(可以称为第一网站)和支付网站(可以称为第二网站)的应用例子，来说明本公开的网站登录方法。其中，本公开的网站登录方法的描述中，包括如何设定无密代理登录的过程、以及设定完 成后如何执行无密代理登录的过程，这些过程都需要购物网站和支付网站之间的配合。
假设用户在某购物网站进行购物，当用户将所选定的商品放入购物车后，可以点击“结算”按钮，去进行结算和付款。该结算按钮可以称为网站跳转触发标识，该网站跳转触发标识的作用，可以是在该标识被用户选择时，将触发购物网站跳转到包括供选择的多个支付网站的网站列表页面，比如，该网站列表页面可以显示支付网站A、支付网站B、支付网站C等，用户可以选择使用何种支付方式。
假设用户选择了其中一种支付方式，本公开实施例中，购物网站接收到用户对网站跳转触发的选择后，可以通过内嵌页面的形式显示用户所选择的支付网站的登录页面。需要说明的是，此时还未进行无密代理登录的设定，购物网站在用户点击结算按钮时，仍然要显示上面提到的网站列表页面，并且当用户选择一个支付网站后，将显示该支付网站的登录页面供用户输入用户名和密码，参见图1所示的页面显示示例。
如图1所示，用户选择的支付网站A的登录页面，可以是以内嵌页面的形式显示在购物网站的页面中，当然也可以不以内嵌页面的方式显示，而是单独显示一个支付网站A的登录页面，在本申请的如下各个实施例中，涉及到网站跳转的页面显示都以内嵌页面的显示形式来举例，通过以内嵌页面显示可以方便用户随时切换至另一个支付网站。比如，当在购物网站的页面中以内嵌页面显示支付网站A的登录页面时，与内嵌页面同位于该购物网站页面中显示的还有支付网站B的选择标识、支付网站C的选择标识等。用户不想登录支付网站A时，可以方便的选择支付网站B等其他站点。
接着仍以上面的支付网站A的登录为例，具体实施中，可以是购物网站的页面中包括一个内嵌iframe，指向支付网站A的登录页面，url中含有参数container＝S(S表示购物网站)，表示该支付网站A的登录页面是内嵌在S这个容器中。支付网站A的登录页面是由支付网站A加载，由服务器传输至S运行所在的浏览器中的支付网站客户端进行显示。
需要注意的是，请继续参见图1，支付网站A的登录页面中还显示有“启用无密代理登录”的选项，供用户选择是否启用。如果用户选择了该选项，表明用户想要实现在购物网站点击结算按钮后，自动跳转至支付网站的已登录页面，该已登录页面可以参见图2所示，相对于原有的用户操作，用户不再需要在网站列表页面中选择支付网站A，也不再需要输入图1中的用户名和密码，而直接就进入到支付网站A的登录成功之后的显示页面，进行付款确认。如果用户不选择该选项，表明用户不希望实现上述操作流程的简化。
假设用户点击选择了图1中所示的“启用无密代理登录”选项，并点击下一步，那么支付网站A将接收到登录信息(例如，用户在图1的登录页面输入的用户名和密码)、以及请求设定无密登录的指示(当用户选择上述选项，则表示向支付网站A发送了该指示)。
支付网站A在验证登录信息成功后，获知用户在本次登录之后的后续登录过程希望启用无密代理登录，那么支付网站A将启动无密代理登录的设定流程，该设定流程将在支付网站A和购物网站S之间交互实现，需要支付网站A向购物网站发送无密代理登录设定请求，请求购物网站侧进行无密代理登录的相关设定，而购物网站在设定成功后，也会通知支付网站A无密代理登录设定成功。图3示例了无密代理登录的设定流程。
在步骤301中，支付网站A创建令牌a，该令牌a用于表示授予无密登录权限的访问令牌。
例如，该令牌a可以称为第二令牌(该第二，仅是为了与后续实施例中的第一令牌、第三令牌等进行区分)，是支付网站A在验证用户在图1中输入的用户名和密码成功后进行创建。
令牌a中可以包括三方面信息：由支付网站A以该网站私钥签名的网站标识(可以是网站名称)，以网站私钥签名的当前时间，以及，登录信息中的用户名，该用户名单独以支付网站A的公钥加密，并以网站私钥签名。
上述令牌a中的三种信息的各自作用是：在后续步骤支付网站A向 购物网站S发送无密代理登录设定请求时，将携带该令牌a，其中的私钥签名的网站标识，可以用于向购物网站S保证该设定请求的真实性；其中的私钥签名的当前时间，可以使得不同时间创建的令牌随时间变化，避免重复盗用；其中的加密并签名的用户名，主要是用于在后续实施例的触发无密代理登录时由S将该用户名传递回A，以指定用于执行无密登录的用户。
此外，本申请实施例中涉及到的令牌，除了以密钥加密外，还另含该密钥的指纹，这样当对应网站更新密钥证书的时候，新旧密钥同时存在，可以根据令牌自带的密钥指纹，找到对应的密钥，以完成解密或者签名验证。以下实施例中涉及到的其他令牌都包含相应的密钥指纹，不再重复叙述。
在步骤302中，支付网站A向购物网站S发送无密代理登录设定请求，携带令牌a。
本实施例中，支付网站A和购物网站S之间的交互通信，可以是通过内嵌隐藏页面实现，将所通信的信息携带在该内嵌隐藏页面的url中。例如，本步骤中的支付网站A向购物网站S发送无密代理登录设定请求，可以是通过一个内嵌iframe(隐藏)，指向S的无密代理登录设定页面，url中含参数token＝令牌a。这样S就可以接收到A发送的设定请求和令牌a。
在步骤303中，购物网站S创建令牌b，该令牌b中包含设备指纹和支付网站A的网站标识。
例如，购物网站S将首先验证本次无密代理登录设定请求的真实性，可以是S利用支付网站A的公钥，查看令牌a中包含的支付网站A的网站名称的真实性。当确定该请求确实是支付网站A所发，则在本步骤创建令牌b，该令牌b可以称为第一令牌。
该令牌b中可以包括如下三方面信息：一个是设备指纹，该设备指纹主要用于作为表示本次的无密代理登录设定的运行环境的标识，该运行环境例如可以包括当前的计算机和运行购物网站和支付网站的浏览器。具体实施中，比如，可以由浏览器中运用的客户端代码，例如 JavaScript或者Flash，主动收集浏览器平台信息，例如浏览器语言，以及由服务器端代码，例如Java或者Python，主动收集HTTP和TCP/IP等各层网络协议中自带的字段信息，例如操作***代号，数据合并后唯一标识客户计算机(含浏览器)，即设备指纹，该指纹也以S公钥加密。另一方面信息是以S公钥加密的支付网站A的网站标识如网站名称。再一方面信息是以S公钥加密的当前时间。
上述令牌b中的三种信息的各自作用是：其中的设备指纹可以是购物网站S在后续的触发无密代理登录时用于做安全性校验，以据此查看用户计算机和浏览器与设定无密代理登录时是否相同。而其中的S签名的当前时间，可以供S内部策略判断令牌是否过期，比如，如果超过预设的时间长度(例如，三个月)，则无密代理登录失效。其中的支付网站A的网站名称，可以用于使得S据此得知该令牌b是针对A，且A已经启用了无密代理登录。
在步骤304中，购物网站S将令牌b存储至浏览器cookie，并可以在网站的后台数据库中存储令牌b和令牌a的对应关系。
在步骤305中，购物网站S通知支付网站A，无密代理登录设定成功。
例如，购物网站S在存储了令牌b、以及两个令牌的对应关系后，无密代理登录设定成功，此时的浏览器cookie中已经存储了令牌b，可以跳转到无密代理登录设定成功页面，通知支付网站A设定成功。
支付网站A以内层iframe加载无密代理登录设定成功页面，并可以修改父iframe，显示无密代理登录已经启用，参见图2所示，支付网站A的已登录页面上显示有已经启用无密代理登录的字样。当用户在图2所示的页面点击确认付款后，可以继续显示支付成功的页面提示。
通过上述图3所示的流程，描述了购物网站S和支付网站A之间在设定无密代理登录时的交互流程，可以看到，在该过程中，购物网站S创建了S执行安全校验所需的包含设备指纹的令牌b，并且支付网站A也创建了无密登录所需的令牌a，包含指定无密登录的用户名。
由图2还可以看到，在支付网站A的已登录页面中，除了包含已 经启用无密代理登录的字样，还可以提供有供用户选择退出无密代理登录的选项，比如页面中在“已经启用无密代理登录”旁边示出的“退出”。
当用户点击了上述的“退出”时，表明该用户不再想使用无密代理登录，即不希望从购物网站S点击结算时直接跳转到图2所示的已登录页面，那么，支付网站A接收到对退出无密代理登录的选项触发。此时，支付网站A将启动无密代理登录的取消流程，该取消流程也将在支付网站A和购物网站S之间交互实现，需要支付网站A向购物网站S发送无密代理登录取消请求，请求购物网站侧进行无密代理登录的取消操作，而购物网站在取消成功后，也可以选择通知支付网站A无密代理登录取消成功。
图4示例了无密代理登录的取消流程。需要说明的是，在取消无密代理登录时，可以是取消由购物网站向支付网站的自动跳转，但是支付网站侧的无密登录可以仍然保留。例如，一种可行的场景是，在取消无密代理登录后，当用户在购物网站S点击结算按钮后，仍然显示包含多个支付网站的网站列表页面，比如包括支付网站A、支付网站B等，用户可以点击选择使用支付网站A进行结算；而在选择支付网站A后，可以仍然无密登录至A，即不用输入用户名和密码，直接进入到A的已登录页面，或者，还可以是，当选择支付网站A后，输入用户名和密码再进入已登录页面。即无密代理登录的取消，可以是取消购物网站S到支付网站A的自动选择和跳转。
在步骤401中，支付网站A创建令牌c，该令牌c用于指示购物网站S取消对支付网站A的无密代理登录。
例如，该令牌c可以称为第四令牌，该令牌c中可以包括：支付网站A的网站标识、当前时间、以及delete这种指示删除的操作标识，该令牌可以由支付网站A进行加密和签名。
在步骤402中，支付网站A向购物网站S发送无密代理登录取消请求，携带令牌c。
在步骤403中，购物网站S根据令牌c，获取包含支付网站A的网站标识的令牌b，删除该令牌b，并删除令牌b对应的令牌a。
例如，购物网站S可以根据令牌c中包括的支付网站A的网站标识，找到浏览器cookie中的包括该网站标识的令牌b，删除该令牌b，并在后台数据库中删除具有对应关系的令牌b和令牌a。这样后续用户再点击购物网站S中的结算按钮，想要向支付网站跳转时，由于已经删除了令牌b和令牌a，S在浏览器cookie中将不能找到令牌b，也无法获知支付网站A，不再自动向支付网站A请求无密登录，而只能显示网站列表页面，由用户自己点击选择支付网站A进行请求跳转。
上面的图3和图4对无密代理登录的设定和取消流程进行了说明，如下将结合图5，对设定完成无密代理登录后，用户点击结算按钮时如何执行无密代理登录的流程进行描述，仍然以网上购物的例子来说。
在步骤501中，购物网站S接收到网站跳转触发。
本步骤中，用户在购物网站S选定要购买的商品后，可以点击S中的结算按钮，此时就是S接收到网站跳转触发，即请求跳转到支付网站去进行付款。通常的方式是，点击结算按钮后，将显示一个包括供选择的多个支付网站的网站列表页面(如果将支付网站称为第二网站，该网站列表页面可以称为第二网站列表页面)，但是，本实施例中的方法，当用户点击结算按钮后，不会再显示该网站列表页面，而是由购物网站S直接跳转至显示网站列表页面中多个支付网站中的其中一个支付网站的已登录页面。比如，用户点击结算按钮后，直接显示其中一个支付网站A的已登录页面，类似图2的页面。具体的实现过程，参见图5中的如下后续步骤。
在步骤502中，购物网站S获取运行所在的浏览器的cookie中存储的令牌b，进行设备指纹的校验。
例如，浏览器cookie中存储的令牌b，包含支付网站A的网站名称，以及在设定S对A的无密代理登录时的运行环境的设备指纹。
本步骤中，购物网站S将根据令牌b中的设备指纹，判断当前运行环境与设备指纹所表示的运行环境是否相同，比如，是否是同一台计算机且同一个浏览器。若通过设备指纹的校验，则继续执行步骤503；否则，表明本次无密代理登录可能存在安全风险，购物网站可以停止执行 后续步骤，且可以提示用户该风险。并且，本步骤中，由于令牌b中还包括支付网站A的网站名称，购物网站S可以据此获知A已经启用了无密代理登录。
在步骤503中，购物网站S获取令牌b对应的令牌a。
例如，该令牌a可以是支付网站A在用户登录成功后授予无密登录权限的访问令牌。S可以由后台数据库中获取令牌b对应的令牌a。
在步骤504中，购物网站S根据令牌b中的网站标识，向支付网站A发送无密登录请求，携带令牌a。
例如，在具体实现中，购物网站S仍然可以是通过隐藏内嵌iframe的url传递信息，该内嵌iframe指向支付网站A的登录页面，url中包含参数container＝S&token＝令牌d，该令牌d可以称为第三令牌，该第三令牌中可以至少包含第二令牌即S签名的令牌a，以供A验证，并且A可以解密令牌a后获得其中的用户名，进行指定用户的无密登录；此外，第三令牌中还可以包含S签名的S名称，以向支付网站A保证该请求的真实性，还可以包括S私钥签名的当前时间。
在步骤505中，支付网站A验证令牌a成功。
例如，支付网站A验证令牌d，确保是由购物网站S发送的请求真实性，并且，还验证令牌a的真实性和完整性。若均验证通过，则执行步骤506，无密登录至支付网站A，此时就可以跳转到图2所示的已登录页面，并且可以在页面上显示已经启用无密代理登录的标识。
在步骤506中，无密登录至支付网站A。
上述的图3至图5，分别了描述了无密代理登录的设定、取消以及触发执行的流程，由这些流程可以看到，一方面，购物网站S可以知道支付网站A启用了无密代理登录，并可以主动向A请求无密登录，而不需要用户再去由多个支付网站的列表中选择A，直接跳转到A的已登录页面，加快了购物的速度，提高了操作效率；另一方面，在这个过程中S和A均参与了安全校验，S校验了设备指纹，A校验了访问令牌，提高了无密登录至A的安全性。
此外，本申请实施例中涉及到的令牌，可以是根据OAuth协议设计令牌，并且通过网站的不对称秘钥加密或签名，保证保密性和真实完整性。其中，S的校验与用户设定的计算机(及浏览器软件)绑定，且不可被伪造、复制、或者抵赖，因为S的令牌因为不对称密钥的保护，是不可伪造的，所有浏览器底层通讯都是通过HTTPS协议，HTTPS协议保证它们在网络上，也是不可被明文监听并被盗用的。S与A已经达成无密代理登录的功能约定和建设，并且S与A的服务、不对称密钥和数据库都是安全运行、存储、不被盗读或者篡改。在触发无密代理登录时，因为S验证令牌b中的设备指纹是否与当前计算机(含浏览器)相同，所以如果有人用远程另一台计算机冒用尝试登录，这是不会成功的。同时，只要A保存令牌d，S也无法抵赖它创建了这个无密登录请求。
在上面的例子中，是以购物网站S与某一个支付网站A之间的无密代理登录的执行流程为例进行说明，实际实施中，购物网站S可以与多个支付网站设定无密代理登录，比如，S既可以无密代理登录至A，也可以无密代理登录至支付网站B，还可以无密代理登录至支付网站C。每一个支付网站与S的无密代理登录关系的设定都可以是相同的，而由购物网站S的角度来看，S可以在浏览器的cookie中存储多个令牌b，每个令牌b对应不同的支付网站，后台数据库中也存储了各个令牌b与对应的令牌a，令牌a是对应的支付网站创建的无密登录访问令牌。
这种情况下，在用户触发无密代理登录时，比如点击了购物网站S中的结算按钮，S可以按照预设的选择规则，选择其中一个已经启用无密代理登录的支付网站，执行无密代理登录。该选择规则，例如是，选择最近登录的支付网站，或者选择登录频率最高的网站等等。
参见图6的示例，假设有三个支付网站A、B和C，都与S之间启用了无密代理登录，并且假设S选择了A进行默认的无密代理登录，当用户点击S中的结算按钮时，S自动跳转至A的已登录页面，图6中的内嵌页面中显示了A的该已登录页面。同时，S在检查浏览器cookie中的多个令牌b时，已经根据各个令牌b中包含的网站标识，得知支付 网站B和C也启用了无密代理登录，则可以同时在与上述内嵌页面的同一页面中，也显示支付网站B和C，以方便用户切换选择，比如，S默认无密代理登录了支付网站A，可是用户实际希望登录至B，则用户可以点击页面中的支付网站B，触发S更改为向B进行无密代理登录。此外，如图6所示，支付网站B和C上还可以显示已经启用无密代理登录的标识，比如，用“快捷”表示其已经启用，而页面中的支付网站D并没有显示“快捷”，表示其没有设定无密代理登录。
参见图6，假设用户选择了支付网站C，那么S将创建一个向支付网站C请求无密登录的第三令牌，该第三令牌携带S签名的S名称、网站C对应的令牌a和当前时间，并携带该令牌向支付网站C发送无密登录请求，并在C通过校验后，在内嵌页面的位置切换为支付网站C的已登录页面。
图6所示的实现方式，可以在多个网站都启用了无密代理登录的情况下，提供了一种S选择登录的方式，并且也方便了用户进行选择切换。
以上的例子，说明了购物网站S和支付网站之间的无密代理登录，购物网站S和支付网站之间是可以直接跳转的关系，比如，购物网站S提供一个网站列表页面，只要用户选择了支付网站A，就可以登录支付网站A进行支付。但是还有一种应用场景，购物网站S和支付网站的中间，还需要有一个“中间站点”，购物网站S和支付网站之间是不能直接跳转的，在这种场景中，第一网站可以是上述的中间站点，也可以称为支付网络站点，而第二网站可以是链接在支付网络站点下的支付网站。
比如，未实施本申请的方法时的通常情况下，当用户点击购物网站S中的结算按钮时，可以显示一个网站列表页面，该页面中可以包括：支付网站A、支付网站B、支付网站C和一个作为中间站点的支付网络站点N，如果点击该支付网络站点N，其下还提供了多个支付网站N1、N2和N3供用户选择(这些支付网站与前述的支付网站A、B和C是并列对等关系)，即支付网站N1、N2和N3是接入支付网络站点N的下一层站点。如果用户要使用支付网站N1，则需要在点击S中的结算后，选择支付网络站点N，再选择N下的支付网站N1，较为繁琐。
而如果使用本申请的方法，在支付网络站点N与支付网站N1之间进行无密代理登录的设置，执行图3至图5的流程，其中，支付网络站点N相当于流程中的购物网站S，支付网站N1相当于流程中的支付网站A。那么，当用户选择点击了支付网络站点N后，不用再选择N1，支付网络站点N就可以直接跳转到显示支付网站N1的已登录页面，类似于由购物网站S跳转到显示支付网站A的已登录页面。
如下对S——N——N1场景下，在N和N1之间设定和触发无密代理登录的过程进行描述，不过由于N和N1所执行的处理与图3至图5中的S和A之间的处理相同，所以这里只简单描述，详细的可以参见上面的例子。
当用户在购物网站S中点击了结算按钮时，可以显示图7所示的页面，该页面中可以包括支付网站A、支付网站B、支付网站C，以及支付网络站点N。当用户点击N之后，则显示图8，N下还链接有支付网站N1、N2和N3供用户选择；具体的可以是，当点击N后，以S的内嵌页面的形式显示N的页面，在该N的页面中显示N1、N2和N3，该内嵌显示可以使得用户不想使用N时，方便的切换选择其他网站，比如可以选择支付网站A。
如果这次初次设定N和N1间的无密代理登录，则当用户在N页面选择了支付网站N1后，可以继续显示N1的登录页面，如图9所示，该图9所显示的N1登录页面就类似于图1中显示的页面，该N1的登录页面也可以内嵌页面形式显示，同时在N的页面中显示N2和N3，以方便用户切换。若用户选择该页面中的“启用无密代理登录”，并点击下一步，则N1网站就会接收到请求设定无密登录的指示，并创建第二令牌，开始与支付网络站点N之间执行无密代理登录的设定流程，具体的过程可以参考图3的S与A之间的流程，不再详述。同理，N和N1之间也可以按照图4的流程进行无密代理登录的取消操作。
设定完成无密代理登录后，当用户下次点击购物网站S中的结算按钮时，可以仍然显示图7的列表页面，但是当用户点击了图7中的支付网络站点N时，此时就相当于N接收到了网站跳转触发。本来按照通 常的方式，N根据该网站跳转触发将图8中的支付网站N1至N3的列表供用户选择，但是由于上面的例子中已经设定了无密代理登录，此时N根据网站跳转触发，将获取运行所在的浏览器的cookie中存储的令牌，校验设备指纹，并在校验通过时自动向支付网站N1发送无密登录请求，即执行图5中所示的流程。所以，当用户点击了支付网络站点N后，就可以直接显示图10，跳转到支付网站N1的已登录页面，并显示有已经启用无密代理登录的标识。当然，N的页面中还可以同时显示支付网站N1和N2供用户切换。
在上面的例子中，是以支付网络站点N是一个不用密码登录的站点为例，比如图7和图8中，当用户点击N之后，可以直接显示N1至N3的列表供用户选择。可选的，该支付网络站点N也可以是一个需要密码登录的站点，比如，当用户点击图7中的支付网络站点N之后，可以先以内嵌形式显示一个N的登录页面，需要用户输入N的用户名和密码后才能登录N，登录成功后才显示N1、N2和N3的列表。这种场景中的无密代理登录的设定和触发流程与前述相同，比如，在设定时无密代理登录，用户先登录N，再选择N1进行设定；而在设定完成后的触发时，用户点击N之后，N可以先让用户输入用户名和密码，并在校验登录成功后，N再执行图5的流程，自动向N1进行无密登录请求，仍然会跳转至图10的页面，只是前面需要用户先登录N。
此外，上述结合图7至图10，描述了S——N——N1场景下，在N和N1之间设定和触发无密代理登录的过程，还可以有其他的应用例子，比如，可以只在S和N之间设定无密代理登录，方法相同。简单描述如下：当用户在购物网站S中点击结算按钮时，显示类似图7的页面，用户可以选择支付网络站点N。同样的，N既可以有密码，也可以不需要密码。当N需要密码时，用户输入用户名和密码登录N，类似于图1中登录支付网站A，并选择启用无密代理登录，那么N将开始与S之间执行图3的设定无密代理登录的流程。设定完成后，当用户下次点击S中的结算时，S就可以自动跳转至N的已登录页面，不需要用户再选择N。当然，此时由于N和N1之间没有无密代理登录设定，跳转的N 的已登录页面中需要显示N1至N3，供用户选择。即使N不需要密码，也可以在页面中设置一个对应N的“启用无密代理登录”的选项供用户选择，以使得用户在点击N时同时通知N要启用无密代理登录。
在S——N——N1场景下，除了上述的N——N1之间设定无密代理登录、或者，S——N之间设定无密代理登录的例子，还可以是既在S—N之间设定，也在N—N1之间设定无密代理登录，形成一种两层的无密代理登录。这样，当用户在购物网站S中点击结算按钮时，出现的场景将是，直接跳转至支付网站N1的已登录页面，已经实现无密登录N1，这样就省去了用户选择支付网络站点N的操作，也省去了用户在支付网络站点N中选择支付网站N1的操作，操作效率进一步实现提高。
在上面的两层无密代理登录场景中，如果将购物网站S称为第一网站，支付网络站点N称为第二网站，将支付网站N1称为第三网站，那么上面例子实现的操作是，响应于用户对网站跳转触发标识的选择，第一网站显示多个第二网站的其中一个第二网站(即N)下的其中一个第三网站(即N1)的已登录页面。
在这个例子中，购物网站S与支付网站N1之间，其实经过了两次无密代理登录，包括：S与支付网络站点N之间的无密代理登录，以及，支付网络站点N与支付网站N1之间的无密代理登录。这两个层次各自之间的无密代理登录的设定和触发流程，与上面例子相同，不再赘述。当这种两层无密代理登录触发时，由N的角度来看上述操作的具体实现，当S无密代理登录至N之后，N可以继续执行如下流程，以实现由N到N1的无密代理登录，实际上该过程与S无密代理登录至N相同。
支付网络站点N在执行无密登录后，获取运行所在的浏览器的cookie中存储的第五令牌，该第五令牌包括其中一个支付网站比如支付网站N1的网站标识以及用于表示在设定N1的无密代理登录时的运行环境的设备指纹。
支付网络站点N根据所述设备指纹，确定当前运行环境与N1无密代理登录设定时的运行环境相同，则获取所述第五令牌对应的第六令牌， 该第六令牌为支付网站N1在用户登录成功后授予无密登录权限的访问令牌。
支付网络站点N根据第五令牌中的网站标识，向网站标识对应的支付网站N1发送无密登录请求，携带所述第六令牌，并在支付网站N1验证第六令牌成功时，实现支付网站N1的无密登录。
在上面的场景例子中，是以三个网站之间(S——N——N1)的无密代理登录为例来说明本公开的方法，具体实施中，还可以是更多层网站进行网站间配合实施的无密代理登录，例如，四层(如，S——N-——N1——N11)、五层或更多层，方法同上述的三个网站间的实施情况，不再详述。
本申请实施例的网站登录方法，可以由网站执行，具体可以是该网站的服务端或者客户端。例如，作为第二网站的支付网站在执行该方法时，可以是由支付网站的服务端创建的第二令牌；又例如，作为第一网站的支付网络站点在执行该方法时，可以是由支付网络站点的客户端根据第一令牌校验设备指纹。本申请的网站登录方法，如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
图11提供了一种网站登录装置，该装置可以应用于第一网站，使得所述第一网站无密代理登录至第二网站；该装置可以包括：令牌获取模块1101、令牌校验模块1102和无密登录模块1103。
令牌获取模块1101，用于在接收到网站跳转触发时，获取第一网站运行所在的浏览器的cookie中存储的第一令牌，所述第一令牌包括 所述网站跳转触发所指示的第二网站列表页面的其中一个第二网站的网站标识、以及用于表示在设定第二网站的无密代理登录时的设备指纹；
令牌校验模块1102，用于根据所述设备指纹，确定当前运行环境与第二网站无密代理登录设定时的运行环境相同，则获取所述第一令牌对应的第二令牌，第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
无密登录模块1103，用于根据第一令牌中的网站标识，向网站标识对应的第二网站发送无密登录请求，携带第三令牌，所述第三令牌中包括所述第二令牌，并在第二网站验证所述第二令牌成功时，无密登录至所述第二网站。
在一个例子中，如图12所示，该装置还可以包括：设定接收模块1201和设定处理模块1202。
设定接收模块1201，用于接收第二网站发送的无密代理登录设定请求，所述无密代理登录设定请求携带所述第二令牌；
设定处理模块1202，用于创建包含所述设备指纹的所述第一令牌，将所述第一令牌存储至运行所在的浏览器cookie，并存储所述第一令牌和第二令牌的对应关系，通知所述第二网站无密代理登录设定成功。
在一个例子中，该装置还可以包括：页面显示模块1203和登录切换模块1204。
页面显示模块1203，用于在无密登录至第二网站后，以内嵌页面的形式显示所述第二网站的已登录页面；当所述浏览器的cookie中存储有分别对应不同第二网站的多个第一令牌时，根据第一令牌中的网站标识，在与内嵌页面的同一页面中，显示已经在第一网站启用无密代理登录的其他第二网站。
登录切换模块1204，用于在检测到用户选择所述其他第二网站时，则向所述其他第二网站发送无密登录请求，并在所述第三令牌中携带其他第二网站的第一令牌对应的第二令牌。
在一个例子中，页面显示模块1203，用于在浏览器的cookie中存 储有分别对应不同第二网站的多个第一令牌，且接收到网站跳转触发时，按照预设的选择规则选择其中一个第二网站，执行无密代理登录。
在一个例子中，该装置还包括：取消接收模块1205和取消处理模块1206。
取消接收模块1205，用于接收第二网站发送的无密代理登录取消请求，所述无密代理登录取消请求携带第三令牌，所述第三令牌用于第二网站创建的指示取消无密代理登录，且第三令牌包括第二网站的网站标识；
取消处理模块1206，用于根据第三令牌中的网站标识，获取包含所述第二网站的第一令牌，删除第一令牌、以及与所述第一令牌对应的第二令牌。
在一个例子中，所述第一网站是购物网站，所述第二网站是支付网站；或者，所述第一网站是支付网络站点，所述第二网站是链接在所述支付网站站点下的支付网站。
图13提供了一种网站登录装置，该装置可以应用于第一网站，使得所述第一网站无密代理登录至第二网站；该装置可以包括：标识显示模块1301和页面跳转模块1302。
标识显示模块1301，用于在页面显示网站跳转触发标识，所述网站跳转触发标识用于在选择时触发第一网站跳转到包括供选择的多个第二网站的网站列表页面；
页面跳转模块1302，用于响应于用户对网站跳转触发标识的选择，跳转至显示所述网站列表页面中多个第二网站的其中一个第二网站的已登录页面。
在一个例子中，所述第二网站以内嵌页面的形式显示在所述第一网站，且所述第二网站的已登录页面上显示已经启用无密代理登录的指示。如图14所示，该装置还可以包括：页面显示模块1401和页面切换模块1402。
页面显示模块1401，用于显示已经启用无密代理登录的其他第二 网站；
页面切换模块1402，用于响应于用户对所述其他第二网站的选择，在所述内嵌页面的位置上切换为所述其他第二网站的已登录页面。
在一个例子中，所述第二网站还链接供选择的多个第三网站；页面跳转模块1302，还用于响应于用户对网站跳转触发标识的选择，显示多个第二网站的其中一个第二网站下的其中一个第三网站的已登录页面。
图15提供了一种网站登录装置，该装置可以应用于第二网站，使得第一网站无密代理登录至第二网站；该装置可以包括：请求接收模块1501和登录执行模块1502。
请求接收模块1501，用于接收第一网站发送的无密登录请求，所述无密登录请求携带第三令牌，所述第三令牌中包括第二令牌，所述第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
登录执行模块1502，用于验证所述第二令牌成功时，执行无密登录。
在一个例子中，如图16所示，该装置还可以包括：设定指示模块1601、设定发送模块1602和设定结果模块1603。
设定指示模块1601，用于接收请求登录的登录信息、以及请求设定无密登录的指示；
设定发送模块1602，用于根据所述指示，在验证登录信息成功后创建所述第二令牌，并向所述第一网站发送无密代理登录设定请求，携带所述第二令牌，以使得第一网站根据无密代理登录设定请求创建包含设备指纹的第一令牌，并存储第一令牌和第二令牌的对应关系；
设定结果模块1603，用于接收第一网站发送的无密代理登录设定成功的通知，并在第二网站的已登录页面中显示无密代理登录已经启用。
在一个例子中，该装置还可以包括：取消指示模块1604和取消处理模块1605。
取消指示模块1604，用于在执行无密登录后，在已登录页面上还 显示：供用户选择退出无密代理登录的选项；
取消处理模块1605，用于在接收到对退出无密代理登录的选项触发时，创建用于指示取消无密代理登录的第四令牌，所述第四令牌中包括第二网站的网站标识；向第一网站发送无密代理登录取消请求，携带所述第四令牌，以使得第一网站根据所述第四令牌取消第二网站的无密代理登录。
在一个例子中，所述第二网站还链接供选择的多个第三网站；该装置还可以包括：令牌取得模块1606、指纹校验模块1607和登录请求模块1608。
令牌取得模块1606，用于在执行无密登录后，获取第二网站运行所在的浏览器的cookie中存储的第五令牌，所述第五令牌包括其中一个第三网站的网站标识、以及用于表示在设定第三网站的无密代理登录时的设备指纹；
指纹校验模块1607，用于根据所述设备指纹，确定当前运行环境与第三网站无密代理登录设定时的运行环境相同，则获取所述第五令牌对应的第六令牌，第六令牌为第三网站在用户登录成功后授予无密登录权限的访问令牌；
登录请求模块1608，用于根据第五令牌中的网站标识，向所述网站标识对应的第三网站发送无密登录请求，携带所述第六令牌，并在第三网站验证所述第六令牌成功时，无密登录至所述第三网站。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (26)

  1. 一种网站登录方法，其特征在于，所述方法用于由第一网站无密代理登录至第二网站；所述方法包括：
    所述第一网站在接收到网站跳转触发时，获取第一网站运行所在的浏览器的cookie中存储的第一令牌，所述第一令牌包括所述网站跳转触发所指示的第二网站列表页面的其中一个第二网站的网站标识、以及用于表示在设定第二网站的无密代理登录时的设备指纹；
    所述第一网站根据所述设备指纹，确定当前运行环境与第二网站无密代理登录设定时的运行环境相同，则获取所述第一令牌对应的第二令牌，所述第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
    所述第一网站根据第一令牌中的网站标识，向所述网站标识对应的第二网站发送无密登录请求，携带第三令牌，所述第三令牌中包括所述第二令牌，并在第二网站验证所述第二令牌成功时，无密登录至所述第二网站。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一网站接收第二网站发送的无密代理登录设定请求，所述无密代理登录设定请求携带所述第二令牌；
    所述第一网站创建包含所述设备指纹的所述第一令牌，将所述第一令牌存储至运行所在的浏览器cookie，并存储所述第一令牌和第二令牌的对应关系，通知所述第二网站无密代理登录设定成功。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一网站在无密登录至第二网站后，以内嵌页面的形式显示所述第二网站的已登录页面；
    当所述浏览器的cookie中存储有分别对应不同第二网站的多个第一令牌时，所述第一网站根据第一令牌中的网站标识，在与所述内嵌页面的同一页面中，显示已经在第一网站启用无密代理登录的其他第二网 站；
    若所述第一网站检测到用户选择所述其他第二网站，则向所述其他第二网站发送无密登录请求，并在所述第三令牌中携带其他第二网站的第一令牌对应的第二令牌。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    若浏览器的cookie中存储有分别对应不同第二网站的多个第一令牌，所述第一网站在接收到网站跳转触发时，按照预设的选择规则选择其中一个第二网站，执行无密代理登录。
  5. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一网站接收第二网站发送的无密代理登录取消请求，所述无密代理登录取消请求携带第三令牌，所述第三令牌用于第二网站创建的指示取消无密代理登录，且第三令牌包括第二网站的网站标识；
    所述第一网站根据第三令牌中的网站标识，获取包含所述第二网站的第一令牌，删除第一令牌、以及与所述第一令牌对应的第二令牌。
  6. 根据权利要求1～5任一所述的方法，其特征在于，所述第一网站是购物网站，所述第二网站是支付网站；
    或者，所述第一网站是支付网络站点，所述第二网站是链接在所述支付网络站点下的支付网站。
  7. 一种网站登录方法，其特征在于，所述方法用于由第一网站无密登录至第二网站；所述方法包括：
    所述第一网站在页面显示网站跳转触发标识，所述网站跳转触发标识用于在选择时触发第一网站跳转到包括供选择的多个第二网站的网站列表页面；
    响应于用户对网站跳转触发标识的选择，所述第一网站跳转至显示所述网站列表页面中多个第二网站的其中一个第二网站的已登录页面。
  8. 根据权利要求7所述的方法，其特征在于，所述第二网站以内嵌页面的形式显示在所述第一网站，且所述第二网站的已登录页面上显示已经启用无密代理登录的指示；所述方法还包括：
    所述第一网站还显示已经启用无密代理登录的其他第二网站；
    响应于用户对所述其他第二网站的选择，所述第一网站在所述内嵌页面的位置上切换为所述其他第二网站的已登录页面。
  9. 根据权利要求7所述的方法，其特征在于，所述第二网站还链接供选择的多个第三网站；所述方法还包括：
    响应于用户对网站跳转触发标识的选择，所述第一网站显示所述多个第二网站的其中一个第二网站下的其中一个第三网站的已登录页面。
  10. 一种网站登录方法，其特征在于，所述方法用于由第一网站无密登录至第二网站；所述方法包括：
    所述第二网站接收第一网站发送的无密登录请求，所述无密登录请求携带第三令牌，所述第三令牌中包括第二令牌，所述第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
    所述第二网站验证所述第二令牌成功时，执行无密登录。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    所述第二网站接收请求登录的登录信息、以及请求设定无密登录的指示；
    所述第二网站根据所述指示，在验证登录信息成功后创建所述第二令牌，并向所述第一网站发送无密代理登录设定请求，携带所述第二令牌，以使得第一网站根据无密代理登录设定请求创建包含设备指纹的第一令牌，并存储第一令牌和第二令牌的对应关系；
    所述第二网站接收第一网站发送的无密代理登录设定成功的通知，并在第二网站的已登录页面中显示无密代理登录已经启用。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    所述第二网站在执行无密登录后，在已登录页面上还显示：供用户选择退出无密代理登录的选项；
    在接收到对退出无密代理登录的选项触发时，所述第二网站创建用于指示取消无密代理登录的第四令牌，所述第四令牌中包括第二网站的 网站标识；
    所述第二网站向第一网站发送无密代理登录取消请求，携带所述第四令牌，以使得第一网站根据所述第四令牌取消第二网站的无密代理登录。
  13. 根据权利要求10所述的方法，其特征在于，所述第二网站还链接供选择的多个第三网站；所述方法还包括：
    所述第二网站在执行无密登录后，获取第二网站运行所在的浏览器的cookie中存储的第五令牌，所述第五令牌包括其中一个第三网站的网站标识、以及用于表示在设定第三网站的无密代理登录时的设备指纹；
    所述第二网站根据所述设备指纹，确定当前运行环境与第三网站无密代理登录设定时的运行环境相同，则获取所述第五令牌对应的第六令牌，所述第六令牌为第三网站在用户登录成功后授予无密登录权限的访问令牌；
    所述第二网站根据第五令牌中的网站标识，向所述网站标识对应的第三网站发送无密登录请求，携带所述第六令牌，并在第三网站验证所述第六令牌成功时，无密登录至所述第三网站。
  14. 一种网站登录装置，其特征在于，所述装置应用于第一网站，使得所述第一网站无密代理登录至第二网站；所述装置包括：
    令牌获取模块，用于在接收到网站跳转触发时，获取第一网站运行所在的浏览器的cookie中存储的第一令牌，所述第一令牌包括所述网站跳转触发所指示的第二网站列表页面的其中一个第二网站的网站标识、以及用于表示在设定第二网站的无密代理登录时的设备指纹；
    令牌校验模块，用于根据所述设备指纹，确定当前运行环境与第二网站无密代理登录设定时的运行环境相同，则获取所述第一令牌对应的第二令牌，所述第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
    无密登录模块，用于根据第一令牌中的网站标识，向所述网站标识对应的第二网站发送无密登录请求，携带第三令牌，所述第三令牌中包 括所述第二令牌，并在第二网站验证所述第二令牌成功时，无密登录至所述第二网站。
  15. 根据权利要求14所述的装置，其特征在于，所述装置还包括：
    设定接收模块，用于接收第二网站发送的无密代理登录设定请求，所述无密代理登录设定请求携带所述第二令牌；
    设定处理模块，用于创建包含所述设备指纹的所述第一令牌，将所述第一令牌存储至运行所在的浏览器cookie，并存储所述第一令牌和第二令牌的对应关系，通知所述第二网站无密代理登录设定成功。
  16. 根据权利要求14所述的装置，其特征在于，所述装置还包括：
    页面显示模块，用于在无密登录至第二网站后，以内嵌页面的形式显示所述第二网站的已登录页面；当所述浏览器的cookie中存储有分别对应不同第二网站的多个第一令牌时，根据第一令牌中的网站标识，在与所述内嵌页面的同一页面中，显示已经在第一网站启用无密代理登录的其他第二网站；
    登录切换模块，用于在检测到用户选择所述其他第二网站时，则向所述其他第二网站发送无密登录请求，并在所述第三令牌中携带其他第二网站的第一令牌对应的第二令牌。
  17. 根据权利要求16所述的装置，其特征在于，
    所述页面显示模块，用于在浏览器的cookie中存储有分别对应不同第二网站的多个第一令牌，且接收到网站跳转触发时，按照预设的选择规则选择其中一个第二网站，执行无密代理登录。
  18. 根据权利要求14所述的装置，其特征在于，所述装置还包括：
    取消接收模块，用于接收第二网站发送的无密代理登录取消请求，所述无密代理登录取消请求携带第三令牌，所述第三令牌用于第二网站创建的指示取消无密代理登录，且第三令牌包括第二网站的网站标识；
    取消处理模块，用于根据第三令牌中的网站标识，获取包含所述第二网站的第一令牌，删除第一令牌、以及与所述第一令牌对应的第二令牌。
  19. 根据权利要求14～18任一所述的装置，其特征在于，所述第一网站是购物网站，所述第二网站是支付网站；
    或者，所述第一网站是支付网络站点，所述第二网站是链接在所述支付网站站点下的支付网站。
  20. 一种网站登录装置，其特征在于，所述装置应用于第一网站，使得所述第一网站无密代理登录至第二网站；所述装置包括：
    标识显示模块，用于在页面显示网站跳转触发标识，所述网站跳转触发标识用于在选择时触发第一网站跳转到包括供选择的多个第二网站的网站列表页面；
    页面跳转模块，用于响应于用户对网站跳转触发标识的选择，跳转至显示所述网站列表页面中多个第二网站的其中一个第二网站的已登录页面。
  21. 根据权利要求20所述的装置，其特征在于，所述第二网站以内嵌页面的形式显示在所述第一网站，且所述第二网站的已登录页面上显示已经启用无密代理登录的指示；所述装置还包括：
    页面显示模块，用于显示已经启用无密代理登录的其他第二网站；
    页面切换模块，用于响应于用户对所述其他第二网站的选择，在所述内嵌页面的位置上切换为所述其他第二网站的已登录页面。
  22. 根据权利要求20所述的装置，其特征在于，所述第二网站还链接供选择的多个第三网站；
    所述页面跳转模块，还用于响应于用户对网站跳转触发标识的选择，显示多个第二网站的其中一个第二网站下的其中一个第三网站的已登录页面。
  23. 一种网站登录装置，其特征在于，所述装置应用于第二网站，使得第一网站无密代理登录至第二网站；所述装置包括：
    请求接收模块，用于接收第一网站发送的无密登录请求，所述无密登录请求携带第三令牌，所述第三令牌中包括第二令牌，所述第二令牌为第二网站在用户登录成功后授予无密登录权限的访问令牌；
    登录执行模块，用于验证所述第二令牌成功时，执行无密登录。
  24. 根据权利要求23所述的装置，其特征在于，所述装置还包括：
    设定指示模块，用于接收请求登录的登录信息、以及请求设定无密登录的指示；
    设定发送模块，用于根据所述指示，在验证登录信息成功后创建所述第二令牌，并向所述第一网站发送无密代理登录设定请求，携带所述第二令牌，以使得第一网站根据无密代理登录设定请求创建包含设备指纹的第一令牌，并存储第一令牌和第二令牌的对应关系；
    设定结果模块，用于接收第一网站发送的无密代理登录设定成功的通知，并在第二网站的已登录页面中显示无密代理登录已经启用。
  25. 根据权利要求24所述的装置，其特征在于，所述装置还包括：
    取消指示模块，用于在执行无密登录后，在已登录页面上还显示：供用户选择退出无密代理登录的选项；
    取消处理模块，用于在接收到对退出无密代理登录的选项触发时，创建用于指示取消无密代理登录的第四令牌，所述第四令牌中包括第二网站的网站标识；向第一网站发送无密代理登录取消请求，携带所述第四令牌，以使得第一网站根据所述第四令牌取消第二网站的无密代理登录。
  26. 根据权利要求23所述的装置，其特征在于，所述第二网站还链接供选择的多个第三网站；所述装置还包括：
    令牌取得模块，用于在执行无密登录后，获取第二网站运行所在的浏览器的cookie中存储的第五令牌，所述第五令牌包括其中一个第三网站的网站标识、以及用于表示在设定第三网站的无密代理登录时的设备指纹；
    指纹校验模块，用于根据所述设备指纹，确定当前运行环境与第三网站无密代理登录设定时的运行环境相同，则获取所述第五令牌对应的第六令牌，所述第六令牌为第三网站在用户登录成功后授予无密登录权限的访问令牌；
    登录请求模块，用于根据第五令牌中的网站标识，向所述网站标识对应的第三网站发送无密登录请求，携带所述第六令牌，并在第三网站验证所述第六令牌成功时，无密登录至所述第三网站。
PCT/CN2017/075459 2016-03-15 2017-03-02 一种网站登录方法和装置 WO2017157177A1 (zh)

Priority Applications (8)

Application Number Priority Date Filing Date Title
SG11201807845QA SG11201807845QA (en) 2016-03-15 2017-03-02 Website login method and apparatus
JP2018549223A JP6749409B2 (ja) 2016-03-15 2017-03-02 ウェブサイトログイン方法及び装置
KR1020187029719A KR102148590B1 (ko) 2016-03-15 2017-03-02 웹사이트 로그인 방법 및 장치
EP17765719.4A EP3432541B1 (en) 2016-03-15 2017-03-02 Web site login method and apparatus
MYPI2018703227A MY189956A (en) 2016-03-15 2017-03-02 Website login method and apparatus
US16/128,277 US10721231B2 (en) 2016-03-15 2018-09-11 Website login method and apparatus
PH12018502007A PH12018502007A1 (en) 2016-03-15 2018-09-19 Web site login method and apparatus
US16/897,412 US10868813B2 (en) 2016-03-15 2020-06-10 Website login method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610147571.7A CN107196892B (zh) 2016-03-15 2016-03-15 一种网站登录方法和装置
CN201610147571.7 2016-03-15

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/128,277 Continuation US10721231B2 (en) 2016-03-15 2018-09-11 Website login method and apparatus

Publications (1)

Publication Number Publication Date
WO2017157177A1 true WO2017157177A1 (zh) 2017-09-21

Family

ID=59850239

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/075459 WO2017157177A1 (zh) 2016-03-15 2017-03-02 一种网站登录方法和装置

Country Status (10)

Country Link
US (2) US10721231B2 (zh)
EP (1) EP3432541B1 (zh)
JP (1) JP6749409B2 (zh)
KR (1) KR102148590B1 (zh)
CN (1) CN107196892B (zh)
MY (1) MY189956A (zh)
PH (1) PH12018502007A1 (zh)
SG (1) SG11201807845QA (zh)
TW (1) TWI671644B (zh)
WO (1) WO2017157177A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220239638A1 (en) * 2019-10-24 2022-07-28 Gree Electric Appliances, Inc. Of Zhuhai Method and device for registration and login, and computer-readable storage medium

Families Citing this family (46)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8312033B1 (en) 2008-06-26 2012-11-13 Experian Marketing Solutions, Inc. Systems and methods for providing an integrated identifier
US9607336B1 (en) 2011-06-16 2017-03-28 Consumerinfo.Com, Inc. Providing credit inquiry alerts
US10664936B2 (en) 2013-03-15 2020-05-26 Csidentity Corporation Authentication systems and methods for on-demand products
US9633322B1 (en) 2013-03-15 2017-04-25 Consumerinfo.Com, Inc. Adjustment of knowledge-based authentication
US9721147B1 (en) 2013-05-23 2017-08-01 Consumerinfo.Com, Inc. Digital identity
US10373240B1 (en) 2014-04-25 2019-08-06 Csidentity Corporation Systems, methods and computer-program products for eligibility verification
CN107196892B (zh) 2016-03-15 2020-03-06 阿里巴巴集团控股有限公司 一种网站登录方法和装置
US10715513B2 (en) * 2017-06-30 2020-07-14 Microsoft Technology Licensing, Llc Single sign-on mechanism on a rich client
CN108197480A (zh) * 2017-12-12 2018-06-22 泰康保险集团股份有限公司 访问控制方法、装置及计算机可读存储介质
US11409893B2 (en) * 2017-12-28 2022-08-09 Teradata Us, Inc. Security for diverse computing environments
CN108390878B (zh) * 2018-02-26 2021-11-05 腾讯科技（深圳）有限公司 用于验证网络请求安全性的方法、装置
US10698743B2 (en) * 2018-06-21 2020-06-30 Paypal, Inc. Shared application interface data through a device-to-device communication session
US10911234B2 (en) 2018-06-22 2021-02-02 Experian Information Solutions, Inc. System and method for a token gateway environment
CN109379324B (zh) * 2018-08-21 2021-12-14 中至数据集团股份有限公司 网站访问方法、装置、可读存储介质及计算机设备
CN109194683A (zh) * 2018-09-30 2019-01-11 北京金山云网络技术有限公司 登陆信息处理方法、装置及客户端
EP3739834A1 (de) * 2019-05-13 2020-11-18 Siemens Aktiengesellschaft Verfahren, vorrichtung und anordnung zum verarbeiten von daten
US11803628B2 (en) * 2019-06-21 2023-10-31 Magic Leap, Inc. Secure authorization via modal window
CN110489957B (zh) * 2019-08-05 2021-09-14 北京秒针人工智能科技有限公司 访问请求的管理方法和计算机存储介质
CN114144993B (zh) * 2019-08-13 2024-04-02 谷歌有限责任公司 保护客户端设备通信的完整性的方法、***和介质
KR20210112359A (ko) * 2019-08-13 2021-09-14 구글 엘엘씨 브라우저 쿠키 보안
US11941065B1 (en) 2019-09-13 2024-03-26 Experian Information Solutions, Inc. Single identifier platform for storing entity data
CN112560003A (zh) * 2019-09-25 2021-03-26 北京京东尚科信息技术有限公司 用户权限管理方法和装置
CN110933034A (zh) * 2019-10-28 2020-03-27 深圳市钱海网络技术有限公司 一种基于数字指纹的登录方法及装置
CN110958248A (zh) * 2019-12-03 2020-04-03 紫光云(南京)数字技术有限公司 网络服务***间的免密认证方法、装置及***
CN111027042A (zh) * 2019-12-03 2020-04-17 武汉极意网络科技有限公司 一种行为验证码的校验方法、装置和存储介质
US11303635B2 (en) * 2020-06-08 2022-04-12 Capital One Services, Llc Assisted third-party password authentication
CN112637167A (zh) * 2020-12-15 2021-04-09 平安资产管理有限责任公司 ***登录方法、装置、计算机设备和存储介质
KR102448784B1 (ko) * 2020-12-30 2022-09-28 숭실대학교 산학협력단 디바이스 핑거프린트를 이용한 가중치 부여 방법, 이를 수행하기 위한 기록 매체 및 장치
CN112818392B (zh) * 2021-01-29 2022-03-15 长沙市到家悠享网络科技有限公司 网页安全处理方法、装置、设备和存储介质
KR102452717B1 (ko) * 2021-04-06 2022-10-12 한국전자통신연구원 사용자 인증 장치 및 방법
US11336698B1 (en) 2021-04-22 2022-05-17 Netskope, Inc. Synthetic request injection for cloud policy enforcement
US11184403B1 (en) 2021-04-23 2021-11-23 Netskope, Inc. Synthetic request injection to generate metadata at points of presence for cloud security enforcement
US11190550B1 (en) 2021-04-22 2021-11-30 Netskope, Inc. Synthetic request injection to improve object security posture for cloud security enforcement
US11647052B2 (en) * 2021-04-22 2023-05-09 Netskope, Inc. Synthetic request injection to retrieve expired metadata for cloud policy enforcement
US11178188B1 (en) 2021-04-22 2021-11-16 Netskope, Inc. Synthetic request injection to generate metadata for cloud policy enforcement
US11271973B1 (en) 2021-04-23 2022-03-08 Netskope, Inc. Synthetic request injection to retrieve object metadata for cloud policy enforcement
US11271972B1 (en) 2021-04-23 2022-03-08 Netskope, Inc. Data flow logic for synthetic request injection for cloud security enforcement
CN113239308B (zh) * 2021-05-26 2023-07-18 杭州安恒信息技术股份有限公司 一种页面访问方法、装置、设备及存储介质
CN113553557A (zh) * 2021-07-23 2021-10-26 咪咕文化科技有限公司 应用的免密登录方法、装置、电子设备及存储介质
CN113965357B (zh) * 2021-09-28 2023-10-17 网宿科技股份有限公司 跨域网站登录状态同步方法、电子设备及存储介质
US11379614B1 (en) 2021-10-22 2022-07-05 Akoya LLC Systems and methods for managing tokens and filtering data to control data access
US11373000B1 (en) * 2021-10-22 2022-06-28 Akoya LLC Systems and methods for managing tokens and filtering data to control data access
US11496483B1 (en) 2021-10-22 2022-11-08 Akoya LLC Systems and methods for managing tokens and filtering data to control data access
US11641357B1 (en) 2021-10-22 2023-05-02 Akoya LLC Systems and methods for managing tokens and filtering data to control data access
US11379617B1 (en) 2021-10-22 2022-07-05 Akoya LLC Systems and methods for managing tokens and filtering data to control data access
US11943260B2 (en) 2022-02-02 2024-03-26 Netskope, Inc. Synthetic request injection to retrieve metadata for cloud policy enforcement

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100211796A1 (en) * 2006-08-18 2010-08-19 Kurt Gailey Method and System for Automatic Login Initiated Upon a Single Action with Encryption
CN102682009A (zh) * 2011-03-11 2012-09-19 腾讯科技（北京）有限公司 一种用户登录网页的方法及***
CN103457738A (zh) * 2013-08-30 2013-12-18 优视科技有限公司 基于浏览器的登陆处理方法及***
CN104348612A (zh) * 2013-07-23 2015-02-11 腾讯科技（深圳）有限公司 一种基于移动终端的第三方网站登录方法和移动终端
CN105337990A (zh) * 2015-11-20 2016-02-17 北京奇虎科技有限公司 用户身份的校验方法及装置

Family Cites Families (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7137006B1 (en) * 1999-09-24 2006-11-14 Citicorp Development Center, Inc. Method and system for single sign-on user access to multiple web servers
GB0025299D0 (en) 2000-10-13 2000-11-29 Ibm Request tracking for analysis of website navigation
WO2002039237A2 (en) * 2000-11-09 2002-05-16 International Business Machines Corporation Method and system for web-based cross-domain single-sign-on authentication
US20020123904A1 (en) * 2001-02-22 2002-09-05 Juan Amengual Internet shopping assistance technology and e-mail place
JP4954979B2 (ja) * 2005-04-29 2012-06-20 オラクル・インターナショナル・コーポレイション 詐欺監視、検出、および階層状ユーザ認証のためのシステムおよび方法
US8490168B1 (en) * 2005-10-12 2013-07-16 At&T Intellectual Property I, L.P. Method for authenticating a user within a multiple website environment to provide secure access
KR101434769B1 (ko) 2010-01-22 2014-08-27 인터디지탈 패튼 홀딩스, 인크 신뢰적인 연합 아이덴티티 관리 및 데이터 액세스 인가를 위한 방법 및 장치
US8843736B2 (en) * 2010-05-04 2014-09-23 Sony Corporation Authentication and authorization for internet video client
CN102299802A (zh) * 2011-09-02 2011-12-28 深圳中兴网信科技有限公司 一种跨域的单点登录实现方法
KR101417758B1 (ko) * 2011-10-13 2014-08-06 에스케이플래닛 주식회사 로그인 정보를 이용한 전자 결제 방법, 시스템 및 장치
US8667579B2 (en) * 2011-11-29 2014-03-04 Genband Us Llc Methods, systems, and computer readable media for bridging user authentication, authorization, and access between web-based and telecom domains
CN103310354A (zh) * 2012-03-08 2013-09-18 阿里巴巴集团控股有限公司 引流质量确定方法及装置、推广信息的投放方法及装置
CN103546432B (zh) * 2012-07-12 2015-12-16 腾讯科技（深圳）有限公司 实现跨域跳转的方法和***以及浏览器、域名服务器
KR102055897B1 (ko) * 2012-12-21 2019-12-16 주식회사 케이티 전화번호를 이용한 인터넷 사이트 서비스 접속 인증 방법 및 시스템
KR20140110118A (ko) * 2013-02-28 2014-09-17 손진곤 웹 어플리케이션 ｓｓｏ에서의 쿠키 재전송 공격 방어 기법
US9009806B2 (en) * 2013-04-12 2015-04-14 Globoforce Limited System and method for mobile single sign-on integration
US20140325089A1 (en) * 2013-04-28 2014-10-30 Tencent Technology (Shenzhen) Company Limited Method, terminal, server and system for page jump
GB201309702D0 (en) * 2013-05-30 2013-07-17 Certivox Ltd Security
CN104348777B (zh) * 2013-07-24 2019-04-09 腾讯科技（深圳）有限公司 一种移动终端对第三方服务器的访问控制方法及***
CN104580074B (zh) * 2013-10-14 2018-08-24 阿里巴巴集团控股有限公司 客户端应用的登录方法及其相应的服务器
IN2013CH06148A (zh) * 2013-12-30 2015-07-03 Samsung Electronics Co Ltd
US9756035B2 (en) * 2014-02-18 2017-09-05 Secureauth Corporation Device fingerprint registration for single sign on authentication
US9378345B2 (en) * 2014-04-29 2016-06-28 Bank Of America Corporation Authentication using device ID
CN103986720B (zh) * 2014-05-26 2017-11-17 网之易信息技术（北京）有限公司 一种登录方法及装置
CN105323222B (zh) * 2014-07-11 2018-08-24 博雅网络游戏开发（深圳）有限公司 登录验证方法和***
CN105592011B (zh) * 2014-10-23 2019-12-24 阿里巴巴集团控股有限公司 一种账号登录方法及装置
CN104378376B (zh) * 2014-11-18 2019-02-26 深圳中兴网信科技有限公司 基于soa的单点登录方法、认证服务器和浏览器
CN107196892B (zh) 2016-03-15 2020-03-06 阿里巴巴集团控股有限公司 一种网站登录方法和装置
CN107359996B (zh) * 2016-05-09 2020-05-05 阿里巴巴集团控股有限公司 多网站间的自动登录方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100211796A1 (en) * 2006-08-18 2010-08-19 Kurt Gailey Method and System for Automatic Login Initiated Upon a Single Action with Encryption
CN102682009A (zh) * 2011-03-11 2012-09-19 腾讯科技（北京）有限公司 一种用户登录网页的方法及***
CN104348612A (zh) * 2013-07-23 2015-02-11 腾讯科技（深圳）有限公司 一种基于移动终端的第三方网站登录方法和移动终端
CN103457738A (zh) * 2013-08-30 2013-12-18 优视科技有限公司 基于浏览器的登陆处理方法及***
CN105337990A (zh) * 2015-11-20 2016-02-17 北京奇虎科技有限公司 用户身份的校验方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220239638A1 (en) * 2019-10-24 2022-07-28 Gree Electric Appliances, Inc. Of Zhuhai Method and device for registration and login, and computer-readable storage medium

Also Published As

Publication number Publication date
MY189956A (en) 2022-03-22
US20180375863A1 (en) 2018-12-27
US10721231B2 (en) 2020-07-21
SG11201807845QA (en) 2018-10-30
EP3432541A4 (en) 2019-11-06
EP3432541A1 (en) 2019-01-23
CN107196892B (zh) 2020-03-06
US10868813B2 (en) 2020-12-15
KR20180123112A (ko) 2018-11-14
CN107196892A (zh) 2017-09-22
TW201734834A (zh) 2017-10-01
EP3432541B1 (en) 2021-07-07
JP2019515368A (ja) 2019-06-06
JP6749409B2 (ja) 2020-09-02
PH12018502007A1 (en) 2019-06-24
KR102148590B1 (ko) 2020-08-27
US20200304501A1 (en) 2020-09-24
TWI671644B (zh) 2019-09-11

Similar Documents

Publication Publication Date Title
WO2017157177A1 (zh) 一种网站登录方法和装置
KR102429633B1 (ko) 다수의 웹사이트들 간의 자동 로그인 방법 및 장치
US10904234B2 (en) Systems and methods of device based customer authentication and authorization
Fett et al. A comprehensive formal security analysis of OAuth 2.0
US8312523B2 (en) Enhanced security for electronic communications
US9332001B2 (en) Customizable sign-on service
US8997196B2 (en) Flexible end-point compliance and strong authentication for distributed hybrid enterprises
US9117062B1 (en) Stateless and secure authentication
US9825917B2 (en) System and method of dynamic issuance of privacy preserving credentials
Wang et al. Vulnerability assessment of oauth implementations in android applications
US9225690B1 (en) Browser security module
US20110060908A1 (en) Biometric authentication system for enhancing network security
US10135810B2 (en) Selective authentication system
CN109274652A (zh) 身份信息验证***、方法及装置及计算机存储介质
JP2008541206A (ja) ネットワーク商取引
US9003540B1 (en) Mitigating forgery for active content
US20150215309A1 (en) Secure Cryptoprocessor for Authorizing Connected Device Requests
CA2844888A1 (en) System and method of extending a host website
Baker OAuth2
Paul et al. UI Component and Authentication
Peles et al. SpoofedMe-Intruding Accounts using Social Login Providers A Social Login Impersonation Attack
Ahmed et al. An Efficient An Efficient, Robust and Secure SSO Architecture for Cloud Computing Implemented in Computing Implemented in a Service Oriented Architecture Service Oriented Architecture

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2018549223

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 11201807845Q

Country of ref document: SG

ENP Entry into the national phase

Ref document number: 20187029719

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2017765719

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2017765719

Country of ref document: EP

Effective date: 20181015

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17765719

Country of ref document: EP

Kind code of ref document: A1