WO2023116382A1 - 一键登录业务的实现 - Google Patents
一键登录业务的实现 Download PDFInfo
- Publication number
- WO2023116382A1 WO2023116382A1 PCT/CN2022/135823 CN2022135823W WO2023116382A1 WO 2023116382 A1 WO2023116382 A1 WO 2023116382A1 CN 2022135823 W CN2022135823 W CN 2022135823W WO 2023116382 A1 WO2023116382 A1 WO 2023116382A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- address
- token
- verification request
- login
- server
- Prior art date
Links
- 238000012795 verification Methods 0.000 claims abstract description 149
- 238000000034 method Methods 0.000 claims abstract description 59
- 238000013475 authorization Methods 0.000 claims description 31
- 238000012545 processing Methods 0.000 claims description 18
- 230000008569 process Effects 0.000 description 8
- 238000010586 diagram Methods 0.000 description 5
- 230000003190 augmentative effect Effects 0.000 description 2
- 238000004590 computer program Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- WQZGKKKJIJFFOK-GASJEMHNSA-N Glucose Natural products OC[C@H]1OC(O)[C@H](O)[C@@H](O)[C@@H]1O WQZGKKKJIJFFOK-GASJEMHNSA-N 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 239000008280 blood Substances 0.000 description 1
- 210000004369 blood Anatomy 0.000 description 1
- 230000036772 blood pressure Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 239000008103 glucose Substances 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 239000004984 smart glass Substances 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
- H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
- H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
Definitions
- One or more embodiments of this specification relate to network information technology, and in particular to a method and device for implementing a one-key login service.
- the application client In order to facilitate the user's use, a new method of logging in to the APP has emerged, that is, a one-click login method.
- the application client usually a mobile phone
- the SDK When the user requests to log in, the SDK communicates with the operator's server to collect the user's mobile phone number.
- the application client After obtaining the user's consent and authorization, the application client Obtain the token (token) for the interface call, pass the token to the application server, and the application server uses the token to obtain information such as the mobile phone number of the currently authorized user, thereby completing the login of the APP.
- token token
- the security of the current one-key login service is relatively low, which may easily cause leakage of user privacy data. Therefore, a more secure method for implementing the one-key login service is required.
- One or more embodiments of this specification describe a method and device for implementing a one-key login service, which can improve the security of the one-key login service.
- a method for implementing a one-click login service includes: obtaining the information of the first IP address from the verification request sent by the application client; issuing a token token to the application client ; Obtain the information of the second IP address from the number acquisition request sent by the application server; determine whether the first IP address is the same as the second IP address, and if they are the same, obtain the token carried in the number acquisition request Obtain the mobile phone number of the terminal device where the application client is located, and send it to the application server; if not, refuse to send the mobile phone number of the terminal device to the application server.
- the verification request includes at least one of the following requests: a login verification request carrying APP ID, APP sign, KEY ID, timestamp and the IP address; a mobile phone identity verification request carrying the APP ID, the IP address and the timestamp; verification request; a newly defined verification request carrying the APP ID and the IP address.
- the sending token token to the application client includes: according to the mobile phone identity verification request Perform identity verification, and issue a token to the application client after the identity verification is successful.
- the information of the first IP address before obtaining the information of the first IP address, it further includes: receiving the login verification request sent by the application client through the https link, and generating a symmetric key after the login verification is successful, and using the symmetric key through the https link
- the key is issued to the application client;
- the information of obtaining the first IP address includes: using the generated symmetric key to decrypt the mobile phone identity verification request sent by the application client, and from the decrypted
- the information of the first IP address is obtained in the mobile phone identity verification request;
- the sending of the token token to the application client includes: encrypting the token with a symmetric key, and sending the encrypted token to the application client.
- a method for implementing a one-key login service comprising: carrying the information of the IP address of the terminal device in the verification request, and sending the verification request to the operator server; receiving the operator server The issued token; the information of the IP address of the terminal device and the received token are sent to the application server; if the login authorization sent by the application server is received, the one-click login is successful.
- the verification request includes at least one of the following requests: a login verification request carrying APP ID, APP sign, KEY ID, timestamp and the IP address; a mobile phone identity verification request carrying the APP ID, the IP address and the timestamp; verification request; a newly defined verification request carrying the APP ID and the IP address.
- the mobile phone identity verification request before sending the mobile phone identity verification request to the operator server, it further includes: sending a login verification request to the operator server through the https link, and receiving the symmetric key issued by the operator server through the https link; Sending the verification request to the operator server includes: using the symmetric key to encrypt the mobile phone identity verification request, and sending the encrypted mobile phone identity verification request to the operator server;
- the token includes: receiving the encrypted token issued by the operator's server, and using a symmetric key to decrypt the encrypted token to obtain the token.
- a method for realizing one-click login service includes: after receiving the login request sent by the application client, performing login pre-authorization; receiving the token sent by the application client and the location of the application client Information about the IP address of the terminal device; carry the received token and the information of the IP address in the number acquisition request, and send the number acquisition request to the operator server; if the application received from the operator server If the mobile phone number of the terminal device where the client is located, the login authorization process is performed according to the mobile phone number.
- information exchange is performed with the operator's server through the https link.
- a device for implementing a one-click login service including: a first IP address acquisition module configured to obtain information about the first IP address from a verification request sent by an application client; a token issuance module , configured to issue a token to the application client; the second IP address obtaining module is configured to obtain the information of the second IP address from the number obtaining request sent by the application server; the authorization processing module is configured to judge the second IP address Whether the first IP address is the same as the second IP address, if they are the same, obtain the mobile phone number of the terminal device where the application client is located according to the token carried in the number acquisition request, and send it to the application server, if not , then refuse to send the mobile phone number of the terminal device to the application server.
- a device for implementing a one-click login service including: a verification request module configured to carry the information of the IP address of the terminal device where it is located in the verification request, and send the verification request to the operator
- the business server configured to carry the information of the IP address of the terminal device where it is located in the verification request, and send the verification request to the operator
- the business server is configured to receive the token issued by the operator server
- the forwarding module is configured to send the information of the IP address of the terminal device and the received token to the application server
- the login authorization module is configured as If the login authorization from the application server is received, the one-click login is successful.
- a device for implementing a one-click login service including: a pre-login module configured to perform pre-login processing after receiving a login request from an application client; a network factor acquisition module configured to receive an application The token sent by the client and the IP address information of the terminal device where the application client is located; the number acquisition module is configured to carry the received token and the information of the IP address in the number acquisition request, and send the number The acquisition request is sent to the operator server; the authorization execution module is configured to perform login authorization processing according to the mobile phone number if the mobile phone number of the terminal device where the application client is located is received from the operator server.
- a computing device including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method described in any embodiment of this specification is implemented. method.
- the implementation method and device for the one-key login service provided by the embodiments of this specification prevents the application server from providing corresponding application services for the attacker's terminal equipment, and improves security.
- FIG. 1 is a schematic diagram of an operation of a one-click login service.
- Fig. 2 is a schematic diagram of a system architecture applied by an embodiment of the present specification.
- Fig. 3 is a flowchart of a method for implementing a one-key login service in an operator server according to an embodiment of this specification.
- Fig. 4 is a flow chart of a method for implementing a one-click login service in an application client according to an embodiment of this specification.
- Fig. 5 is a flow chart of a method for implementing a one-click login service in an application server according to an embodiment of this specification.
- Fig. 6 is a flow chart of a method in which an operator server, an application client, and an application server cooperate to realize a one-click login service in an embodiment of this specification.
- Fig. 7 is a schematic structural diagram of a device for one-click login service in an embodiment of this specification.
- Fig. 8 is a schematic structural diagram of a device for one-key login service in another embodiment of this specification.
- Fig. 9 is a schematic structural diagram of a device for one-key login service in another embodiment of this specification.
- the system architecture mainly includes three network nodes: an application client, an application server and an operator server.
- the application client is installed and run in the terminal device, which may include but not limited to such as: smart mobile terminal, smart home device, network device, wearable device, smart medical device, PC (personal computer) and so on.
- the intelligent mobile terminal may include, for example, a mobile phone, a tablet computer, a notebook computer, a PDA (Personal Digital Assistant), an Internet car, and the like.
- Smart home devices may include smart home appliances, such as smart TVs, smart air conditioners, smart water heaters, smart refrigerators, smart air purifiers, etc. Smart home devices may also include smart door locks, smart sockets, smart lights, smart cameras, etc.
- Network devices may include, for example, switches, wireless APs, servers, and so on.
- Wearable devices may include devices such as smart watches, smart glasses, smart bracelets, virtual reality devices, augmented reality devices, mixed reality devices (that is, devices that can support virtual reality and augmented reality), and the like.
- Smart medical devices may include, for example, smart thermometers, smart blood pressure meters, smart blood glucose meters, and so on.
- Application clients can be various types of applications, including but not limited to payment applications, multimedia playback applications, map applications, text editing applications, financial applications, browser applications, instant messaging applications, and so on.
- the carrier server refers to the server device of the provider providing network services, which may be a single server or a server group composed of multiple servers.
- the operator's server is responsible for providing network services for various applications, such as security authentication, providing a mobile phone number for one-key login, etc.
- An application server is a specific application server that provides corresponding application services for application clients.
- the application server is a server that provides Alipay services.
- the application client, the application server and the operator server interact through the network.
- the network may include various connection types, such as wires, wireless communication links, or fiber optic cables.
- Fig. 3 is a flowchart of a method for implementing a one-key login service in an operator server according to an embodiment of this specification. Referring to Fig. 3, the method includes the following steps.
- Step 301 Obtain the information of the first IP address from the verification request sent by the application client.
- Step 303 Issue a token to the application client.
- Step 305 Obtain the information of the second IP address from the number acquisition request sent by the application server.
- Step 307 Determine whether the first IP address is the same as the second IP address, if they are the same, go to step 309, if not, go to step 311.
- Step 309 Obtain the mobile phone number of the terminal device where the application client is located according to the token carried in the number acquisition request, and send it to the application server.
- Step 311 Refusing to send the mobile phone number of the terminal device to the application server.
- the operator server will obtain the first IP address sent by the application client before issuing the token (the first IP address corresponds to:
- the server requests the IP address of the terminal device for one-click login, such as the IP address of terminal device Y), and obtains the second IP address sent by the application server after issuing the token (the second IP address corresponds to: Afterwards, request the IP address of the terminal device for one-key login through the application server), if the two IP addresses are the same, it can be considered that in a one-key login service, the terminal device that communicated with the operator's server before issuing the token is the same as the terminal device that was issued.
- the terminal device that communicates with the application server after sending the token is the same terminal device, which is terminal device Y.
- the terminal device Y used by the legitimate user did not steal the token issued by the attacker, and no attack occurred. Therefore, the operator server can provide the mobile phone number of the terminal device Y where the application client is located to the application server, so that the application server is Its currently connected terminal device Y provides corresponding application services; on the contrary, if the two IP addresses are different, it can be considered that in a one-key login service, the terminal device Y that communicated with the operator's server before issuing the token is the same as the next
- the terminal device X that communicates with the application server after the token is issued is not the same terminal device, that is, the terminal device X currently connected to the application server is not the terminal device Y used by the legitimate user, but an attacker who stolen the token.
- the operator server does not provide the application server with the mobile phone number of the terminal device Y where the application client is located, so that the application server cannot provide corresponding application services. It can be seen that the method in the embodiment of this specification prevents the application server from providing the attacker's terminal device with the application service corresponding to the application client, thereby improving security.
- step 301 the operator server acquires the information of the first IP address from the verification request sent by the application client.
- the application client sends a verification request to the operator server through its terminal device Y, and the verification request will carry the IP address of the terminal device Y, which is recorded as the first IP address.
- the verification request carrying the first IP address can include any one or more of the following: Verification request 1: In the one-click login service, before the operator server issues the token, the application client will send the operator server Send a login verification request to verify the identity of the application client. Therefore, the login verification request can be used to carry the IP address of the terminal device and sent to the operator server.
- the verification request in step 301 can carry APP ID, APP sign, KEY ID, timestamp and A login verification request for the first IP address.
- Verification request 2 In the one-click login service, before the operator server issues a token, the application client will send a mobile phone identity verification request to the operator server to verify the identity of the terminal device where the application client is located. Therefore, the mobile phone identity verification request can be used to carry the first IP address and sent to the operator server.
- the verification request in step 301 can be the mobile phone identity carrying the APP ID, the first IP address and the time stamp Verify request.
- Verification request 3 Before the operator server issues the token, the application client can use a newly defined verification request to send the first IP address to the operation server. Correspondingly, the verification request in step 301 can carry Newly defined verification request for APP ID and first IP address.
- the verification request in step 301 adopts the above-mentioned verification request 2, that is, the mobile phone identity verification request carrying the APP ID, the first IP address and the time stamp.
- encryption processing can be performed, specifically: before step 301, the operator server will receive the application client through the https link.
- an implementation process of step 301 includes : The operator server uses the symmetric key to decrypt the mobile phone identity verification request sent by the application client, and obtains the information of the first IP address from the decrypted mobile phone identity verification request.
- step 303 the operator server issues a token to the application client.
- the operator server after receiving the mobile phone identity verification request, the operator server will perform identity verification according to the mobile phone identity verification request, and after the identity verification is successful, issue a token to the application client.
- the operator server uses the symmetric key key to encrypt the token, and sends the encrypted token to the application client, thereby Avoid token leaks as much as possible.
- the application client After the application client obtains the token, if it has been encrypted, it can decrypt it with the pre-acquired symmetric key key to obtain the token. After the application client obtains the token, the application client can send the token to the application server. At the same time, for subsequent legality verification, the application client also records the IP address of the terminal device where it is located as the second IP address Also sent to the application server. The application server sends the received token and the second IP address to the operator server in the number acquisition request.
- step 305 obtain the information of the second IP address from the number obtaining request sent by the application server.
- the operator server obtains two IP addresses from both the application client and the application server.
- the operator server judges whether the two IP addresses are the same. If they are the same, it can be considered that in the one-key login service, it communicates with the operator server before issuing the token.
- the terminal device and the terminal device that communicates with the application server after the token is issued are the same terminal device, both are terminal device Y, that is to say, the terminal device currently performing one-click login business with the application server is a terminal device used by a legal user Y, so the operator server can provide the mobile phone number of the terminal device Y where the application client is located to the application server, so that the application server can provide corresponding application services for the terminal device Y currently connected to it; on the contrary, if the two IP addresses do not Similarly, it can be considered that in a one-key login service, the terminal device Y that communicates with the operator server before the token is issued is not the same terminal device X that communicates with the application server after the token is issued, that is, the current The terminal device X connected to the application server
- the attack has already occurred, so the operator server does not provide the application client to the application server.
- the IP address can be any one of IPv4 (Internet Protocol Version 4, Internet Protocol Version 4) address and IPv6 (Internet Protocol Version 6, Internet Protocol Version 6) address or two.
- the application client can communicate with the application server through a dedicated link. Before obtaining the symmetric key, the application client can communicate with the operator server through the https link. After obtaining the symmetric key, the application The client can communicate with the operator's server through the http link, and the application server can communicate with the operator's server through the https link.
- Fig. 4 is a flow chart of a method for implementing a one-click login service in an application client according to an embodiment of this specification.
- the method includes: Step 401: Carry the information of the IP address of the terminal device in the verification request, and send the verification request to the operator's server.
- step 401 For the description of the specific implementation of this step 401, reference may be made to all the descriptions of the above step 301.
- the verification request in step 401 includes at least one of the following requests: a login verification request carrying APP ID, APP sign, KEY ID, timestamp, and the IP address; Mobile phone identity verification request; a newly defined verification request carrying the APP ID and the IP address.
- the verification request is a mobile phone identity verification request carrying APP ID, information of the IP address of the terminal device where it is located, and a time stamp.
- the application client before sending the mobile phone identity verification request to the operator server, it further includes: the application client sends a login verification request to the operator server through the https link, and receives the symmetric key issued by the operator server through the https link ;
- the application client uses a symmetric key to encrypt the mobile phone identity verification request, and sends the encrypted mobile phone identity verification request to the operator's server;
- Step 403 Receive the token issued by the operator's server.
- the application client receives the encrypted token issued by the operator's server, and uses the symmetric key to decrypt the encrypted token to obtain the token.
- Step 405 Send the information of the IP address of the terminal device and the received token to the application server.
- the application client In order to be able to perform legality verification in the operator's server, the application client needs to carry the IP address of the terminal device where the application client is located when sending the token to the application server.
- Step 407 If the login authorization from the application server is received, the one-key login is successful; if the login authorization from the application server is not received, the one-key login fails.
- Fig. 5 is a flow chart of a method for implementing a one-click login service in an application server according to an embodiment of this specification.
- the method includes: Step 501: Receive a login request from an application client, and perform login pre-authorization.
- an application client When an application client needs to use the one-key login service, it first sends a login request to the application server, thereby triggering the one-key login service.
- the application server will perform login pre-authorization processing, such as sending a pre-login interface to the application client. Afterwards, the application client will execute the above steps 401 to 405, for details, please refer to all relevant descriptions of steps 401 to 405.
- Step 503 Receive the token sent by the application client and the information of the IP address of the terminal device where the application client is located.
- the terminal device communicating with the application server in step 503 is the same terminal device as the terminal device in step 501, for example, marked as terminal device Y, then, in step 503, the application server What is received is the IP address of the terminal device Y.
- the terminal device communicating with the application server in step 503 and the terminal device in step 501 are not the same terminal device, for example, the terminal device communicating in step 503 is marked as terminal device X, Then, in step 503, what the application server receives is the IP address of the terminal device X.
- Step 505 Carry the received token and IP address information in the number acquisition request, and send the number acquisition request to the operator server.
- the application server may send the number acquisition request to the operator server through an https link.
- Step 507 If the mobile phone number of the terminal device where the application client is located is received from the operator server, perform login authorization processing according to the mobile phone number.
- the implementation method of the one-key login service will be described below in conjunction with the cooperative processing of the application client, application server, and operator server.
- the application client passes the above verification
- the verification request 2 that is, the mobile phone identity verification request carrying the IP address of the terminal device is used as an example for illustration. Referring to FIG. 6, the method includes the following steps.
- Step 601 The application client sends a login request to its own application server through a dedicated link.
- the application client is an application program (APP) installed in the terminal device.
- the application client may execute the processing of sending the login request in this step after being triggered by the user.
- APP application program
- Step 603 After receiving the login request, the application server performs login pre-authorization, including sending a pre-login interface to the application client through a dedicated link.
- Step 605 the application server sends a login verification request to the operator server through the https link.
- the https link is an encrypted link, and sending the login verification request through the https link can further improve security.
- the login verification request may include information such as the identification (APP ID) of the application client, the signature (APP sign) of the application client, the key identifier (KEY ID) and the time stamp.
- APP ID the identification of the application client
- APP sign the signature of the application client
- key identifier the key identifier of the application client
- Step 607 The operator server authenticates the identity of the application client according to the received login verification request, and generates a session key key after successful authentication, and sends the key to the application client through the https link.
- key is a symmetric key.
- Step 609 The application client generates a mobile phone identity verification request carrying the APP ID, the IP address of the terminal device where it is located, and a time stamp, encrypts it with a symmetric key, and sends it to the operator's server through the http link.
- the IP address of the terminal device where the application client is located carried in the mobile phone identity verification request may include an IPv4 address and an IPv6 address.
- Step 611 The operator server uses the key to decrypt the mobile phone identity verification request, and performs identity verification. After the identity verification is successful, obtain the first IP address information from the mobile phone identity verification request, use the symmetric key key to encrypt the token, and Send the encrypted token to the application client.
- the operator server will save the IP address of the terminal device where the application client is located, which is obtained before issuing the token, and record it as the first IP address.
- Step 613 After the application client uses the symmetric key to decrypt the token, it sends the token and the IP address of the terminal device to the application server through a dedicated link.
- Step 615 The application server sends the APP ID, the received token and the IP address in the number acquisition request to the operator server through the https link.
- Step 617 The operator server judges whether the IP address sent by the application server is recorded as the second IP address and whether the first IP address obtained before is the same. The number is sent to the application server, otherwise, the one-key login fails this time.
- the carrier server when the one-key login fails, the carrier server returns a message of number acquisition failure to the application server.
- Step 619 If the application server receives the mobile phone number of the terminal device where the application client is located from the operator server, it will perform login success authorization processing to the application client through the dedicated link according to the mobile phone number.
- a device for realizing one-key login service which is set in the operator server, see FIG. 7, and includes: a first IP address acquisition module 701, configured as Obtain the information of the first IP address in the verification request; the token issuance module 702 is configured to issue token to the application client; the second IP address acquisition module 703 is configured to obtain the number in the number acquisition request sent from the application server Obtain the information of the second IP address; the authorization processing module 704 is configured to determine whether the first IP address is the same as the second IP address, and if they are the same, obtain the application client according to the token carried in the number acquisition request The mobile phone number of the terminal device where it is located, and send it to the application server, if not the same, then refuse to send the mobile phone number of the terminal device to the application server.
- a first IP address acquisition module 701 configured as Obtain the information of the first IP address in the verification request
- the token issuance module 702 is configured to issue token to the application client
- the second IP address acquisition module 703 is configured to obtain the number in the
- the first IP address obtaining module 701 is configured to obtain the first IP address from any one or more of the following requests: carrying APP ID, APP sign, KEY ID, timestamp and The login verification request of the first IP address; and the mobile phone identity verification request carrying the APP ID, the first IP address and the timestamp; and the newly defined verification request carrying the APP ID and the first IP address .
- the verification request is a mobile phone identity verification request carrying APP ID, first IP address information, and a time stamp;
- the first IP address acquisition module 701 is configured to perform identity verification from the mobile phone Obtain the information of the first IP address in the request;
- the token issuance module 702 is configured to perform identity verification according to the identity verification request of the mobile phone, and after the identity verification is successful, issue a token to the application client.
- the implementation device for one-click login service applied to the operator's server further includes: a login verification module configured to receive the login verification request sent by the application client through the https link, and according to the login verification request Perform login verification; the key generation module is configured to generate a symmetric key after the login verification module is successfully verified, and send the symmetric key to the application client through the https link; the first IP address acquisition module 701 is It is configured to perform decryption of the mobile phone identity verification request sent by the application client using the generated symmetric key, and obtain the information of the first IP address from the decrypted mobile phone identity verification request; issue a token
- the module 702 is configured and executed: use a symmetric key to encrypt the token, and send the encrypted token to the application client.
- an implementation device for one-click login service is provided, which is set in the application client, see Figure 8, including: a verification request module 801 configured to send the information of the IP address of the terminal device where it is located carry in the verification request, and send the verification request to the operator server; the token receiving module 802 is configured to receive the token issued by the operator server; the forwarding module 803 is configured to transfer the IP address of the terminal device where it is located The information and the received token are sent to the application server; the login authorization module 804 is configured to succeed in one-click login if the login authorization sent by the application server is received.
- the verification request module 801 is configured to send any one or more of the following requests to the operator server: carrying APP ID, APP sign, KEY ID, timestamp and the first A login verification request of an IP address; and a mobile phone identity verification request carrying the APP ID, the first IP address and a time stamp; and a newly defined verification request carrying the APP ID and the first IP address.
- the verification request module 801 when the verification request module 801 sends a mobile phone identity verification request carrying the APP ID, the first IP address and a time stamp, the implementation of the one-key login service applied to the application client
- the device further includes: a login request module, configured to send a login verification request to the operator server through the https link, and receive the symmetric key issued by the operator server through the https link;
- the verification request module 801 is configured to use the The symmetric key encrypts the mobile phone identity verification request, and sends the encrypted mobile phone identity verification request to the operator server;
- the token receiving module 802 is configured to perform: receive the encrypted token issued by the operator server, use The symmetric key decrypts the encrypted token to obtain the token.
- a device for implementing a one-click login service which is set in an application server, see FIG. 9, and includes: a pre-login module 901 configured to receive a login request from an application client , to perform login preprocessing; the network factor acquisition module 902 is configured to receive the token sent by the application client and the information of the IP address of the terminal device where the application client is located; the number acquisition module 903 is configured to receive the token and The information of the IP address is carried in the number acquisition request, and the number acquisition request is sent to the operator server; the authorization execution module 904 is configured as a mobile phone of the terminal device where the application client is located if the operator server receives the number, the login authorization process will be performed according to the mobile phone number.
- a pre-login module 901 configured to receive a login request from an application client , to perform login preprocessing
- the network factor acquisition module 902 is configured to receive the token sent by the application client and the information of the IP address of the terminal device where the application client is located
- the number acquisition module 903
- the number acquisition module 903 is configured to send the number acquisition request to the operator server through the https link;
- the authorization execution module 904 is configured to receive the application sent by the operator server through the https link The mobile phone number of the terminal device where the client is located.
- An embodiment of the present specification provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, the computer is instructed to execute the method in any one of the embodiments in the specification.
- An embodiment of this specification provides a computing device, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the implementation of any one of the embodiments in the specification is implemented. method.
- the structure shown in the embodiment of the present specification does not constitute a specific limitation on the device of the embodiment of the present specification.
- the above-mentioned apparatus may include more or less components than those shown in the illustrations, or combine certain components, or separate certain components, or arrange different components.
- the illustrated components may be realized in hardware, software, or a combination of software and hardware.
- each embodiment in this specification is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments.
- the description is relatively simple, and for relevant parts, please refer to part of the description of the method embodiment.
- the functions described in the present invention may be implemented by hardware, software, pendants or any combination thereof.
- the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Telephonic Communication Services (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
本说明书实施例提供了一键登录业务的实现方法和装置。在该方法中，从应用客户端发来的校验请求中获取第一IP地址的信息；向所述应用客户端下发令牌token；从应用服务器发来的号码获取请求中获取第二IP地址的信息；判断所述第一IP地址与所述第二IP地址是否相同，如果相同，则根据所述号码获取请求中携带的token获取应用客户端所在的终端设备的手机号，并发送给所述应用服务器，如果不相同，则拒绝将该终端设备的手机号发送给所述应用服务器。本说明书实施例能够提高一键登录业务的安全性，可以避免用户隐私数据的泄露。
Description
本说明书一个或多个实施例涉及网络信息技术，尤其涉及一键登录业务的实现方法和装置。
随着网络的快速发展，基于网络产生了各种各样的业务应用。用户只需要在终端设备中下载相应业务应用的应用客户端即应用程序(APP)，通过应用客户端注册并登录，就可以享受相应的业务应用，比如，看电影或者购买商品等。
为了方便用户的使用，目前出现了一种新的登录APP的方法，即一键登录方法。在一键登录方法中，应用客户端，通常为手机，会预先嵌入认证SDK，用户请求登录时，通过该SDK与运营商服务器通信以便采集用户手机号码，在获得用户同意授权后，应用客户端获得接口调用的令牌(token)，将token传递给应用服务器，应用服务器利用token获取当前授权用户的手机号码等信息，从而完成了APP的登录。
参见图1，在一键登录业务中，用户只需要点击相关的“一键登录”的按键，而无需输入手机号码、用户名、密码以及短信验证码等，因此，可以让用户更方便、快捷地完成注册、登录流程，将原本可能需要20秒左右的流程，缩短到了2秒左右，为用户使用带来了很大的方便。
但是，目前的一键登录业务的安全性相对较低，这样就容易造成用户隐私数据的泄露，因此需要一种更为安全的一键登录业务的实现方法。
发明内容
本说明书一个或多个实施例描述了一键登录业务的实现方法和装置，能够提高一键登录业务的安全性。
根据第一方面，提供了一种一键登录业务的实现方法，其中包括：从应用客户端发来的校验请求中获取第一IP地址的信息；向所述应用客户端下发令牌token；从应用服务器发来的号码获取请求中获取第二IP地址的信息；判断所述第一IP地址与所述第二IP地址是否相同，如果相同，则根据所述号码获取请求中携带的token获取应用客户端所在的终端设备的手机号，并发送给所述应用服务器，如果不相同，则拒绝将该 终端设备的手机号发送给所述应用服务器。
所述校验请求包括如下中的至少一个请求：携带APP ID、APP sign，KEY ID、时间戳以及所述IP地址的登录验证请求；携带APP ID、所述IP地址及时间戳的手机身份校验请求；携带APP ID及所述IP地址的新定义的校验请求。
其中，所述校验请求为携带APP ID、第一IP地址信息及时间戳的手机身份校验请求时；所述向所述应用客户端下发令牌token，包括：根据手机身份校验请求进行身份验证，在身份验证成功后，向所述应用客户端下发token。
其中，在获取第一IP地址的信息之前，进一步包括：通过https链路接收所述应用客户端发来的登录验证请求，在登录验证成功后，生成对称密钥，通过https链路将该对称密钥下发给所述应用客户端；所述获取第一IP地址的信息，包括：利用生成的所述对称密钥对应用客户端发来的手机身份校验请求进行解密，从解密后的手机身份校验请求中获取所述第一IP地址的信息；所述向所述应用客户端下发令牌token，包括：利用对称密钥对token进行加密，将加密后的token下发给应用客户端。
根据第二方面，提供了一键登录业务的实现方法，该方法包括：将终端设备的IP地址的信息携带在校验请求中，并将该校验请求发送给运营商服务器；接收运营商服务器下发的token；将终端设备的IP地址的信息及接收到的token发送给应用服务器；如果接收到应用服务器发来的登录授权，则一键登录成功。
所述校验请求包括如下中的至少一个请求：携带APP ID、APP sign，KEY ID、时间戳以及所述IP地址的登录验证请求；携带APP ID、所述IP地址及时间戳的手机身份校验请求；携带APP ID及所述IP地址的新定义的校验请求。
其中，在将手机身份校验请求发送给运营商服务器之前，进一步包括：通过https链路向运营商服务器发送登录验证请求，通过https链路接收运营商服务器下发的对称密钥；所述将该校验请求发送给运营商服务器，包括：利用所述对称密钥对手机身份校验请求进行加密，将加密后的手机身份校验请求发送给运营商服务器；所述接收运营商服务器下发的token，包括：接收运营商服务器下发的加密后的token，利用对称密钥对该加密后的token进行解密，得到token。
根据第三方面，提供了一键登录业务的实现方法，该方法包括：接收到应用客户端发来的登录请求之后，进行登录预授权；接收应用客户端发来的token及该应用客户端所在的终端设备的IP地址的信息；将接收到的token以及所述IP地址的信息携带在号 码获取请求中，并将该号码获取请求发送给运营商服务器；如果接收到运营商服务器发来的应用客户端所在的终端设备的手机号，则根据该手机号进行登录授权处理。
其中，通过https链路与运营商服务器进行信息交互。
根据第四方面，提供了一键登录业务的实现装置，包括：第一IP地址获取模块，配置为从应用客户端发来的校验请求中获取第一IP地址的信息；令牌下发模块，配置为向所述应用客户端下发token；第二IP地址获取模块，配置为从应用服务器发来的号码获取请求中获取第二IP地址的信息；授权处理模块，配置为判断所述第一IP地址与所述第二IP地址是否相同，如果相同，则根据所述号码获取请求中携带的token获取应用客户端所在的终端设备的手机号，并发送给所述应用服务器，如果不相同，则拒绝将该终端设备的手机号发送给所述应用服务器。
根据第五方面，提供了一键登录业务的实现装置，包括：校验请求模块，配置为将所在的终端设备的IP地址的信息携带在校验请求中，并将该校验请求发送给运营商服务器；令牌接收模块，配置为接收运营商服务器下发的token；转发模块，配置为将所在的终端设备的IP地址的信息及接收到的token发送给应用服务器；登录授权模块，配置为如果接收到应用服务器发来的登录授权，则一键登录成功。
根据第六方面，提供了一键登录业务的实现装置，包括：预登录模块，配置为在接收到应用客户端发来的登录请求之后，进行预登录处理；网络因子获取模块，配置为接收应用客户端发来的token以及该应用客户端所在的终端设备的IP地址的信息；号码获取模块，配置为将接收到的token以及所述IP地址的信息携带在号码获取请求中，并将该号码获取请求发送给运营商服务器；授权执行模块，配置为如果接收到运营商服务器发来的应用客户端所在的终端设备的手机号，则根据该手机号进行登录授权处理。
根据第七方面，提供了一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现本说明书任一实施例所述的方法。
本说明书实施例提供的一键登录业务的实现方法及装置避免了应用服务器为攻击者的终端设备提供对应的应用服务，提高了安全性。
为了更清楚地说明本说明书实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本说明书的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是一键登录业务的一种操作示意图。
图2是本说明书一个实施例所应用的***架构的示意图。
图3是本说明书一个实施例在运营商服务器中实现一键登录业务的方法的流程图。
图4是本说明书一个实施例在应用客户端中实现一键登录业务的方法的流程图。
图5是本说明书一个实施例在应用服务器中实现一键登录业务的方法的流程图。
图6是本说明书一个实施例中运营商服务器、应用客户端及应用服务器配合实现一键登录业务的方法的流程图。
图7是本说明书一个实施例中一键登录业务的装置的结构示意图。
图8是本说明书另一个实施例中一键登录业务的装置的结构示意图。
图9是本说明书又一个实施例中一键登录业务的装置的结构示意图。
下面结合附图，对本说明书提供的方案进行描述。
为了方便对本说明书提供的方法进行理解，首先对本说明书所涉及和适用的***架构进行描述。如图2中所示，该***架构中主要包括三个网络节点：应用客户端、应用服务器和运营商服务器。
其中，应用客户端安装并运行于终端设备中，终端设备可以包括但不限于诸如：智能移动终端、智能家居设备、网络设备、可穿戴式设备、智能医疗设备、PC(个人计算机)等。其中智能移动终端可以包括诸如手机、平板电脑、笔记本电脑、PDA(个人数字助理)、互联网汽车等。智能家居设备可以包括智能家电设备，诸如智能电视、智能空调、智能热水器、智能冰箱、智能空气净化器等等，智能家居设备还可以包括智能门锁、智能插座、智能电灯、智能摄像头等。网络设备可以包括诸如交换机、无线AP、服务器等。可穿戴式设备可以包括诸如智能手表、智能眼镜、智能手环、虚拟 现实设备、增强现实设备、混合现实设备(即可以支持虚拟现实和增强现实的设备)等等。智能医疗设备可以包括诸如智能体温计、智能血压仪、智能血糖仪等等。
应用客户端可以是各种类型的应用，包括但不限于诸如支付类应用、多媒体播放类应用、地图类应用、文本编辑类应用、金融类应用、浏览器类应用、即时通信类应用等等。
运营商服务器指的是提供网络服务的供应商的服务端设备，可以是单一服务器，也可以是多个服务器构成的服务器群组。运营商服务器负责为各类应用提供网络服务，例如安全认证、提供一键登录的手机号等。
应用服务器是一种具体应用的服务器，专门为应用客户端提供对应的应用服务，比如对于支付宝这种应用客户端，应用服务器则是提供支付宝业务的服务器。
应该理解，图2中的应用客户端、应用服务器、运营商服务器的数目仅仅是示意性的。根据实现需要，可以选择和布设任意数目。
参见图2，应用客户端、应用服务器以及运营商服务器通过网络交互。其中，网络可以包括各种连接类型，例如有线、无线通信链路或者光纤电缆等。
因为本说明书提供的一键登录业务的实现方法涉及到图2中所示的3种网络节点，因此，下面通过不同的实施例分别说明运营商服务器、应用客户端以及应用服务器在一键登录业务中的处理。
首先，说明运营商服务器在一键登录业务中的处理。
图3是本说明书一个实施例在运营商服务器中实现一键登录业务的方法的流程图。参见图3，该方法包括以下步骤。
步骤301：从应用客户端发来的校验请求中获取第一IP地址的信息。
步骤303：向所述应用客户端下发令牌token。
步骤305：从应用服务器发来的号码获取请求中获取第二IP地址的信息。
步骤307：判断所述第一IP地址与所述第二IP地址是否相同，如果相同，执行步骤309，如果不相同，执行步骤311。
步骤309：根据号码获取请求中携带的token获取应用客户端所在的终端设备的手机号，并发送给所述应用服务器。
步骤311：拒绝将该终端设备的手机号发送给所述应用服务器。
在现有的一键登录业务中，会出现诸如如下情况：一个攻击者利用自己的终端设备X盗取了下发给应用客户端的token，之后，攻击者通过终端设备X仿冒该应用客户端所在的终端设备Y向应用服务器发送token，因为所利用的token正确，应用服务器可以从运营商服务器处拿到应用客户端所在的终端设备Y的手机号，从而导致应用服务器误认为发来token的终端设备X就是应用客户端所在的终端设备Y，即认为攻击者就是应用客户端的合法用户，从而向攻击者提供对应的应用服务，比如播放该合法用户才有权限观看的视频资料或者完成转账等，从而对用户的使用带来了安全问题，并可能会造成用户隐私数据的泄露。
而根据上述图3所示的过程可以看出，运营商服务器会在下发token之前获取应用客户端发来的第一IP地址(该第一IP地址对应的是：在下发token之前，向运营商服务器请求一键登录的终端设备的IP地址，比如记为终端设备Y的IP地址)，在下发token之后获取应用服务器发来的第二IP地址(该第二IP地址对应的是：在下发token之后，通过应用服务器请求一键登录的终端设备的IP地址)，如果该两个IP地址相同，就可以认为在一次一键登录业务中，下发token之前与运营商服务器通信的终端设备与下发token之后与应用服务器通信的终端设备是同一个终端设备，都是终端设备Y，也就是说，当前与应用服务器进行一键登录业务的终端设备(即向应用服务器发送token的终端设备)是合法用户使用的终端设备Y，下发的token没有被攻击者盗取，没有发生攻击行为，因此运营商服务器可以向应用服务器提供应用客户端所在的终端设备Y的手机号码，从而使得应用服务器为其当前连接的终端设备Y提供对应的应用服务；相反，如果该两个IP地址不相同，就可以认为在一次一键登录业务中，下发token之前与运营商服务器通信的终端设备Y与下发token之后与应用服务器通信的终端设备X不是同一个终端设备，也就是说，当前与应用服务器连接的终端设备X不是合法用户使用的终端设备Y，而是盗取了token的一个攻击者使用的终端设备X，已经发生了攻击行为，因此运营商服务器不向应用服务器提供应用客户端所在的终端设备Y的手机号码，从而使得应用服务器无法为其当前连接的攻击者的终端设备X提供对应的应用服务。可见，本说明书实施例的方法避免了应用服务器为攻击者的终端设备提供应用客户端对应的应用服务，提高了安全性。
下面结合具体的实施例对图3所示的过程进行说明。
首先对于步骤301：运营商服务器从应用客户端发来的校验请求中获取第一IP地址 的信息。
可以理解，应用客户端是通过其所在的终端设备Y向运营商服务器发送校验请求的，该校验请求中会携带终端设备Y的IP地址，记为第一IP地址。
携带第一IP地址的校验请求可以包括如下中的任意一种或者多种：校验请求1：在一键登录业务中，在运营商服务器下发token之前，应用客户端会向运营商服务器发送登录校验请求，以便对应用客户端的身份进行验证。因此，可以利用该登录校验请求携带所在终端设备的IP地址，并发送给运营商服务器，相应地，本步骤301中的校验请求可以是携带APP ID、APP sign，KEY ID、时间戳以及第一IP地址的登录校验请求。
校验请求2：在一键登录业务中，在运营商服务器下发token之前，应用客户端会向运营商服务器发送手机身份校验请求，以便对应用客户端所在的终端设备的身份进行验证。因此，可以利用该手机身份校验请求携带第一IP地址，并发送给运营商服务器，相应地，本步骤301中的校验请求可以是携带APP ID、第一IP地址及时间戳的手机身份校验请求。
校验请求3：在运营商服务器下发token之前，应用客户端可以利用新定义的一个校验请求将第一IP地址发送给运营服务器，相应地，本步骤301中的校验请求可以是携带APP ID及第一IP地址的新定义的校验请求。
较佳地，步骤301中的校验请求采用上述的校验请求2，即携带APP ID、第一IP地址及时间戳的手机身份校验请求。此时为了提高安全性，避免终端设备Y的第一IP地址及其他信息的泄露，可以进行加密处理，具体为：在步骤301之前，运营商服务器会通过https链路接收所述应用客户端发来的登录验证请求，在登录验证成功后，运营商服务器生成对称密钥key，通过https链路将该对称密钥key下发给所述应用客户端；这样，应用客户端会利用对称密钥key对携带APP ID、第一IP地址及时间戳的手机身份校验请求进行加密，然后再将加密后的手机身份校验请求发送给运营商服务器；相应地，步骤301的一种实现过程包括：运营商服务器利用对称密钥key对应用客户端发来的手机身份校验请求进行解密，从解密后的手机身份校验请求中获取所述第一IP地址的信息。
接下来对于步骤303：运营商服务器向所述应用客户端下发令牌token。
这里，运营商服务器在接收到手机身份校验请求后，会根据手机身份校验请求进行 身份验证，在身份验证成功后，向所述应用客户端下发token。
如前所述，如果运营商服务器生成了对称密钥key，那么，本步骤303中，运营商服务器利用对称密钥key对token进行加密，将加密后的token下发给应用客户端，从而尽可能地避免token泄露。
应用客户端获取了token之后，如果已被加密，则可以利用预先获取的对称密钥key进行解密，获得token。在应用客户端获得了token之后，应用客户端则可以将该token发送给应用服务器，同时，为了后续的合法性校验，应用客户端同时将所在的终端设备的IP地址记为第二IP地址也发送给应用服务器。应用服务器将接收到的token及第二IP地址携带在号码获取请求中发送给运营商服务器。
接下来对于步骤305：从应用服务器发来的号码获取请求中获取第二IP地址的信息。
执行到本步骤时，运营商服务器则从应用客户端及应用服务器两方获取了两个IP地址。
接下来在步骤307至步骤311中，如前所述，运营商服务器判断该两个IP地址是否相同，如果相同，就可以认为在一次一键登录业务中，下发token之前与运营商服务器通信的终端设备与在下发token之后与应用服务器通信的终端设备是同一个终端设备，都是终端设备Y，也就是说，当前与应用服务器进行一键登录业务的终端设备是合法用户使用的终端设备Y，因此运营商服务器可以向应用服务器提供应用客户端所在的终端设备Y的手机号码，从而使得应用服务器为其当前连接的终端设备Y提供对应的应用服务；相反，如果该两个IP地址不相同，就可以认为在一次一键登录业务中，下发token之前与运营商服务器通信的终端设备Y与在下发token之后与应用服务器通信的终端设备X不是同一个终端设备，也就是说，当前与应用服务器连接的终端设备X不是合法用户使用的终端设备Y，而是盗取了token的一个攻击者使用的终端设备X，已经发生了攻击行为，因此运营商服务器不向应用服务器提供应用客户端所在的终端设备Y的手机号码，从而使得应用服务器无法为其当前连接的终端设备X提供对应的应用服务。可见，本说明书实施例的方法避免了应用服务器为攻击者的终端设备提供应用客户端对应的应用服务，提高了安全性。
需要说明的是，在本说明书的实施例中，IP地址可以是IPv4(Internet Protocol Version 4，互联网协议第4版)地址以及IPv6(Internet Protocol Version 6，互联网协议第6版)地址中的任意一个或者两个。
在本说明书实施例中，应用客户端可以通过专有链路与应用服务器进行通信，在获得对称密钥之前应用客户端可以通过https链路与运营商服务器进行通信，在获得对称密钥之后应用客户端可以通过http链路与运营商服务器进行通信，应用服务器可以通过https链路与运营商服务器进行通信。
下面说明应用客户端在一键登录业务中的处理。
图4是本说明书一个实施例在应用客户端中实现一键登录业务的方法的流程图。参见图4，该方法包括：步骤401：将所在终端设备的IP地址的信息携带在校验请求中，并将该校验请求发送给运营商服务器。
本步骤401的具体实现的说明可以参见上述对步骤301的所有说明。
比如，步骤401的校验请求包括如下中的至少一个请求：携带APP ID、APP sign，KEY ID、时间戳以及所述IP地址的登录验证请求；携带APP ID、所述IP地址及时间戳的手机身份校验请求；携带APP ID及所述IP地址的新定义的校验请求。
再如，在一种较佳的实现方式中，校验请求为携带APP ID、所在终端设备的IP地址的信息及时间戳的手机身份校验请求。此时，在将手机身份校验请求发送给运营商服务器之前，进一步包括：应用客户端通过https链路向运营商服务器发送登录验证请求，通过https链路接收运营商服务器下发的对称密钥；本步骤401中，应用客户端利用对称密钥对手机身份校验请求进行加密，将加密后的手机身份校验请求发送给运营商服务器；步骤403：接收运营商服务器下发的token。
本步骤403的具体实现的说明可以参见上述对步骤303的所有说明。比如，应用客户端接收运营商服务器下发的加密后的token，利用对称密钥对该加密后的token进行解密，得到token。
步骤405：将所在终端设备的IP地址的信息及接收到的token发送给应用服务器。
为了能够在运营商服务器中进行合法性验证，应用客户端在向应用服务器发送token时，需要同时携带该应用客户端所在的终端设备的IP地址。
步骤407：如果接收到应用服务器发来的登录授权，则一键登录成功，如果未接收到应用服务器发来的登录授权，则一键登录失败。
下面说明应用服务器在一键登录业务中的处理。
图5是本说明书一个实施例在应用服务器中实现一键登录业务的方法的流程图。参 见图5，该方法包括：步骤501：接收应用客户端发来的登录请求，进行登录预授权。
当一个应用客户端需要使用一键登录业务时，首先会向应用服务器发送登录请求，从而触发启动一键登录业务。应用服务器则会进行登录预授权处理，比如发送预登录界面给应用客户端。之后，应用客户端则会执行上述步骤401至步骤405，具体可以参见对步骤401至步骤405的所有相关说明。
步骤503：接收应用客户端发来的token及该应用客户端所在的终端设备的IP地址的信息。
这里，如果token未被攻击者盗取，那么步骤503中与应用服务器通信的终端设备与步骤501中的终端设备就是同一个终端设备，比如记为终端设备Y，那么，步骤503中，应用服务器接收到的就是终端设备Y的IP地址。
相反，如果token被攻击者盗取，那么步骤503中与应用服务器通信的终端设备与步骤501中的终端设备就不是同一个终端设备，比如本步骤503中通信的终端设备记为终端设备X，那么，步骤503中，应用服务器接收到的就是终端设备X的IP地址。
步骤505：将接收到的token以及IP地址的信息携带在号码获取请求中，并将该号码获取请求发送给运营商服务器。
本步骤505中，应用服务器可以通过https链路将所述号码获取请求发送给运营商服务器。
运营商服务器接收到号码获取请求之后的处理可以参见上述对步骤305至步骤311的所有说明。
步骤507：如果接收到运营商服务器发来的应用客户端所在的终端设备的手机号，则根据该手机号进行登录授权处理。
下面结合应用客户端、应用服务器以及运营商服务器三者的配合处理，来说明一键登录业务的实现方法，在该方法中，在运营商服务器下发token之前，以应用客户端通过上述的校验请求2即手机身份校验请求携带终端设备的IP地址为例进行说明，参见图6，该方法包括如下步骤。
步骤601：应用客户端通过专有链路向自己所属的应用服务器发送登录请求。
本步骤601中，应用客户端即安装在终端设备中的应用程序(APP)。应用客户端可以是在受到用户的触发后，执行本步骤中发送登录请求的处理。
应用客户端与应用服务器之间存在专有链路，因此可以通过该专有链路而不是公网发送登录请求。
步骤603：应用服务器接收到登录请求后，进行登录预授权，包括通过专有链路向该应用客户端发送预登录界面。
步骤605：应用服务器通过https链路向运营商服务器发送登录验证请求。
这里，https链路是一种加密链路，通过该https链路发送登录验证请求可以进一步提高安全性。
本步骤605中，登录验证请求中可以包括应用客户端的标识(APP ID)、应用客户端的签名(APP sign)，密钥标识符(KEY ID)以及时间戳等信息。
步骤607：运营商服务器根据接收到的登录验证请求对应用客户端的身份进行认证，认证成功后会生成一个会话密钥key，通过https链路向应用客户端发送key。
这里，key是一个对称密钥。
步骤609：应用客户端生成携带APP ID、所在的终端设备的IP地址和时间戳的手机身份校验请求，用对称密钥key加密后，通过http链路发送给运营商服务器。
这里，手机身份校验请求中携带的应用客户端所在的终端设备的IP地址可以包括IPv4地址以及IPv6地址。
步骤611：运营商服务器利用key解密手机身份校验请求，进行身份验证，在身份验证成功后，从该手机身份校验请求中获取第一IP地址的信息，利用对称密钥key加密token，并向应用客户端下发加密后的token。
这里，运营商服务器会保存在下发token之前得到的应用客户端所在的终端设备的IP地址，记为第一IP地址。
步骤613：应用客户端利用对称密钥解密出token之后，通过专有链路将该token以及所在的终端设备的IP地址发送给应用服务器。
步骤615：应用服务器将APP ID、接收到的token以及IP地址携带在号码获取请求中通过https链路发送给运营商服务器。
步骤617：运营商服务器判断应用服务器发来的IP地址记为第二IP地址与之前获取的第一IP地址是否相同，如果相同，则通过https链路将从网关处查询到的终端设备的手机号码发送给应用服务器，否则，本次一键登录失败。
比如，一键登录失败时，运营商服务器向应用服务器返回取号失败消息。
步骤619：应用服务器如果接收到运营商服务器发来的应用客户端所在的终端设备的手机号，则根据该手机号并通过专有链路向应用客户端进行登录成功授权处理。
在本说明书的一个实施例中，提供了一键登录业务的实现装置，设置于运营商服务器中，参见图7，包括：第一IP地址获取模块701，配置为从应用客户端发来的校验请求中获取第一IP地址的信息；令牌下发模块702，配置为向所述应用客户端下发token；第二IP地址获取模块703，配置为从应用服务器发来的号码获取请求中获取第二IP地址的信息；授权处理模块704，配置为判断所述第一IP地址与所述第二IP地址是否相同，如果相同，则根据所述号码获取请求中携带的token获取应用客户端所在的终端设备的手机号，并发送给所述应用服务器，如果不相同，则拒绝将该终端设备的手机号发送给所述应用服务器。
在本说明书一个实施例中，第一IP地址获取模块701被配置为执行从下述的任意一种或多种请求中获取第一IP地址：携带APP ID、APP sign，KEY ID、时间戳以及所述第一IP地址的登录验证请求；以及携带APP ID、所述第一IP地址及时间戳的手机身份校验请求；以及携带APP ID及所述第一IP地址的新定义的校验请求。
在本说明书一个实施例中，所述校验请求为携带APP ID、第一IP地址信息及时间戳的手机身份校验请求；第一IP地址获取模块701被配置为执行从该手机身份校验请求中获取第一IP地址的信息；令牌下发模块702被配置执行：根据手机身份校验请求进行身份验证，在身份验证成功后，向所述应用客户端下发token。
在本说明书一个实施例中，应用于运营商服务器中的一键登录业务的实现装置进一步包括：登录验证模块，配置为通过https链路接收应用客户端发来的登录验证请求，根据登录验证请求进行登录验证；密钥生成模块，配置为在登录验证模块验证成功后，生成对称密钥，通过https链路将该对称密钥下发给所述应用客户端；第一IP地址获取模块701被配置为执行利用生成的所述对称密钥对应用客户端发来的手机身份校验请求进行解密，从解密后的手机身份校验请求中获取所述第一IP地址的信息；令牌下发模块702被配置执行：利用对称密钥对token进行加密，将加密后的token下发给应用客户端。
在本说明书的一个实施例中，提供了一键登录业务的实现装置，设置于应用客户端中，参见图8，包括：校验请求模块801，配置为将所在的终端设备的IP地址的信 息携带在校验请求中，并将该校验请求发送给运营商服务器；令牌接收模块802，配置为接收运营商服务器下发的token；转发模块803，配置为将所在的终端设备的IP地址的信息及接收到的token发送给应用服务器；登录授权模块804，配置为如果接收到应用服务器发来的登录授权，则一键登录成功。
在本说明书的一个实施例中，校验请求模块801被配置为将如下中的任意一种或者多种请求发送给运营商服务器：携带APP ID、APP sign，KEY ID、时间戳以及所述第一IP地址的登录验证请求；以及携带APP ID、所述第一IP地址及时间戳的手机身份校验请求；以及携带APP ID及所述第一IP地址的新定义的校验请求。
在本说明书的一个实施例中，当校验请求模块801发送的是携带APP ID、所述第一IP地址及时间戳的手机身份校验请求时，应用于应用客户端的一键登录业务的实现装置中进一步包括：登录请求模块，配置为通过https链路向运营商服务器发送登录验证请求，通过https链路接收运营商服务器下发的对称密钥；校验请求模块801被配置为利用所述对称密钥对手机身份校验请求进行加密，将加密后的手机身份校验请求发送给运营商服务器；令牌接收模块802被配置为执行：接收运营商服务器下发的加密后的token，利用对称密钥对该加密后的token进行解密，得到token。
在本说明书的一个实施例中，提供了一键登录业务的实现装置，设置于应用服务器中，参见图9，包括：预登录模块901，配置为在接收到应用客户端发来的登录请求之后，进行登录预处理；网络因子获取模块902，配置为接收应用客户端发来的token以及该应用客户端所在的终端设备的IP地址的信息；号码获取模块903，配置为将接收到的token以及所述IP地址的信息携带在号码获取请求中，并将该号码获取请求发送给运营商服务器；授权执行模块904，配置为如果接收到运营商服务器发来的应用客户端所在的终端设备的手机号，则根据该手机号进行登录授权处理。
在本说明书一个实施例中，号码获取模块903被配置为通过https链路将所述号码获取请求发送给运营商服务器；授权执行模块904被配置为通过https链路接收运营商服务器发来的应用客户端所在的终端设备的手机号。
本说明书一个实施例提供了一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行说明书中任一个实施例中的方法。
本说明书一个实施例提供了一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现执行说明书中任一个实 施例中的方法。
可以理解的是，本说明书实施例示意的结构并不构成对本说明书实施例的装置的具体限定。在说明书的另一些实施例中，上述装置可以包括比图示更多或者更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件、软件或者软件和硬件的组合来实现。
上述装置、***内的各模块之间的信息交互、执行过程等内容，由于与本说明书方法实施例基于同一构思，具体内容可参见本说明书方法实施例中的叙述，此处不再赘述。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、挂件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。
Claims (12)
- 一键登录业务的实现方法，其中包括：从应用客户端发来的校验请求中获取第一IP地址的信息；向所述应用客户端下发令牌token；从应用服务器发来的号码获取请求中获取第二IP地址的信息；判断所述第一IP地址与所述第二IP地址是否相同，如果相同，则根据所述号码获取请求中携带的token获取应用客户端所在的终端设备的手机号，并发送给所述应用服务器，如果不相同，则拒绝将该终端设备的手机号发送给所述应用服务器。
- 根据权利要求1所述的方法，其中，所述校验请求包括如下中的至少一个请求：携带APP ID、APP sign，KEY ID、时间戳以及所述第一IP地址的登录验证请求；携带APP ID、所述第一IP地址及时间戳的手机身份校验请求；携带APP ID及所述第一IP地址的新定义的校验请求。
- 根据权利要求2所述的方法，其中，当所述校验请求包括携带APP ID、第一IP地址信息及时间戳的手机身份校验请求时，在获取第一IP地址的信息之前，进一步包括：通过https链路接收所述应用客户端发来的登录验证请求，在登录验证成功后，生成对称密钥，通过https链路将该对称密钥下发给所述应用客户端；所述获取第一IP地址的信息，包括：利用生成的所述对称密钥对应用客户端发来的手机身份校验请求进行解密，从解密后的手机身份校验请求中获取所述第一IP地址的信息；所述向所述应用客户端下发令牌token，包括：利用对称密钥对token进行加密，将加密后的token下发给应用客户端。
- 一键登录业务的实现方法，该方法包括：将终端设备的IP地址的信息携带在校验请求中，并将该校验请求发送给运营商服务器；接收运营商服务器下发的token；将终端设备的IP地址的信息及接收到的token发送给应用服务器；如果接收到应用服务器发来的登录授权，则一键登录成功。
- 根据权利要求4所述的方法，其中，所述校验请求包括如下中的至少一个请求：携带APP ID、APP sign，KEY ID、时间戳以及所述IP地址的登录验证请求；携带APP ID、所述IP地址及时间戳的手机身份校验请求；携带APP ID及所述IP地址的新定义的校验请求。
- 根据权利要求5所述的方法，其中，当所述校验请求为携带APP ID、所述IP地址及时间戳的手机身份校验请求时，在将手机身份校验请求发送给运营商服务器之前，进一步包括：通过https链路向运营商服务器发送登录验证请求，通过https链路接收运营商服务器下发的对称密钥；所述将该校验请求发送给运营商服务器，包括：利用所述对称密钥对手机身份校验请求进行加密，将加密后的手机身份校验请求发送给运营商服务器；所述接收运营商服务器下发的token，包括：接收运营商服务器下发的加密后的token，利用对称密钥对该加密后的token进行解密，得到token。
- 一键登录业务的实现方法，该方法包括：接收应用客户端发来的登录请求，进行登录预授权；接收应用客户端发来的token及该应用客户端所在的终端设备的IP地址的信息；将接收到的token以及所述IP地址的信息携带在号码获取请求中，并将该号码获取请求发送给运营商服务器；如果接收到运营商服务器发来的应用客户端所在的终端设备的手机号，则根据该手机号进行登录授权处理。
- 根据权利要求7所述的方法，其中，通过https链路与运营商服务器进行信息交互。
- 一键登录业务的实现装置，包括：第一IP地址获取模块，配置为从应用客户端发来的校验请求中获取第一IP地址的信息；令牌下发模块，配置为向所述应用客户端下发token；第二IP地址获取模块，配置为从应用服务器发来的号码获取请求中获取第二IP地址的信息；授权处理模块，配置为判断所述第一IP地址与所述第二IP地址是否相同，如果相同，则根据所述号码获取请求中携带的token获取应用客户端所在的终端设备的手机号，并发送给所述应用服务器，如果不相同，则拒绝将该终端设备的手机号发送给所述应用服务器。
- 一键登录业务的实现装置，包括：校验请求模块，配置为将所在的终端设备的IP地址的信息携带在校验请求中，并将该校验请求发送给运营商服务器；令牌接收模块，配置为接收运营商服务器下发的token；转发模块，配置为将所在的终端设备的IP地址的信息及接收到的token发送给应用服务器；登录授权模块，配置为如果接收到应用服务器发来的登录授权，则一键登录成功。
- 一键登录业务的实现装置，包括：预登录模块，配置为在接收到应用客户端发来的登录请求之后，进行登录预授权；网络因子获取模块，配置为接收应用客户端发来的token以及该应用客户端所在的终端设备的IP地址的信息；号码获取模块，配置为将接收到的token以及所述IP地址的信息携带在号码获取请求中，并将该号码获取请求发送给运营商服务器；授权执行模块，配置为如果接收到运营商服务器发来的应用客户端所在的终端设备的手机号，则根据该手机号进行登录授权处理。
- 一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现权利要求1-8中任一项所述的方法。
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| EP22909697.9A EP4346256A1 (en) | 2021-12-22 | 2022-12-01 | Implementation of one-key login service |
| US18/398,424 US20240137221A1 (en) | 2021-12-22 | 2023-12-28 | Implementation of one-touch login service |
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111579026.2 | 2021-12-22 | ||
| CN202111579026.2A CN114390524B (zh) | 2021-12-22 | 2021-12-22 | 一键登录业务的实现方法和装置 |
Related Child Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| US18/398,424 Continuation US20240137221A1 (en) | 2021-12-22 | 2023-12-28 | Implementation of one-touch login service |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2023116382A1 true WO2023116382A1 (zh) | 2023-06-29 |
Family
ID=81197179
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2022/135823 WO2023116382A1 (zh) | 2021-12-22 | 2022-12-01 | 一键登录业务的实现 |
Country Status (4)
| Country | Link |
|---|---|
| US (1) | US20240137221A1 (zh) |
| EP (1) | EP4346256A1 (zh) |
| CN (1) | CN114390524B (zh) |
| WO (1) | WO2023116382A1 (zh) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117098134A (zh) * | 2023-10-17 | 2023-11-21 | 湖北星纪魅族集团有限公司 | 安全控制方法、终端及非暂时性计算机可读存储介质 |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114390524B (zh) * | 2021-12-22 | 2024-04-23 | 支付宝(杭州)信息技术有限公司 | 一键登录业务的实现方法和装置 |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109688147A (zh) * | 2018-12-29 | 2019-04-26 | 北京达佳互联信息技术有限公司 | 应用登录方法、装置、终端、服务器、***及存储介质 |
| CN110691087A (zh) * | 2019-09-29 | 2020-01-14 | 北京搜狐新媒体信息技术有限公司 | 一种访问控制方法、装置、服务器及存储介质 |
| CN111770057A (zh) * | 2020-05-29 | 2020-10-13 | 北京奇艺世纪科技有限公司 | 身份验证***及身份验证方法 |
| CN114390524A (zh) * | 2021-12-22 | 2022-04-22 | 支付宝(杭州)信息技术有限公司 | 一键登录业务的实现方法和装置 |
Family Cites Families (17)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8156335B2 (en) * | 2008-09-02 | 2012-04-10 | F2Ware, Inc. | IP address secure multi-channel authentication for online transactions |
| CN101350797B (zh) * | 2008-09-17 | 2011-11-30 | 腾讯科技（深圳）有限公司 | 简化用户操作的网站登录方法、***、客户端和服务器 |
| CN101448001B (zh) * | 2008-11-19 | 2012-03-21 | 中国工商银行股份有限公司 | 一种实现wap手机银行交易安全控制的***及方法 |
| CN103297404A (zh) * | 2012-03-01 | 2013-09-11 | 盛大计算机（上海）有限公司 | 一种实现登录确认的方法、装置及*** |
| CN103313245B (zh) * | 2013-05-28 | 2016-04-20 | 中国联合网络通信集团有限公司 | 基于手机终端的网络业务访问方法、设备和*** |
| CN104902028B (zh) * | 2015-06-19 | 2019-02-15 | 广州密码科技有限公司 | 一种一键登录认证方法、装置及*** |
| CN105101205B (zh) * | 2015-06-19 | 2018-12-18 | 广州密码科技有限公司 | 一种一键登录认证方法、装置及*** |
| CN106470201A (zh) * | 2015-08-21 | 2017-03-01 | 中兴通讯股份有限公司 | 一种用户认证方法和装置 |
| CN106130971B (zh) * | 2016-06-22 | 2019-05-10 | 中国联合网络通信集团有限公司 | 身份认证方法及认证服务器 |
| CN105897771B (zh) * | 2016-06-22 | 2019-04-09 | 中国联合网络通信集团有限公司 | 身份认证方法、认证服务器及第三方平台 |
| CN107948204B (zh) * | 2017-12-29 | 2020-10-30 | 咪咕文化科技有限公司 | 一键登录方法及***、相关设备以及计算机可读存储介质 |
| CN109089264A (zh) * | 2018-08-02 | 2018-12-25 | 江苏满运软件科技有限公司 | 一种移动终端免密登录的方法及*** |
| CN110392065A (zh) * | 2018-12-27 | 2019-10-29 | 上海创蓝文化传播有限公司 | 闪验号码认证sdk的实现方法及*** |
| CN110351298A (zh) * | 2019-07-24 | 2019-10-18 | ***通信集团黑龙江有限公司 | 访问控制方法、装置、设备及存储介质 |
| CN110798453B (zh) * | 2019-10-16 | 2022-07-12 | 上海易点时空网络有限公司 | 用于一键登录的数据处理方法及装置 |
| CN113423107A (zh) * | 2021-05-26 | 2021-09-21 | 动信(上海)互联网络有限公司 | 一种基于5g消息进行手机号身份认证的***及方法 |
| CN113765906B (zh) * | 2021-08-30 | 2022-11-29 | 上海纬百科技有限公司 | 终端应用程序的一键登录的方法、设备及*** |
-
2021
- 2021-12-22 CN CN202111579026.2A patent/CN114390524B/zh active Active
-
2022
- 2022-12-01 EP EP22909697.9A patent/EP4346256A1/en active Pending
- 2022-12-01 WO PCT/CN2022/135823 patent/WO2023116382A1/zh active Application Filing
-
2023
- 2023-12-28 US US18/398,424 patent/US20240137221A1/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109688147A (zh) * | 2018-12-29 | 2019-04-26 | 北京达佳互联信息技术有限公司 | 应用登录方法、装置、终端、服务器、***及存储介质 |
| CN110691087A (zh) * | 2019-09-29 | 2020-01-14 | 北京搜狐新媒体信息技术有限公司 | 一种访问控制方法、装置、服务器及存储介质 |
| CN111770057A (zh) * | 2020-05-29 | 2020-10-13 | 北京奇艺世纪科技有限公司 | 身份验证***及身份验证方法 |
| CN114390524A (zh) * | 2021-12-22 | 2022-04-22 | 支付宝(杭州)信息技术有限公司 | 一键登录业务的实现方法和装置 |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117098134A (zh) * | 2023-10-17 | 2023-11-21 | 湖北星纪魅族集团有限公司 | 安全控制方法、终端及非暂时性计算机可读存储介质 |
| CN117098134B (zh) * | 2023-10-17 | 2024-01-26 | 湖北星纪魅族集团有限公司 | 安全控制方法、终端及非暂时性计算机可读存储介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114390524B (zh) | 2024-04-23 |
| CN114390524A (zh) | 2022-04-22 |
| EP4346256A1 (en) | 2024-04-03 |
| US20240137221A1 (en) | 2024-04-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2022206349A1 (zh) | 一种信息验证的方法、相关装置、设备以及存储介质 | |
| US9992176B2 (en) | Systems and methods for encrypted communication in a secure network | |
| US11501294B2 (en) | Method and device for providing and obtaining graphic code information, and terminal | |
| WO2023116382A1 (zh) | 一键登录业务的实现 | |
| CN106487765B (zh) | 授权访问方法以及使用该方法的设备 | |
| EP3454504B1 (en) | Service provider certificate management | |
| MXPA04007546A (es) | Metodo y sistema para proporcionar una tercera autenticacion de autorizacion. | |
| WO2006135897A2 (en) | Proxy authentication network | |
| CN102427442A (zh) | 组合请求相关元数据和元数据内容 | |
| CN113225352B (zh) | 一种数据传输方法、装置、电子设备及存储介质 | |
| CN112437044B (zh) | 即时通讯方法和装置 | |
| CN103237010B (zh) | 以加密方式提供数字内容的服务器端 | |
| CN107094156A (zh) | 一种基于p2p模式的安全通信方法及*** | |
| WO2024139616A1 (zh) | 签名认证方法和装置 | |
| JP2008535427A (ja) | データ処理デバイスとセキュリティモジュールとの間のセキュア通信 | |
| CN113993127B (zh) | 一键登录业务的实现方法和装置 | |
| WO2018141219A1 (zh) | 认证服务器、认证***及方法 | |
| CN103237011B (zh) | 数字内容加密传送方法以及服务器端 | |
| CN114158046B (zh) | 一键登录业务的实现方法和装置 | |
| CN111698203A (zh) | 一种云数据加密方法 | |
| CN113904830B (zh) | 一种spa认证的方法、装置、电子设备和可读存储介质 | |
| CN105871788B (zh) | 一种登录服务器的密码生成方法及装置 | |
| CN112769783A (zh) | 数据传输方法及云服务器、接收端和发送端 | |
| CN114158047B (zh) | 一键登录业务的实现方法和装置 | |
| CN114826616B (zh) | 数据处理方法、装置、电子设备和介质 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 22909697 Country of ref document: EP Kind code of ref document: A1 |
|
| WWE | Wipo information: entry into national phase |
Ref document number: 2022909697 Country of ref document: EP Ref document number: 22909697.9 Country of ref document: EP |
|
| ENP | Entry into the national phase |
Ref document number: 2022909697 Country of ref document: EP Effective date: 20231227 |