WO2024093964A1 - 一种移动端单点登录认证的方法及*** - Google Patents

一种移动端单点登录认证的方法及*** Download PDF

Info

Publication number
WO2024093964A1
WO2024093964A1 PCT/CN2023/128128 CN2023128128W WO2024093964A1 WO 2024093964 A1 WO2024093964 A1 WO 2024093964A1 CN 2023128128 W CN2023128128 W CN 2023128128W WO 2024093964 A1 WO2024093964 A1 WO 2024093964A1
Authority
WO
WIPO (PCT)
Prior art keywords
single sign
information
module
authentication
access party
Prior art date
Application number
PCT/CN2023/128128
Other languages
English (en)
French (fr)
Inventor
许鹏飞
王刚
丘凌
陈天明
陶智明
符永捷
冯敏
丁嘉嘉
陈鑫
黄文欢
Original Assignee
天翼数字生活科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天翼数字生活科技有限公司 filed Critical 天翼数字生活科技有限公司
Publication of WO2024093964A1 publication Critical patent/WO2024093964A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol

Definitions

  • the present invention relates to the field of Internet technology, and in particular to a method and system for single sign-on authentication of a mobile terminal based on an operator's traffic gateway.
  • the “capability provider” authentication server After receiving the authorization code, the "access party” server applies for a token from the “capability provider” authentication server to obtain the user information of the "capability provider". It can be seen that this process still requires It is not convenient for users to manually agree to the authorization. There is also a risk of account leakage and illegal remote login, and there is no guarantee that the operation is performed on a trusted SIM card installed device (the user's mobile terminal), which has poor security.
  • the single sign-on authentication method and system of the present invention generates a safe and reliable token by obtaining a number from the traffic gateway of the mobile communication operator for real-time verification.
  • the most reliable user information (mobile phone number) can be obtained with just one click, and the user does not need to record the account number and password.
  • multi-concurrent login of multiple application processes can be achieved through inter-process communication, so that users can completely get rid of the trouble of needing to record multiple sets of account numbers and passwords and frequent logins. The process is safer and faster, and the user experience is better.
  • a method for single sign-on authentication of an access party application in a mobile terminal includes: applying for generation of a temporary login credential; performing user information authentication to obtain login authentication information based on received access party application information combined with user connection base station information and combined with an operator traffic gateway authentication plug-in; generating a temporary login credential based on the login authentication information; generating an authentication token based on the temporary login credential; using the authentication token to request user information; and completing login to the access party application based on the user information obtained after verification.
  • the step of applying for generating temporary login credentials includes: the access party application in the mobile terminal calls the single sign-on SDK module login interface implanted in the access party application, and communicates with the single sign-on application module through AIDL to send the access party application information (including the access party application package name, signature, BundleID, authentication certificate) to the single sign-on application module in the same mobile terminal; and the single sign-on application module processes the access party application information and sends it to the server
  • the single sign-on service module on the side applies for login authentication information.
  • the steps of performing user information authentication to obtain login authentication information include: the single sign-on service module on the server side sends the IP, MAC, and DeviceID information of the mobile terminal to the operator's traffic gateway verification module; the operator's traffic gateway verification module compares and verifies the received IP, MAC, and DeviceID information of the mobile terminal with the operator's base station information (including the location, frequency, and channel information of the base station) that it has, obtains the user information of the mobile terminal (including the mobile terminal SIM card number and location information), and feeds it back to the single sign-on service module; and the single sign-on service module generates login authentication information and feeds it back to the single sign-on application module.
  • a system for single sign-on authentication of access party applications in a mobile terminal includes: a single sign-on application module located in the mobile terminal for user authentication and information transmission, a single sign-on SDK module implanted in the access party application for information collection and transmission, and the access party's own login module; and a single sign-on service module and an operator traffic gateway verification module located on the server side for processing information reported by the single sign-on application module to perform traffic gateway authentication and provide user information.
  • the single sign-on service module and the operator traffic gateway verification module perform user information authentication based on the processed access party application information received from the single sign-on application module, combined with the user connection base station information and the operator traffic gateway authentication plug-in, to obtain login authentication information, and feed back the login authentication information to the single sign-on application module to generate a temporary login credential.
  • the single sign-on SDK module generates an authentication token based on the temporary login credential, and the authentication token is sent to the access party server to request user information from the single sign-on application module to complete the single sign-on authentication of the access party application.
  • the single sign-on application module further includes a process communication module and a traffic gateway verification module.
  • the traffic gateway verification module processes the access party application module information and sends it to the single sign-on service module to apply for generating temporary login credentials.
  • FIG1 is a schematic block diagram of a single sign-on authentication system according to the present invention.
  • FIG. 2 is a flow chart of a single sign-on authentication method according to an embodiment of the present invention.
  • each box in the flowchart or block diagram may represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions.
  • the single sign-on authentication method and system of the present invention completes operator traffic gateway verification, process communication between applications, etc. through the traffic network base station of the mobile communication operator connected to the user's client device, and can realize fast, imperceptible and safe single sign-on authentication service.
  • the present invention is applicable to various operating systems of existing mobile terminal devices, and each access party application can quickly and safely realize single sign-on authentication by implanting the single sign-on SDK of the present invention with the corresponding operating system version into itself.
  • the user information is obtained to complete the authentication and generate a temporary authentication token.
  • the single sign-on application in the mobile terminal uses the temporary authentication token to pass it to the single sign-on SDK implanted in the access party application through inter-process communication in the same device.
  • the single sign-on SDK obtains the authentication token and combines the characteristic information of the access party application to provide the access party application with login credentials that can be used for login.
  • the single sign-on authentication system of the present invention is described in detail below in conjunction with FIG. 1 .
  • the modules shown by the solid lines are components of the single sign-on authentication system of the present invention.
  • the modules shown by the dotted lines are related existing modules of the present invention, including the access side application module using the present invention. block, access server, and mobile device.
  • the single sign-on authentication system of the present invention includes a single sign-on application module 100 for user authentication and information transmission, a single sign-on SDK module 200 for information collection and transmission, and an access party's own login module 300 located in a read-only memory ROM of a mobile terminal; and a single sign-on service module 400 and an operator traffic gateway verification module 500 located on the server side for processing information reported by the single sign-on application module 100 to perform traffic gateway authentication and provide user information such as a SIM card number.
  • the single sign-on module 100 further includes a process communication module 110 and a traffic gateway verification module 120.
  • the process communication module 110 enables the system of the present invention to communicate with the access party application on the same terminal.
  • the single sign-on SDK module 200 and the access party's own login module 300 are embedded in the access party's application module.
  • the connection relationship and information transmission relationship of each module are as follows:
  • the access party application module calls the login interface of the single sign-on SDK module 200 embedded therein, so that the single sign-on SDK module 200 communicates with the single sign-on application module 100 in the mobile terminal (for example, communication can be carried out through AIDL, and other methods familiar to those skilled in the art are also conceivable), and sends the access party application module information (including, for example, the access party application package name, signature, BundleID, authentication credentials, etc.) to the single sign-on application module 100;
  • the access party application module information including, for example, the access party application package name, signature, BundleID, authentication credentials, etc.
  • the traffic gateway verification module 120 in the single sign-on application module 100 processes the received access party application module information and sends it to the single sign-on service module 400 on the server side to apply for generating a temporary login credential;
  • the single sign-on service module 400 communicates with the single sign-on application module 100 to receive the above-mentioned processed access party application module information. At the same time, the single sign-on service module 400 communicates with the operator traffic gateway verification module 500 to send private network IP, public network IP, device MAC address, device DeviceID and other information to the operator traffic gateway verification module 500.
  • the operator traffic gateway verification module 500 compares and verifies the information it has, namely the operator base station information to which the mobile terminal data traffic is connected (including, for example, the location, frequency, channel, etc. of the base station), with the above information reported by the single sign-on service module 400, and feeds back to the single sign-on service module 400 the user information such as the SIM card number and device location of the mobile terminal that initiated the request.
  • the single sign-on service module 400 then completes the acquisition of user information, generates login authentication information and sends it back to the single sign-on application module 100 of the mobile terminal;
  • the single sign-on application module 100 generates a temporary login credential based on the returned login authentication information and returns it to the single sign-on SDK module 200;
  • the single sign-on SDK module 200 generates an authentication token based on the received temporary login credentials and returns it to the access party's own login module 300 which is also embedded in the access party's application module;
  • the access party login module 300 sends the received authentication token to the access party server communicating with it, and the access party server communicates with the single sign-on service module 400 and requests user information (including, for example, the SIM card mobile phone number of the request initiating, the location information of the request initiating device, etc.) from the single sign-on service module 400;
  • user information including, for example, the SIM card mobile phone number of the request initiating, the location information of the request initiating device, etc.
  • the single sign-on service module 400 returns the user information to the access party server after verification
  • the access party server returns the received user information to the access party's own login module 300 of the mobile terminal, completing the user's silent login of the access party application.
  • the single sign-on authentication method of the present invention is described in detail below in conjunction with FIG. 2 .
  • the access party application is started.
  • Step S10 Apply to generate temporary login credentials. This step specifically includes:
  • Step S11 The access party application in the mobile terminal calls the login interface of the single sign-on SDK module embedded therein, communicates with the single sign-on application module in the mobile terminal through, for example, AIDL, and sends the access party application module information (including, for example, the access party application package name, signature, BundleID, authentication certificate, etc.) to the single sign-on application module;
  • the access party application module information including, for example, the access party application package name, signature, BundleID, authentication certificate, etc.
  • Step S12 the single sign-on application module processes the received access party application information and sends it to the single sign-on service module on the server side to apply for login authentication information;
  • Step S20 Perform user information authentication to obtain login authentication information.
  • the processed access party application information received from the single sign-on application module combined with the user connection base station information and the operator traffic gateway authentication plug-in, complete the user information authentication and return the login authentication information.
  • This step specifically includes:
  • Step S21 The single sign-on service module sends the private IP, public IP, device MAC address, device ID and other information of the mobile terminal to the operator on the server side.
  • Business traffic gateway verification module
  • Step S22 The operator traffic gateway verification module compares and verifies the received information with the information it has, such as the operator base station information (including, for example, the location, frequency, channel, etc. of the base station) to which the mobile terminal data traffic is connected, obtains the user information such as the SIM card number and location of the mobile terminal, and feeds it back to the single sign-on service module;
  • the operator base station information including, for example, the location, frequency, channel, etc. of the base station
  • Step S23 The single sign-on service module completes user information authentication and acquisition, generates login authentication information and feeds it back to the single sign-on application module of the mobile terminal;
  • Step S30 generating temporary login credentials: the single sign-on application module of the mobile terminal generates temporary login credentials according to the login authentication information received from the single sign-on service module, and feeds back the temporary login credentials to the single sign-on SDK module in the access party application in the mobile terminal;
  • Step S40 The single sign-on SDK module generates an authentication token according to the temporary login credentials
  • Step S50 The access party application module uses the authentication token to request the access party server to request user information from the single sign-on service module;
  • Step S60 After verification, the single sign-on service module feeds back the user information to the access server.
  • Step S70 The access-party server returns the acquired user information to the access-party application module in the mobile terminal, completing the user's silent login to the access-party application module.
  • the present invention realizes the generation of temporary authentication tokens through operator traffic gateway verification. It only needs to complete gateway number acquisition once when the device is activated.
  • the temporary authentication token can be used to realize single-point login in the same device through inter-process communication in the future. It can realize complete silent login, without the need for users to register and record any account information, and without the need for users to perform login operations. It is convenient and fast, and has a good user experience.
  • the authentication user information is generated by acquiring a number through the traffic gateway, it also ensures that only the user's own SIM card can generate a token, which is safe and reliable.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明涉及一种移动端单点登录认证的方法及***。通过由单点登录服务模块和运营商流量网关校验模块根据从单点登录应用模块接收到的经处理的接入方应用信息结合用户连接基站信息再结合运营商流量网关鉴权插件，进行用户信息鉴权，将获得的登录鉴权信息反馈给单点登录应用模块以生成临时登录凭证，交由单点登录SDK模块生成认证令牌，并发送给接入方服务器以向单点登录应用模块请求用户信息，来完成接入方应用的单点登录认证，从而实现静默登录，无需用户注册和记录任何的账号信息，无需用户进行登录操作，方便快捷，安全可靠。

Description

一种移动端单点登录认证的方法及*** 技术领域
本发明涉及互联网技术领域，尤其涉及一种基于运营商流量网关的移动端单点登录认证的方法及***。
背景技术
目前，用户在个人移动端上使用一款APP时如果想体验到更好的专属权益服务通常需要注册个人账号并在后续使用时登录该个人账号。随着日常使用的APP数量日渐增多，就需要注册多个APP账号，按各APP所的规定格式设置用户名和密码。许多APP在应用关闭时会自动退出账户，下次使用时用户又需要进行登录账户的操作，虽然部分APP可以通过指纹、手势解锁来免除记忆和反复输入用户名密码的麻烦，但频繁登录对用户来说总是难免体验感较差。另一些APP在应用关闭时甚至移动终端关闭或重启后也不会退出账户，这样虽然避免了下次使用时的登录操作，但会导致缺乏安全性，例如在手机丢失或失窃被不法分子获得的情况下可能导致该APP账户内资金或其他敏感信息遭到不法分子的盗用。
现在有一些单点登录的解决方案，例如，通过移动终端上的个人社交账号来登录同一移动端上的其它APP。这种技术是基于OAuth2.0模式制定的，通过一个社交账号认证服务器(以下称为“能力提供方”)生成临时令牌的方式为其它APP(以下称为“接入方”)提供注册和登录能力。但是这种技术方案受制于用户必须先拥有“能力提供方”的账号并且为已处于登录状态，用户欲访问每个其它APP时，该其它APP通过一个授权URL把用户导向“能力提供方”的认证服务器返回一个授权页面询问用户是否同意授权，用户点击“同意”按钮，“能力提供方”的认证服务器返回授权码，“接入方”服务器收到授权码后再向“能力提供方”的认证服务器申请令牌以获得“能力提供方”的该用户信息。可见该过程还是需要 用户手动同意授权，也不够便捷。且存在账号泄露被非法异地登录风险，无法保障一定是在可信SIM卡安装设备(本人移动端)上操作，安全性差。
现阶段还没有哪个解决方案可以实现让用户真正不需要注册任何账号也不需要任何用户授权其他“能力提供方”提供用户信息而直接就可以在一个设备中“无感登录”所有APP获得针对用户本人的专属权益服务体验。
因此，亟须一种优化的登录技术方案，解决在生成身份凭证时不够便捷可靠、多个应用需要多次登录等问题。
发明内容
提供本发明内容以便以简化形式介绍将在以下详细描述中进一步描述的一些概念。本发明内容并不旨在标识出所要求保护的主题的关键特征或必要特征；也不旨在用于确定或限制所要求保护的主题的范围。
本发明的单点登录认证的方法及***通过从移动通信运营商的流量网关取号实时校验生成安全可靠的令牌，只需点按一下即可获取最可靠的用户信息(手机号)，不需要用户记录账号密码，同时通过进程间通信实现多个应用进程的多并发登录，让用户彻底摆脱需要记录多套账号密码以及频繁登录的苦恼，流程更加安全快捷、用户体验更加良好。
根据本发明的一种移动端中接入方应用的单点登录认证的方法，包括：申请生成临时登录凭证；根据接收到的接入方应用信息结合用户连接基站信息再结合运营商流量网关鉴权插件，进行用户信息鉴权获得登录鉴权信息；根据登录鉴权信息生成临时登录凭证；根据临时登录凭证生成认证令牌；使用认证令牌请求用户信息；以及根据校验通过后的获得的用户信息，完成对接入方应用的登录。
其中，申请生成临时登录凭证的步骤包括：由移动端中的接入方应用调用植入在接入方应用中的单点登录SDK模块登录接口，与单点登录应用模块通过AIDL进行通信，来将接入方应用信息(包括接入方应用包名、签名、BundleID、鉴权凭证)发送给同处移动端中的单点登录应用模块；以及由单点登录应用模块对接入方应用信息进行处理后发送到服务器 侧的单点登录服务模块以申请登录鉴权信息。
进行用户信息鉴权获得登录鉴权信息的步骤包括：由服务器侧的单点登录服务模块将移动端的IP、MAC、DeviceID信息发送给运营商流量网关校验模块；由运营商流量网关校验模块将接收到的移动端的IP、MAC、DeviceID信息与自身掌握的运营商基站信息(包括基站的位置、频率、信道信息)进行比对校验，获得移动端的用户信息(包括移动端SIM***和位置信息)反馈给单点登录服务模块；以及由单点登录服务模块生成登录鉴权信息并反馈给单点登录应用模块。
根据本发明的一种用于移动端中接入方应用的单点登录认证的***，包括：位于移动端内的用于用户鉴权和传输信息的单点登录应用模块、被植入在接入方应用中的用于信息采集与传输的单点登录SDK模块、和接入方自身登录模块；以及位于服务器侧的用于处理单点登录应用模块上报的信息进行流量网关鉴权并提供用户信息的单点登录服务模块和运营商流量网关校验模块。
其中，单点登录服务模块和运营商流量网关校验模块根据从单点登录应用模块接收到的经处理的接入方应用信息结合用户连接基站信息再结合运营商流量网关鉴权插件，进行用户信息鉴权获得登录鉴权信息，并将登录鉴权信息反馈给单点登录应用模块以生成临时登录凭证，单点登录SDK模块基于临时登录凭证生成认证令牌，认证令牌被发送给接入方服务器以向单点登录应用模块请求用户信息完成接入方应用的单点登录认证。
其中，单点登录应用模块进一步包括进程通信模块和流量网关检验模块，流量网关检验模块对接入方应用模块信息进行处理并发送到单点登录服务模块，以申请生成临时登录凭证。
通过阅读下面的详细描述并参考相关联的附图，这些及其他特点和优点将变得显而易见。应该理解，前面的概括说明和下面的详细描述只是说明性的，不会对所要求保护的各方面形成限制。
附图说明
以下将通过参考附图中示出的具体实施例来对本发明进行更具体描 述。
图1是根据本发明的单点登录认证***的示意框图；
图2是根据本发明的一个实施例的单点登录认证方法的流程图。
附图中的流程图和框图显示了根据本申请的实施例的***、方法可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或代码的一部分，所述模块、程序段或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。
具体实施方式
以下将通过参考附图中示出的具体实施例来对本发明进行更具体描述。通过阅读下文具体实施方式的详细描述，本发明的各种优点和益处对于本领域普通技术人员将变得清楚明了。然而应当理解，可以以各种形式实现本发明而不应被这里阐述的各实施方式所限制。提供以下实施方式是为了能够更透彻地理解本发明。除非另有说明，本申请使用的技术术语或者科学术语应当为本申请所属领域技术人员所理解的通常意义。
本发明的单点登录认证的方法及***通过用户的客户端设备连接的移动通信运营商的流量网络基站完成运营商流量网关校验、应用间的进程通信等，可以实现快捷、无感、安全的单点登录认证服务。本发明适用于现有移动端设备的各类操作***，各接入方应用都可以通过向自身植入对应操作***版本的本发明的单点登录SDK快捷安全地实现单点登录认证。
根据本发明，通过采集用户移动端流量网络基站信息与运营商流量网关持有信息比对校验，进而得到用户信息完成认证生成临时认证令牌，移动端内的单点登录应用进而使用临时认证令牌在同设备内通过进程间的通信传递给植入在接入方应用中的单点登录SDK，单点登录SDK得到认证令牌和结合接入方应用的特性信息，为接入方应用提供可作为登录使用的登录凭证。
以下结合图1详述本发明的单点登录认证的***。
在图1中，实线所示模块为本发明的单点登录认证***的组成部分。而虚线所示模块为本发明相关现有模块，包括使用本发明的接入方应用模 块、接入方服务器、以及移动端设备。
本发明的单点登录认证***包括，位于移动端的只读存储器ROM内的用于用户鉴权和传输信息的单点登录应用模块100、用于信息采集与传输的单点登录SDK模块200、和接入方自身登录模块300；以及位于服务器侧的用于处理单点登录应用模块100上报的信息进行流量网关鉴权并提供SIM***等用户信息的单点登录服务模块400和运营商流量网关校验模块500。
其中单点登录模块100中进一步包括进程通信模块110和流量网关检验模块120，进程通信模块110实现本发明的***和接入方应用在同一终端上通信，。
单点登录SDK模块200和接入方自身登录模块300被植入在接入方应用模块中。各模块的连接关系和信息传输关系具体如下：
在移动端，接入方应用模块调用植入在其中的单点登录SDK模块200的登录接口，使得单点登录SDK模块200去和同在移动端中的单点登录应用模块100进行通信(例如可以通过AIDL进行通信，其他本领域技术人员熟悉的方式也是可以构想的)，将接入方应用模块信息(包括例如接入方应用包名、签名、BundleID、鉴权凭证等)发送给单点登录应用模块100；
单点登录应用模块100中的流量网关检验模块120对收到的上述接入方应用模块信息进行处理并发送到服务器端的单点登录服务模块400，以申请生成临时登录凭证；
单点登录服务模块400与单点登录应用模块100进行通信，接收上述经处理的接入方应用模块信息，同时单点登录服务模块400和运营商流量网关校验模块500进行通信，将私网IP、公网IP、设备MAC地址、设备DeviceID等信息发送给运营商流量网关校验模块500。
运营商流量网关校验模块500将自身掌握的信息一一移动端数据流量连接的运营商基站信息(包括例如，基站的位置、频率、信道等)，与单点登录服务模块400上报的上述信息进行比对校验，将发起请求的移动端的SIM***、设备位置等用户信息反馈给单点登录服务模块400。
单点登录服务模块400进而完成用户信息的获取，生成登录鉴权信息并发送回移动端的单点登录应用模块100；
单点登录应用模块100根据返回的登录鉴权信息生成临时登录凭证并将其返回单点登录SDK模块200；
单点登录SDK模块200根据接收到的临时登录凭证生成认证令牌并将其返回同样植入在接入方应用模块之中的接入方自身登录模块300；
接入方自身登录模块300将接收到的认证令牌发送到与之通信的接入方服务器，接入方服务器与单点登录服务模块400进行通信，向单点登录服务模块400请求用户信息(包括例如，请求发起的SIM卡手机号、请求发起设备的位置信息等)；
单点登录服务模块400在校验通过后将用户信息返回接入方服务器；
接入方服务器将收到的用户信息返回移动端的接入方自身登录模块300，完成接入方应用的用户静默登录。
以下结合图2详述本发明的单点登录认证的方法，在用户准备使用其移动端中的某一应用之际，启动该接入方应用。
步骤S10、申请生成临时登录凭证，该步骤具体包括：
步骤S11、由移动端中的接入方应用调用植入其中的单点登录SDK模块登录接口，与移动端中的单点登录应用模块通过例如AIDL进行通信，将接入方应用模块信息(包括例如接入方应用包名、签名、BundleID、鉴权凭证等)发送给单点登录应用模块；
步骤S12、单点登录应用模块将所收到的上述接入方应用信息进行处理后发送给服务器侧的单点登录服务模块以申请登录鉴权信息；
步骤S20、进行用户信息鉴权获得登录鉴权信息，根据从单点登录应用模块接收到的经处理的接入方应用信息结合用户连接基站信息再结合运营商流量网关鉴权插件，完成用户信息鉴权返回登录鉴权信息，该步骤具体包括：
步骤S21、单点登录服务模块将移动端的私网IP、公网IP、设备MAC地址、设备DeviceID等信息发送给同样属于服务器侧的运 营商流量网关校验模块；
步骤S22、运营商流量网关校验模块将所接收到的上述信息和自身掌握的信息一一例如移动端数据流量所连接的运营商基站信息(包括例如，基站的位置、频率、信道等)进行比对校验，获得移动端的SIM***、位置等用户信息，反馈给单点登录服务模块；
步骤S23、单点登录服务模块完成用户信息鉴权与获取，生成登录鉴权信息并反馈给移动端的单点登录应用模块；
步骤S30、生成临时登录凭证：移动端的单点登录应用模块根据从单点登录服务模块收到的登录鉴权信息生成临时登录凭证，并将临时登录凭证反馈给同在移动端内的接入方应用中的单点登录SDK模块；
步骤S40、单点登录SDK模块根据临时登录凭证生成认证令牌；
步骤S50、接入方应用模块使用该认证令牌请求接入方服务器去向单点登录服务模块请求用户信息；
步骤S60、单点登录服务模块在校验通过后将用户信息反馈给接入方服务器
步骤S70、接入方服务器将获取的用户信息返回移动端中的接入方应用模块，完成用户对该接入方应用模块的静默登录。
本发明通过运营商流量网关校验实现生成临时认证令牌，只需要在设备激活时完成一次网关取号，后续都可以使用临时认证令牌在同设备内通过进程间的通信实现单点登录，可以实现彻底的静默登录，无需用户注册和记录任何的账号信息，无需用户进行登录操作，方便快捷，具有良好的用户体验。而且，由于是通过流量网关取号实现认证用户信息生成身份凭证，也确保了只有用户本人的SIM卡才可以生成令牌，安全可靠。
以上各实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述各实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围，其均应涵盖在本申请的权利要求和说明书的范围当中。

Claims (10)

  1. 一种移动端中接入方应用的单点登录认证的方法，包括：
    申请生成临时登录凭证；
    根据接收到的接入方应用信息结合用户连接基站信息再结合运营商流量网关鉴权插件，进行用户信息鉴权获得登录鉴权信息；
    根据所述登录鉴权信息生成临时登录凭证；
    根据所述临时登录凭证生成认证令牌；
    使用所述认证令牌请求用户信息；以及
    根据校验通过后的获得的所述用户信息，完成对接入方应用的登录。
  2. 根据权利要求1所述的方法，其特征在于，申请生成临时登录凭证的步骤包括：
    由移动端中的所述接入方应用将所述接入方应用信息发送给同处所述移动端中的单点登录应用模块；以及
    由所述单点登录应用模块对所述接入方应用信息进行处理后发送到服务器侧的单点登录服务模块以申请登录鉴权信息。
  3. 根据权利要求2所述的方法，其特征在于，所述接入方应用信息包括接入方应用包名、签名、BundleID、鉴权凭证。
  4. 根据权利要求2所述的方法，其特征在于，由移动端中的所述接入方应用将所述接入方应用信息发送给单点登录应用模块包括：调用植入在所述接入方应用中的单点登录SDK模块登录接口，与所述单点登录应用模块通过AIDL进行通信。
  5. 根据权利要求1所述的方法，其特征在于，进行用户信息鉴权获得登录鉴权信息的步骤包括：
    由服务器侧的单点登录服务模块将移动端的IP、MAC、DeviceID信息发送给运营商流量网关校验模块；
    由所述运营商流量网关校验模块将接收到的所述移动端的IP、MAC、DeviceID信息与自身掌握的运营商基站信息进行比对校验，获得移动端的用户信息反馈给所述单点登录服务模块；以及
    由所述单点登录服务模块生成所述登录鉴权信息并反馈给所述单点登录应用模块。
  6. 根据权利要求5所述的方法，其特征在于，所述运营商基站信息包括基站的位置、频率、信道信息。
  7. 根据权利要求5所述的方法，其特征在于，所述移动端的用户信息包括移动端SIM***和位置信息。
  8. 一种用于移动端中接入方应用的单点登录认证的***，包括：
    位于移动端内的用于用户鉴权和传输信息的单点登录应用模块、用于信息采集与传输的单点登录SDK模块、和接入方自身登录模块；以及
    位于服务器侧的用于处理所述单点登录应用模块上报的信息进行流量网关鉴权并提供用户信息的单点登录服务模块和运营商流量网关校验模块，
    其中，所述单点登录服务模块和所述运营商流量网关校验模块根据从所述单点登录应用模块接收到的经处理的接入方应用信息结合用户连接基站信息再结合运营商流量网关鉴权插件，进行用户信息鉴权获得登录鉴权信息，并将登录鉴权信息反馈给所述单点登录应用模块以生成临时登录凭证，所述单点登录SDK模块基于所述临时登录凭证生成认证令牌，所述认证令牌被发送给接入方服务器以向所述单点登录应用模块请求所述用户信息完成接入方应用的单点登录认证。
  9. 根据权利要求8所述的***，其特征在于，所述单点登录SDK模块和接入方自身登录模块被植入在所述接入方应用中。
  10. 根据权利要求8所述的***，其特征在于，所述单点登录应用模块进一步包括进程通信模块和流量网关检验模块，其中所述流量网关检验模块对接入方应用模块信息进行处理并发送到所述单点登录服务模块，以申请生成临时登录凭证。
PCT/CN2023/128128 2022-11-03 2023-10-31 一种移动端单点登录认证的方法及*** WO2024093964A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211369970.XA CN117997568A (zh) 2022-11-03 2022-11-03 一种移动端单点登录认证的方法及***
CN202211369970.X 2022-11-03

Publications (1)

Publication Number Publication Date
WO2024093964A1 true WO2024093964A1 (zh) 2024-05-10

Family

ID=90900370

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/128128 WO2024093964A1 (zh) 2022-11-03 2023-10-31 一种移动端单点登录认证的方法及***

Country Status (2)

Country Link
CN (1) CN117997568A (zh)
WO (1) WO2024093964A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130139241A1 (en) * 2011-11-29 2013-05-30 Michael Leeder Methods, systems, and computer readable media for bridging user authentication, authorization, and access between web-based and telecom domains
US20140181944A1 (en) * 2012-12-26 2014-06-26 Cellco Partnership D/B/A Verizon Wireless Single sign-on for a native application and a web application on a mobile device
US20200382488A1 (en) * 2019-06-03 2020-12-03 Zuora, Inc. Systems and methods for providing authentication in a microservice system
CN114430340A (zh) * 2021-12-24 2022-05-03 天翼云科技有限公司 一种跨域单点登录方法、装置及设备
CN114666124A (zh) * 2022-03-22 2022-06-24 通号智慧城市研究设计院有限公司 业务***登录方法、登录装置、电子设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130139241A1 (en) * 2011-11-29 2013-05-30 Michael Leeder Methods, systems, and computer readable media for bridging user authentication, authorization, and access between web-based and telecom domains
US20140181944A1 (en) * 2012-12-26 2014-06-26 Cellco Partnership D/B/A Verizon Wireless Single sign-on for a native application and a web application on a mobile device
US20200382488A1 (en) * 2019-06-03 2020-12-03 Zuora, Inc. Systems and methods for providing authentication in a microservice system
CN114430340A (zh) * 2021-12-24 2022-05-03 天翼云科技有限公司 一种跨域单点登录方法、装置及设备
CN114666124A (zh) * 2022-03-22 2022-06-24 通号智慧城市研究设计院有限公司 业务***登录方法、登录装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN117997568A (zh) 2024-05-07

Similar Documents

Publication Publication Date Title
US11510054B2 (en) Methods, apparatuses, and computer program products for performing identification and authentication by linking mobile device biometric confirmation with third-party mobile device account association
WO2018113437A1 (zh) 基于鉴权装置的电子身份证认证服务***
US8606234B2 (en) Methods and apparatus for provisioning devices with secrets
US9038138B2 (en) Device token protocol for authorization and persistent authentication shared across applications
US9781105B2 (en) Fallback identity authentication techniques
EP2834959B1 (en) Secure authentication in a multi-party system
US8978100B2 (en) Policy-based authentication
US7865173B2 (en) Method and arrangement for authentication procedures in a communication network
US20160337351A1 (en) Authentication system
WO2014183526A1 (zh) 一种身份识别的方法、装置和***
US10291588B2 (en) Secure registration to a service provided by a web server
CN112020716A (zh) 远程生物特征识别
WO2024088370A1 (zh) 设备匿名标识获取方法、装置、存储介质及计算机设备
KR20220167366A (ko) 온라인 서비스 서버와 클라이언트 간의 상호 인증 방법 및 시스템
WO2024093964A1 (zh) 一种移动端单点登录认证的方法及***
KOSE et al. TrustedID: An Identity Management System based on OpenID Connect Protocol
CN115314217A (zh) 跨多接入边缘计算***登录方法及装置
KR20170099339A (ko) 보안 회원가입 및 로그인 호스팅 서비스 제공 시스템 및 그 방법
KR20170070379A (ko) 이동통신 단말기 usim 카드 기반 암호화 통신 방법 및 시스템
CN106664313B (zh) 认证中心的***或方法
US11917087B2 (en) Transparent short-range wireless device factor in a multi-factor authentication system
WO2024016124A1 (zh) 一种设备配置方法及装置、通信设备
WO2024114636A1 (zh) 认证方法、装置、业务平台及存储介质
GB2582326A (en) A method of mutual authentication
CN116366274A (zh) 处理访问控制的装置、方法及***

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23884894

Country of ref document: EP

Kind code of ref document: A1