CN112862590A - Business authorization method, computing device and medium - Google Patents

Business authorization method, computing device and medium Download PDF

Info

Publication number
CN112862590A
CN112862590A CN202110057097.XA CN202110057097A CN112862590A CN 112862590 A CN112862590 A CN 112862590A CN 202110057097 A CN202110057097 A CN 202110057097A CN 112862590 A CN112862590 A CN 112862590A
Authority
CN
China
Prior art keywords
information
server
authentication
user
text
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202110057097.XA
Other languages
Chinese (zh)
Inventor
王懋成
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Construction Bank Corp Shanghai Branch
Original Assignee
China Construction Bank Corp Shanghai Branch
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Construction Bank Corp Shanghai Branch filed Critical China Construction Bank Corp Shanghai Branch
Priority to CN202110057097.XA priority Critical patent/CN112862590A/en
Publication of CN112862590A publication Critical patent/CN112862590A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/02Banking, e.g. interest calculation or account maintenance
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45Structures or tools for the administration of authentication
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/42Confirmation, e.g. check or permission by the legal debtor of payment

Abstract

The present disclosure provides a business authorization method, a computing device and a medium. The service authorization method comprises the following steps: generating, at a first server, a first text and first authentication information in response to a first request for a service to be authorized from a second server, the first text including the first authentication information, the first text being associated with the service to be authorized; sending a first response including the first text to the second server to enable the second server to present the first text via the user terminal; determining second authentication information based on the first authentication information; sending a verification message to the user terminal, wherein the verification message indicates the association information about the first verification information for prompting the user to send the information to be verified to the second server to generate a verification confirmation message; and if the authentication confirmation message received from the second server matches the second authentication information, enabling the service to be authorized with respect to the user to be authorized. The method and the system can support service authorization in a three-party scene.

Description

Business authorization method, computing device and medium
Technical Field
Embodiments of the present disclosure relate to the field of information processing, and more particularly, to a business authorization method, a computing device, and a medium.
Background
With the development of internet technology, financial institutions increasingly adopt online transaction modes, thereby providing high efficiency and convenience for users. Services provided by the financial institution may be exposed on the platform of the third party institution for selection by the user. However, when a user desires that a service to be authorized, at least for security reasons and compliance with regulations of a regulatory body, the user needs to make, for example, a contract with a financial institution other than a third-party institution to complete the authorization of the service to be authorized, and for services such as ETC authorization, the user may still need to go to the office of the financial institution to complete the authorization. Therefore, there is a need in such three-party scenarios to securely authorize the service to be authorized with respect to the user.
The traditional business authorization scheme is difficult to effectively and safely realize business authorization in a three-party scene.
Disclosure of Invention
Embodiments of the present disclosure provide a service authorization method, a computing device, and a computer-readable storage medium, which can effectively and securely implement service authorization in a three-party scenario.
In a first aspect of the present disclosure, a service authorization method is provided, including: generating, at a first server, a first text and first authentication information in response to a first request for a service to be authorized from a second server, the first text including the first authentication information, the first text being associated with the service to be authorized; sending a first response including the first text to the second server to enable the second server to present the first text via the user terminal; determining second authentication information based on the first authentication information; sending a verification message to the user terminal, wherein the verification message indicates the association information about the first verification information for prompting the user to send the information to be verified to the second server to generate a verification confirmation message; and if the authentication confirmation message received from the second server matches the second authentication information, causing the service to be authorized with respect to the user to be authorized.
In a second aspect of the present disclosure, a service authorization method is provided, including: at a second server, sending a first request for the service to be authorized to a first server; receiving a first response comprising a first text from the first server, wherein the first text comprises first verification information, and the first text is associated with the service to be authorized; enabling the user terminal to display the first text to a user; receiving information to be authenticated from the user terminal, wherein the information to be authenticated is sent by the user terminal in response to receiving an authentication message sent by the first server, and wherein the authentication message indicates association information regarding the first authentication information; sending a verification confirmation message including the to-be-verified information to the first server to cause the first server to authorize the to-be-authorized service with respect to the user based on a match between the verification confirmation message and second verification information at the first server, wherein the second verification information is determined by the first server based on the first verification information.
In a third aspect of the present disclosure, a service authorization method is provided, including: at the user terminal, sending a second request indicating a service to be authorized intended by the user to a second server; receiving a first text from the second server for presentation to the user, the first text comprising first authentication information, the first text being associated with the service to be authorized; receiving a verification message from the first server, the verification message indicating associated information about the first verification information for prompting a user to send information to be verified to the second server; receiving information to be verified input by a user based on the verification message and the first text; and sending the information to be verified to the second server, so that the second server generates a verification confirmation message for enabling the service to be authorized between the second server and the user based on the information to be verified, wherein the verification confirmation message is used by the first server to confirm the matching with the second verification information.
In a fourth aspect of the disclosure, there is provided a computing device comprising: at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions when executed by the at least one processing unit causing the computing device to perform the method according to any one of the first to third aspects of the present disclosure.
In a fifth aspect of the present disclosure, there is provided a computer readable storage medium having stored thereon computer program code which, when executed, causes a machine to perform a method according to any one of the first to third aspects of the present disclosure.
The embodiment of the disclosure can support service authorization in a three-party scenario.
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the disclosure, nor is it intended to be used to limit the scope of the disclosure.
Drawings
The foregoing and other objects, features and advantages of the disclosure will be apparent from the following more particular descriptions of exemplary embodiments of the disclosure as illustrated in the accompanying drawings wherein like reference numbers generally represent like parts throughout the exemplary embodiments of the disclosure.
FIG. 1 schematically shows a schematic diagram of an exemplary environment in accordance with an embodiment of the present disclosure.
Fig. 2 schematically shows a schematic diagram of an interaction method of service authorization according to an embodiment of the present disclosure.
Fig. 3 schematically shows a flow chart of a service authorization method performed at a first server according to an embodiment of the present disclosure.
Fig. 4 schematically shows a flow chart of a service authorization method performed at a second server according to an embodiment of the present disclosure.
Fig. 5 schematically shows a flow chart of a service authorization method performed at a user terminal according to an embodiment of the present disclosure.
FIG. 6 illustrates a schematic block diagram of an example computing device that can be used to implement embodiments of the present disclosure.
Detailed Description
The principles of the present disclosure will be described below with reference to a number of example embodiments shown in the drawings.
The term "include" and variations thereof as used herein is meant to be inclusive in an open-ended manner, i.e., "including but not limited to". Unless specifically stated otherwise, the term "or" means "and/or". The term "based on" means "based at least in part on". The terms "one example embodiment" and "one embodiment" mean "a set of example embodiments". The term "another embodiment" means "a set of additional embodiments". The terms "first," "second," and the like may refer to different or the same object. Other explicit and implicit definitions are also possible below.
As discussed above, in a three-party scenario, the conventional scheme cannot effectively and securely implement authorization of a service to be authorized between, for example, a financial institution and a user, due to the presence of a third party other than a service provider and an acquirer, and thus, there is a need for a scheme capable of implementing authorization of a service to be authorized in a three-party scenario. Furthermore, due to the presence of third parties, it is desirable to be able to expose as little user information as possible, in particular information relating to the user's financial security, to the third parties. Thus, there is also a need for proper handling of sensitive information about privacy, and even financial security, that a user retains at a financial institution.
To address at least in part one or more of the above problems and other potential problems, example embodiments of the present disclosure propose a service authorization scheme in which a user may select a service that a financial institution can provide on a third-party platform presented by the user terminal and input information required to authorize the service. The server of the third party platform may send a request including such information to the server of the financial institution. The server of the financial institution can respectively send different verification information to the third-party platform and the user terminal so as to be displayed to the user. The user can input corresponding information to be verified by means of the user terminal according to the received verification information and send the corresponding information to be verified to the server of the third-party platform. And the server of the third-party platform processes the information to be verified and sends the information to be verified to the server of the financial institution to verify whether the information to be verified is correct or not. The financial institution's server enables the service to be authorized with respect to the user to be authorized in case the information to be verified is correct, and optionally, re-sends different verification information to the third party platform and the user terminal in case the information to be verified is incorrect.
In this scenario, sensitive information such as information regarding fund security (e.g., information for authentication) may not be exposed to third parties based on interactions between the three parties, whereby the financial institution's server may securely and efficiently (e.g., via a third party platform) effect authorization of the transaction to be authorized with the user.
Fig. 1 illustrates a schematic diagram of an exemplary environment 100 in which devices and/or methods according to embodiments of the present disclosure may be implemented, according to an embodiment of the present disclosure.
As shown in fig. 1, the environment 100 generally includes a user terminal 115, a first server 105 and a second server 110, the first server 105 and the second server 110, and the second server 110 and the user terminal 115 are communicatively connected to each other, and the first server may send a message (e.g., a text message, a telephone channel, an official public number channel (such as WeChat, Payment Bao), etc.) to the user terminal through a communication channel (e.g., a text message channel, a telephone channel, an official public number channel (such as WeChat, Payment Bao), etc.).
The user terminal 115 may be implemented, for example, at a computing device. For example, the user 120 may obtain the desired service at the user terminal 115 via a user interface (APP, web page, applet, software, etc.) provided by a server of the third party authority (e.g., the second server 110). It will be appreciated that since services are typically provided by a financial institution, the user 120 needs to contract with the financial institution to effect authorization of the service to be authorized. Herein, "business" may refer to various financial services that a financial institution can provide, including but not limited to, a consumption service such as ETC, an investment service such as a financing product and an online deposit, and a loan service of various loans, etc.; an "authorization" for a business may be a user granting permission to a financial institution to perform business-related operations (e.g., drawing ETC fees from the user's bank account), or a financial institution granting permission to the user to obtain business-related rights (e.g., obtaining financial services provided by a bank via a third party), which typically requires contract signing by both the user and the financial institution to complete such authorization. Thus, authorization of a transaction to be authorized typically requires processing by a server of the financial institution (e.g., first server 105). The user terminal 115 may be configured to interact with the second server 110 to submit thereto a request for a service to be authorized indicating the user's intention, and to receive a first text such as a contract document returned from the second server 110. The user terminal 115 may also be configured to receive a message (e.g., an authentication message) from the first server 105. The user terminal 115 may also be configured to receive information to be authenticated (e.g., a set of authentication codes) input by the user 120 and transmit it to the second server in response to the message.
The second server 110 may be implemented, for example, at a computing device, which may be a network server of a third party organization. In this context, the third party institution may be a platform that exposes services that can be provided by the financial institution, but the third party institution does not actually provide these services. The second server 110 is configured to enable interaction with the user terminal 115 and to forward (e.g., with or without processing) data from the user terminal and the first server to the opposite party. The second server 110 may be configured to receive a request (e.g., a second request indicating a service to be authorized intended by the user 120) from a user terminal, which may include user information (e.g., first identification information of the user) that may uniquely identify the user 120, including but not limited to contact information of the user, credential information of the user, bank account information of the user, and the like. The second server 110 may also be configured to generate a first request to send to the first server 105 for processing based on the second request. The second server may be further configured to receive a first response including the first text from the first server 105 and to cause the user terminal to present the first text. The second server 110 may be further configured to receive the information to be authenticated input by the user and generate an authentication confirmation message (e.g., including the information to be authenticated and the unique identifier associated with the first request) therefrom for transmission to the first server.
The first server 105 may be implemented, for example, at a computing device, which may be a verification server of a financial institution. The first server is configured to manage authorization of the service to be authorized that the user(s) intend to obtain. The first server 105 may be configured to receive a request (e.g., a first request for a service to be authorized) from the second server 110 of the third-party organization and generate a response to return to the second server 110. For example, the response may be a first response including first text, which may be a contract to be contracted for the service, which may be in a format such as a PDF or WORD document. The contract may be generated according to a contract template based on user information provided by the user and additionally or alternatively a unique identifier corresponding to the request. The first text may include first authentication information, and the first authentication information may be presented at a predetermined position of the first text, for example, may be presented at a footer or a header of the PDF document, or a last page of the PDF document. The first server 105 may also be configured to send a message (e.g., an authentication message) to the user terminal 115. In some embodiments, the first text may also take the form of a link through which the user 120 may access the aforementioned PDF or WORD documents maintained at the first server to further avoid interception of sensitive information about the user (e.g., credential information included in these documents, etc.) by malicious parties that may be present at the server of the third party organization.
In some embodiments, an association between the user and his contact information, credential information, and bank account information may be maintained at first server 105. In some embodiments, the first server 105 may also generate a unique identifier to identify the request (e.g., based on user information included in the request).
The first server 105 may be configured to determine the second authentication information from the first authentication information. For example, when the first authentication information is a plurality of sets (e.g., 8 sets) of random characters, the first server 105 may randomly select a set (e.g., 3 rd set) of random characters therefrom as the second authentication information. The first server 105 may be further configured to generate, based on the second authentication information, an authentication message indicating association information about the first authentication information to send to the user terminal 115 (e.g., via a mobile phone number corresponding to the user information of the user 120, etc.). For example, if the 3 rd group random character is the second authentication information, the authentication message may be "you are going to transact business at organization a, please enter the 3 rd group random character in the multiple groups of random characters at the contract C location into the authentication box".
By way of non-limiting example, the computing device may be any device having computing capabilities. The computing device may be any type of mobile, stationary, or portable computing device, including but not limited to a mobile phone, desktop computer, laptop computer, notebook computer, netbook computer, tablet computer, multimedia computer, and the like. In some embodiments, all or a portion of the components of such a device may be distributed in the cloud.
It is to be understood that although only one user terminal 115, first server 105, and second server 110 are shown in fig. 1, respectively, the number may be any number. For example, the user 120 may interact with the second server 110 through one of the user terminals 115 (e.g., via APP on a mobile phone, a Web page provided by a Web browser, or an applet) and receive a verification message (e.g., a push message in short message, phone, official public number, etc.) from the first server through the user terminal. The user 120 may interact with the second server 110 through a user terminal (e.g., a Web page provided via software on a laptop or a Web browser) and receive a verification message (e.g., a push message in short message, telephone, official public number, etc.) from the first server through another user terminal (e.g., a mobile phone).
It is to be understood that, although the first authentication information is described herein with a plurality of sets of random characters, and one set of random characters is the second authentication information, the first authentication information and the second authentication information may take other various forms as long as it can be verified that the operation related to the service authorization is performed by the user himself.
For example, the first verification information may also be a plurality of groups of pictures, each group of pictures being an equation, in which case the second verification information may be a result based on one or more equations corresponding to one or more of the pictures, and the verification message may accordingly prompt the user to input one or more results of the equations.
For another example, the first authentication information may also be a plurality of answers (e.g., the home palace, the valsarong, the winter palace, the summer palace, etc.), in which case the second authentication information may be one or more answers (e.g., the winter palace) thereof, and the authentication message may prompt the user to input the one or more answers. For example, in this case, the verification message may be "you are going to transact business B at organization a, please enter the russian answer at the contract C location into the verification box".
It should be understood that the architecture and functionality in environment 100 is described for exemplary purposes only and is not meant to imply any limitation on the scope of the disclosure. Embodiments of the present disclosure may also be applied to environments involving service authorization having different structures and/or functions.
A method according to an embodiment of the present disclosure will be described in detail below with reference to fig. 2 to 5. For ease of understanding, specific data mentioned in the following description are exemplary and are not intended to limit the scope of the present disclosure. For ease of description, a method according to an embodiment of the present disclosure is described below in conjunction with the exemplary environment 100 shown in FIG. 1. Methods according to embodiments of the present disclosure may be implemented in the first server 105, the second service 110, and the user terminal 115 shown in fig. 1, respectively, or other suitable devices. It is to be understood that methods in accordance with embodiments of the present disclosure may also include additional acts not shown and/or may omit acts shown, as the scope of the present disclosure is not limited in this respect.
Fig. 2 schematically shows a flow diagram of an interactive method 200 of service authorization according to an embodiment of the present disclosure.
The user terminal 115 may receive (step 202) the user 120 information entered by the user 120, as well as the intended service to be authorized. In response to receiving the above information from the user 120, the user terminal 115 may send (step 204) to the second server 110 a request (sometimes also referred to as a second request) indicating the intended service to be authorized by the user 120, which request may include first identification information of the user 120, the first identification information including at least one of: contact information of the user 120, credential information of the user 120, and bank account information of the user 120.
The second server 110 may receive the second request. In response to receiving the request from the user terminal 115, the second server 110 may send (step 206) a request (sometimes also referred to as a first request) for the service to be authorized to the first server 105, which may also include the first identification information of the user 120.
The first server 105 may receive the first request. In response to the first request for the service to be authorized from the second server 110, the first server 105 may generate (step 208) a first text and first authentication information, wherein the first text includes the first authentication information, the first text being associated with the service to be authorized. As discussed above, in some embodiments, the first text may take the form of a format such as a PDF or WORD document, and in other embodiments, the first text may also take the form of a link. In some embodiments, the first text may be a contract to be entered by the user 120 in relation to the service to be authorized, and the first authentication information may be presented at a predetermined location of the contract. In some embodiments, the first server 105 may generate multiple sets of random characters as the first authentication information. In some embodiments, the first server 105 may generate a unique identifier associated with the first request to uniquely indicate the first request.
The first server 105 may send (step 210) a first response including the first text to the second server 110. In some embodiments, the first server 105 may send a first response to the second server 110 that includes the first text and the unique identifier.
The second server 110 may receive the first response and may cause (step 212) the user terminal 115 to present the first text to the user 120. For example, the second server 110 may send the first text to the user terminal 115 for presentation. The second server 110 may also convert the first text into other formats (including but not limited to audio files) that can be processed by the user terminal 115 for presentation to the user 120.
The first server 105 may determine (step 214) second authentication information based on the first authentication information. In the case where the first authentication information is a plurality of sets of random characters, the second authentication information may be at least one set of random characters therein.
The first server 105 may then send (step 216) an authentication message to the user terminal 115. The authentication message indicates association information about the first authentication information for prompting the user 120 to send information to be authenticated to the second server 110 to generate an authentication confirmation message. The user terminal 115 may receive the authentication message.
Additionally or alternatively, the first server 105 may determine a target communication channel (e.g., a short message channel, a micro message channel, etc.) based on the first identification information (e.g., a mobile phone number or a micro message account, etc. input by the user 120, or determine a corresponding mobile phone number or a micro message account, etc. of the user 120 by querying credential information and/or bank account information of the user 120). The first server 105 may then send a verification message to the user terminal 115 over the target communication channel based on the first identification information.
In the case where the first authentication information is a plurality of sets of random characters, the association information is association information about at least one set of random characters and the first authentication information (i.e., the plurality of sets of random characters). For example, the association information may include a position of the at least one set of random characters in the plurality of sets of random character strings.
It is to be understood that the order of steps 208 through 216 is not limited to the order of the numbers in fig. 2. In some embodiments, steps 208 and 214 may be performed in parallel, and steps 210 and 216 may be performed in parallel. In other embodiments, step 210 may also be performed after step 216.
In response to receiving the first text (specifically, the first authentication information trained in relation to the first text) and the authentication message, the user 120 may determine the information to be authenticated to be input and input the information to be authenticated via the user terminal 115.
The user terminal 115 may receive (step 218) the information to be authenticated entered by the user 120 based on the authentication message, and the first text, and may accordingly send (step 220) the information to be authenticated to the second server 110, which the second server 110 may receive from the user terminal 115, and may accordingly generate (step 222) an authentication confirmation message comprising, for example, the information to be authenticated and the unique identifier. The second server 110 may send (step 224) the authentication confirmation message to the first server 105.
The first server 105 may receive the authentication confirmation message including at least the information to be authenticated and may determine (step 226) whether to have the service to be authorized with respect to the user 120 authorized accordingly. If it is determined that the authentication confirmation message matches the second authentication information, the first server 105 may cause the service to be authorized with respect to the user 120 to be authorized. Conversely, the first server 105 may determine that the service to be authorized with respect to the user 120 is not to be authorized for a while, and may perform at least some of steps 208 to 226 again (which will be discussed in detail below) to re-verify whether it is the user 120 himself/herself intended to enter into a contract for the service to be authorized, and re-determine whether the service to be authorized with respect to the user 120 is to be authorized.
According to an embodiment of the present disclosure, based on interactions between the three parties, the financial institution's server may determine whether the user 120 personally intends to handle the service to be authorized, and sign up directly with the user 120 (e.g., via a third party platform) to enable the service to be authorized, while not exposing sensitive information related to, for example, fund security to the third party platform. In this way, the authorization of the service to be authorized in a three-party scene can be safely and effectively realized.
Fig. 3 schematically shows a flow chart of a service authorization method 300 according to an embodiment of the present disclosure. For example, the method 300 may be implemented at the first server 105105 as shown in fig. 1.
In step 302, in response to a first request for a service to be authorized from the second server 110, the first server 105 generates a first text and first authentication information, the first text including the first authentication information, the first text being associated with the service to be authorized.
At step 304, the first server 105 sends a first response comprising the first text to the second server 110 to enable the second server 110 to present the first text via the user terminal 115.
At step 306, the first server 105 determines second authentication information based on the first authentication information.
In step 308, the first server 105 sends an authentication message to the user terminal 115, the authentication message indicating association information about the first authentication information for prompting the user 120 to send information to be authenticated to the second server 110 to generate an authentication confirmation message.
At step 310, the first server 105 determines whether the authentication confirmation message matches the second authentication information.
If the authentication confirmation message received from the second server 110 matches the second authentication information, the first server 105 causes the service to be authorized with respect to the user 120 to be authorized in step 312. Otherwise, the first server 105 may re-determine whether to have the service to be authorized with respect to the user 120 authorized, for example, by re-performing steps 302 to 310. In some embodiments, the first server 105 may generate the first text by the following steps. The first server 105 may generate, in response to the first request, a unique identifier indicating the first request and generate a plurality of sets of random characters as the first authentication information. In some embodiments, the first server 105 may associate at least one random character of the plurality of sets of random characters with the unique identifier, the at least one random character being the second authentication information.
In some embodiments, the first server 105 may generate a first response including the first text and the unique identifier, and may send the first response including the first text and the unique identifier to the second server 110.
In some embodiments, the association information is association information between the at least one group of random characters and the first authentication information.
In some embodiments, the first request comprises first identification information about the user 120 of the service to be authorized, the first identification information comprising at least one of: contact information of the user 120, credential information of the user 120, and bank account information of the user 120.
In some embodiments, the first server 105 may determine a target communication channel based on the first identification information, and may send a verification message indicating the association information to the user terminal 115 through the target communication channel based on the first identification information.
In some embodiments, the first server 105 may receive a verification confirmation message from the second server 110, the verification confirmation message including the information to be verified, and the unique identifier. The first server 105 may then determine that the information to be authenticated matches at least one set of random characters associated with the unique identifier. The first server 105 may cause the service to be authorized with respect to the user 120 to be authorized if it is determined that the information to be authenticated matches at least one set of random characters associated with the unique identifier.
In some cases, for example, when the user 120 is in the account of the second server 110 and is operated by a possible malicious party, if one authentication fails, the malicious party may obtain authorization for the service to be authorized through a limited number of repeated attempts, and thus cause potential damage to the user 120. In some embodiments, if the first server 105 determines that the information to be authenticated does not match at least one set of random characters associated with the unique identifier (e.g., step 310: no), the first server 105 may perform the following: generating a further unique identifier; generating a plurality of additional sets of random characters as first authentication information for the first text; associating at least one further random character of the plurality of further sets of random characters with a further unique identifier, wherein the at least one further set of random characters is second authentication information; sending a first response comprising the first text and the further unique identifier to the second server 110; and sending a verification message to the user terminal 115, the verification message indicating information about the association between the at least one further set of random characters and the first verification information.
In this way, the first server 105 may regenerate the first authentication information (e.g., multiple sets of random characters) and the second authentication information (e.g., at least one set of random characters) for authentication after one authentication failure, and prompt the user 120 to re-input the information to be authenticated related to the new second authentication information via the second server 110 and the user terminal 115, respectively. Thus, a potentially malicious party can be prevented from obtaining authorization for the service (which is not allowed by the user 120) by repeating attempts several times.
In other embodiments, if the first server 105 determines that the information to be authenticated does not match the at least one set of random characters associated with the unique identifier (e.g., step 310: no), the first server 105 may perform the following: associating at least one other set of random characters in the plurality of sets of random characters with the unique identifier, the at least one other set of random characters being second authentication information; and transmitting a verification message to the user terminal 115, the verification message indicating association information between the at least one other set of random characters and the first verification information.
In this way, the first server 105 may regenerate only the second authentication information for authentication (e.g., randomly picking another set of random characters from among the sets of random characters) after one authentication failure, and prompt the user 120 via the user terminal 115 to re-input the information to be authenticated related to the new second authentication information. Thus, a potentially malicious party can be prevented in a more efficient way from obtaining authorization for the service (which is not allowed by the user 120) by multiple repeated attempts.
In some embodiments, if the authentication is not successful for a predetermined number of consecutive times (e.g., 3 times), first server 105 may suspend authentication of the to-be-authorized service related to user 120, for example, for a period of time (e.g., a day), or, for example, forward to a human for further authentication.
Fig. 4 schematically shows a flow chart of a service authorization method 400 according to an embodiment of the present disclosure. For example, the method 400 may be implemented at the second server 110 as shown in fig. 1.
In step 402, the second server 110 sends a first request for the service to be authorized to the first server 105.
At step 404, the second server 110 receives a first response from the first server 105 comprising a first text comprising the first authentication information, the first text being associated with the service to be authorized.
In some embodiments, the second server 110 may receive a first response from the first server 105 that includes the first text and a unique identifier indicating the first request.
The second server 110 causes the user terminal 115 to present the first text to the user 120 at step 406.
In step 408, the second server 110 receives information to be authenticated from the user terminal 115, wherein the information to be authenticated is sent by the user terminal 115 in response to receiving the authentication message sent by the first server 105, and wherein the authentication message indicates association information regarding the first authentication information.
At step 410, the second server 110 sends a validation confirmation message including the to-be-validated information to the first server 105, such that the first server 105 causes the service to be authorized with respect to the user 120 to be authorized based on a match between the validation confirmation message and second validation information at the first server 105, wherein the second validation information is determined by the first server 105 based on the first validation information.
In some embodiments, the validation confirmation message may be generated by the second server 110 by: receiving information to be authenticated input by the user 120 in response to the authentication message from the user terminal 115; and generating a verification confirmation message comprising the information to be verified and the unique identifier.
In some embodiments, if the first server 105 determines that the information to be authenticated does not match the at least one set of random characters associated with the unique identifier, the second server 110 may re-receive the updated first text (in particular, the updated first authentication information, e.g., the sets of additional random characters) from the first server 105 to enable the user terminal 115 to present the updated first text to the user 120.
Fig. 5 schematically shows a flow chart of a service authorization method 500 according to an embodiment of the present disclosure. For example, the method 500 may be implemented at the user terminal 115 as shown in fig. 1.
In step 502, the user terminal 115 sends a second request to the second server 110 indicating the intended to-be-authorized service for the user 120.
In step 504, the user terminal 115 receives a first text from the second server 110 for presentation to the user 120, the first text comprising the first authentication information, the first text being associated with the service to be authorized.
In some embodiments, the user terminal 115 may receive a first text including a plurality of sets of random characters as the first authentication information.
In step 506, the user terminal 115 receives an authentication message from the first server 105, the authentication message indicating association information about the first authentication information for prompting the user 120 to send information to be authenticated to the second server 110.
In some embodiments, the association information relates to association information between at least one of the plurality of groups of random characters and the first authentication information, the plurality of groups of random characters being the first authentication information, and the at least one group of random characters being the second authentication information.
In step 508, the user terminal 115 receives the information to be authenticated input by the user 120 based on the authentication message, and the first text.
In step 510, the user terminal 115 transmits the to-be-authenticated information to the second server 110, so that the second server 110 generates an authentication confirmation message for enabling the to-be-authorized service with respect to the user 120 based on the to-be-authenticated information, the authentication confirmation message being used by the first server 105 to confirm the matching with the second authentication information.
In some embodiments, if the first server 105 determines that the information to be authenticated does not match the at least one set of random characters associated with the unique identifier, the user terminal 115 may re-receive the updated authentication message from the first server 105 (e.g., to indicate entry of at least one other set of random characters of the plurality of sets of random characters, or entry of at least one other set of random characters of the plurality of other sets of random characters) to enable the user terminal 115 to receive the updated information to be authenticated entered by the user 120.
FIG. 6 illustrates a schematic block diagram of an example computing device 600 that can be used to implement embodiments of the present disclosure. For example, computing device 600 may be used to implement any of user terminal 105, first server 115, and second server 110 shown in fig. 1. As shown, computing device 600 includes a Central Processing Unit (CPU)601 that can perform various appropriate actions and processes in accordance with computer program instructions stored in a Read Only Memory (ROM)602 or loaded from a storage unit 608 into a Random Access Memory (RAM) 603. In the RAM, various programs and data required for the operation of the computing device 600 may also be stored. The CPU, ROM, and RAM are connected to each other through a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.
A number of components in computing device 600 connect to I/O interface 605, including: an input unit 606 such as a keyboard, a mouse, or the like; an output unit 607 such as various types of displays, speakers, and the like; a storage unit 608, such as a magnetic disk, optical disk, or the like; and a communication unit 609 such as a network card, modem, wireless communication transceiver, etc. The communication unit 609 allows the computing device 600 to exchange information/data with other devices through a computer network such as the internet and/or various telecommunication networks.
The central processing unit 601 performs the various methods and processes described above, such as any of the methods 200 to 400. For example, in some embodiments, any of the methods 200-400 may be implemented as a computer software program or computer program object tangibly embodied in a machine-readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program may be loaded and/or installed onto computing device 600 via ROM and/or communications unit 609. When loaded into RAM and executed by a CPU, a computer program may perform one or more steps of any of the methods 200 to 400 described above. Alternatively, in other embodiments, the CPU may be configured to perform any of the above methods by any other suitable means (e.g., by means of firmware).
The present disclosure may be methods, apparatus, systems, and/or computer program objects. The computer program object may include a computer-readable storage medium having computer-readable program instructions embodied thereon for carrying out various aspects of the present disclosure.
The computer readable storage medium may be a tangible device that can hold and store the instructions for use by the instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic memory device, a magnetic memory device, an optical memory device, an electromagnetic memory device, a semiconductor memory device, any non-transitory memory device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a Static Random Access Memory (SRAM), a portable compact disc read-only memory (CD-ROM), a Digital Versatile Disc (DVD), a memory stick, a floppy disk, a mechanical coding device, such as punch cards or in-groove projection structures having instructions stored thereon, and any suitable combination of the foregoing. Computer-readable storage media as used herein is not to be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., optical pulses through a fiber optic cable), or electrical signals transmitted through electrical wires.
The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a respective computing/processing device, or to an external computer or external storage device via a network, such as the internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. The network adapter card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing/processing device.
The computer program instructions for carrying out operations of the present disclosure may be assembler instructions, Instruction Set Architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, the electronic circuitry that can execute the computer-readable program instructions implements aspects of the present disclosure by utilizing the state information of the computer-readable program instructions to personalize the electronic circuitry, such as a programmable logic circuit, a Field Programmable Gate Array (FPGA), or a Programmable Logic Array (PLA).
Various aspects of the present disclosure are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program objects according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer-readable program instructions.
These computer-readable program instructions may be provided to a processing unit of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer-readable medium storing the instructions comprises an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus or other devices implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program objects according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
Having described embodiments of the present disclosure, the foregoing description is intended to be exemplary, not exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen in order to best explain the principles of the embodiments, the practical application, or improvements made to the technology in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims (18)

1. A service authorization method comprises the following steps:
generating, at a first server, a first text and first authentication information in response to a first request for a service to be authorized from a second server, the first text including the first authentication information, the first text being associated with the service to be authorized;
sending a first response including the first text to the second server to enable the second server to present the first text via a user terminal;
determining second authentication information based on the first authentication information;
sending a verification message to a user terminal, wherein the verification message indicates the association information about the first verification information, so as to prompt the user to send information to be verified to the second server to generate a verification confirmation message; and
if the authentication confirmation message received from the second server matches the second authentication information, the service to be authorized is authorized with respect to the user.
2. The method of claim 1, wherein generating the first text comprises:
generating, in response to the first request, a unique identifier indicative of the first request; and
generating a plurality of groups of random characters as the first authentication information; and is
The method further comprises the following steps:
associating at least one random character of the plurality of sets of random characters with the unique identifier, the at least one random character being the second authentication information.
3. The method of claim 2, wherein sending the first response including the first text to the second server:
generating the first response comprising the first text and the unique identifier; and
sending the first response including the first text and the unique identifier to the second server.
4. The method of claim 2, wherein the association information is about an association between the at least one set of random characters and the first authentication information.
5. The method of claim 4, the first request comprising first identification information regarding the user of the service to be authorized, the first identification information comprising at least one of: the contact information of the user, the certificate information of the user and the bank account information of the user.
6. The method of claim 5, wherein sending the verification message to the user terminal comprises:
determining a target communication channel based on the first identification information; and
and sending the verification message indicating the association information to the user terminal through the target communication channel based on the first identification information.
7. The method of claim 2, wherein determining to authorize the service to be authorized to the user comprises:
receiving the authentication confirmation message from the second server, the authentication confirmation message including the information to be authenticated and the unique identifier; and
determining to authorize the service to be authorized to the user if it is determined that the information to be authenticated matches the at least one set of random characters associated with the unique identifier.
8. The method of claim 7, further comprising:
if it is determined that the information to be verified does not match the at least one set of random characters associated with the unique identifier, performing the following:
generating a further unique identifier;
generating a plurality of additional sets of random characters as the first authentication information for the first text;
associating at least one further random character of the plurality of further sets of random characters with the further unique identifier, the at least one further set of random characters being the second authentication information;
sending the first response comprising the first text and the further unique identifier to the second server; and
sending the authentication message to the user terminal, the authentication message indicating information about an association between the at least one further set of random characters and the first authentication information.
9. The method of claim 7, further comprising:
if it is determined that the information to be verified does not match the at least one set of random characters associated with the unique identifier, performing the following:
associating at least one other set of random characters of the plurality of sets of random characters with the unique identifier, the at least one other set of random characters being the second authentication information; and
sending the authentication message to the user terminal, the authentication information indicating association information between the at least one group of other random characters and the first authentication information.
10. A service authorization method comprises the following steps:
at a second server, sending a first request for the service to be authorized to a first server;
receiving a first response comprising a first text from the first server, wherein the first text comprises first verification information, and the first text is associated with the service to be authorized;
enabling a user terminal to display the first text to the user;
receiving information to be authenticated from a user terminal, wherein the information to be authenticated is sent by the user terminal in response to receiving an authentication message sent by a first server, and wherein the authentication message indicates association information regarding the first authentication information;
sending the authentication confirmation message including the to-be-authenticated information to the first server to cause the to-be-authorized service with respect to the user to be authorized based on a match between the authentication confirmation message and second authentication information at the first server, wherein the second authentication information is determined by the first server based on the first authentication information.
11. The method of claim 10, wherein receiving the first response comprises:
receiving the first response from the first server that includes the first text and a unique identifier indicating the first request.
12. The method of claim 11, wherein the validation confirmation message is generated by:
receiving, from the user terminal, information to be authenticated input by the user in response to the authentication message; and
generating the authentication confirmation message including the information to be authenticated and the unique identifier.
13. A service authorization method comprises the following steps:
at the user terminal, sending a second request indicating a service to be authorized intended by the user to a second server;
receiving a first text from the second server for presentation to the user, the first text comprising first authentication information, the first text being associated with the service to be authorized;
receiving a verification message from a first server, the verification message indicating associated information about the first verification information for prompting the user to send information to be verified to the second server;
receiving the information to be authenticated input by the user based on the authentication message and the first text; and
sending the information to be authenticated to the second server, so that the second server generates an authentication confirmation message for enabling the service to be authorized with respect to the user based on the information to be authenticated, the authentication confirmation message being used by the first server to confirm matching with second authentication information.
14. The method of claim 13, wherein receiving the first text comprises:
receiving the first text including a plurality of groups of random characters as the first authentication information.
15. The method according to claim 14, wherein the association information is information on association between at least one random character of a plurality of groups of random characters and the first authentication information, the plurality of groups of random characters being the first authentication information, the at least one group of random characters being the second authentication information.
16. The method of any of claims 1 to 14, wherein the first server is an authentication server of a financial institution and the second server is a web server of a third party institution.
17. A computing device, comprising:
at least one processing unit; and
at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions when executed by the at least one processing unit causing the computing device to perform the method of any of claims 1-16.
18. A computer readable storage medium having stored thereon computer program code which, when executed, causes a machine to perform the method of any of claims 1 to 16.
CN202110057097.XA 2021-01-15 2021-01-15 Business authorization method, computing device and medium Pending CN112862590A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110057097.XA CN112862590A (en) 2021-01-15 2021-01-15 Business authorization method, computing device and medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110057097.XA CN112862590A (en) 2021-01-15 2021-01-15 Business authorization method, computing device and medium

Publications (1)

Publication Number Publication Date
CN112862590A true CN112862590A (en) 2021-05-28

Family

ID=76005808

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110057097.XA Pending CN112862590A (en) 2021-01-15 2021-01-15 Business authorization method, computing device and medium

Country Status (1)

Country Link
CN (1) CN112862590A (en)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120117639A1 (en) * 2010-11-09 2012-05-10 International Business Machines Corporation Remote authentication based on challenge-response using digital certificates
CN104113549A (en) * 2014-07-28 2014-10-22 百度在线网络技术(北京)有限公司 Platform authorization method, platform server side, application client side and system
US20170278094A1 (en) * 2014-12-16 2017-09-28 Visa Europe Limited Transaction authorisation
CN109190352A (en) * 2018-07-03 2019-01-11 阿里巴巴集团控股有限公司 A kind of authorization text Accuracy Verification method and apparatus
CN110555300A (en) * 2019-09-06 2019-12-10 北京字节跳动网络技术有限公司 application program authorization method, client, server, terminal device and medium
CN112202772A (en) * 2020-09-29 2021-01-08 北京海泰方圆科技股份有限公司 Authorization management method and device

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120117639A1 (en) * 2010-11-09 2012-05-10 International Business Machines Corporation Remote authentication based on challenge-response using digital certificates
CN104113549A (en) * 2014-07-28 2014-10-22 百度在线网络技术(北京)有限公司 Platform authorization method, platform server side, application client side and system
US20170278094A1 (en) * 2014-12-16 2017-09-28 Visa Europe Limited Transaction authorisation
CN109190352A (en) * 2018-07-03 2019-01-11 阿里巴巴集团控股有限公司 A kind of authorization text Accuracy Verification method and apparatus
CN110555300A (en) * 2019-09-06 2019-12-10 北京字节跳动网络技术有限公司 application program authorization method, client, server, terminal device and medium
CN112202772A (en) * 2020-09-29 2021-01-08 北京海泰方圆科技股份有限公司 Authorization management method and device

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
王维建等: "面向分散控制系统的安全接入认证方法研究", 信息安全与通信保密, no. 05, 31 December 2016 (2016-12-31), pages 104 - 106 *

Similar Documents

Publication Publication Date Title
KR101883156B1 (en) System and method for authentication, user terminal, authentication server and service server for executing the same
CN108551437B (en) Method and apparatus for authenticating information
CN110555299B (en) Electronic contract signing and storing method and device, computer equipment and storage medium
US9407632B2 (en) Transformation rules for one-time passwords
CN107249004B (en) Identity authentication method, device and client
US11388194B2 (en) Identity verification and verifying device
US20140052575A1 (en) METHOD FOR AUTOMATICALLY GENERATING ELECTRONIC CONTRACT WITH VARIABLE TERMS IN B-to-C E-COMMERCE TRADE
TW202036402A (en) Service processing method and device
CN112039826A (en) Login method and device applied to applet terminal
KR20200002501A (en) Method for certificating node of public blockchain, apparatus and system for executing the method
CN111949958A (en) Authorization authentication method and device in Oauth protocol
CN110719252B (en) Method, system and medium for authorizing transactions over a communication channel
CN114519206A (en) Method for anonymously signing electronic contract and signature system
CN113228075A (en) Computer-implemented system and method for controlling or enforcing transfers made on a blockchain
CN115996140A (en) Access content acquisition method, device, equipment and storage medium
CN112862590A (en) Business authorization method, computing device and medium
CN114186994A (en) Method, terminal and system for using digital currency wallet application
CN114037446A (en) Transaction method, transaction management method, device and system for digital currency
CN109257177B (en) Key generation method, system, mobile terminal, server and storage medium
CN113890738A (en) Electronic signature method and device
CN114679317A (en) Data viewing method and device
CN111127006A (en) Transaction processing method and system based on block chain
KR101879842B1 (en) User authentication method and system using one time password
CN112069231B (en) User information processing method and device, storage medium and electronic equipment
CN114301662B (en) Method, device, equipment and medium for requesting producer network function service

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination