CN102638473A - User data authorization method, device and system - Google Patents
User data authorization method, device and system Download PDFInfo
- Publication number
- CN102638473A CN102638473A CN201210137848XA CN201210137848A CN102638473A CN 102638473 A CN102638473 A CN 102638473A CN 201210137848X A CN201210137848X A CN 201210137848XA CN 201210137848 A CN201210137848 A CN 201210137848A CN 102638473 A CN102638473 A CN 102638473A
- Authority
- CN
- China
- Prior art keywords
- account
- sub
- server
- authorization
- user
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a user data authorization method, a user data authorization device and a user data authorization system. The method comprises the steps that an authorization server receives an authorization request transmitted by a third-party application server, wherein the authorization request comprises a server identifier and a server address; an identity authentication request is transmitted to an authentication gateway to authenticate the identity of a client user by the authentication gateway; an identity authentication response which is fed back by the authentication gateway is received, wherein the identity authentication response comprises an user identifier of the authenticated user; user sub-accounts which are matched with the user identifier are searched from the authorization server and are transmitted to a client for the client user to select an authorized sub-account; the authorized sub-account which is fed back by the client is received, and a corresponding relationship among the server identifier, the user identifier and the authorized sub-account is built and saved; and the user identifier, the authorized sub-account and an access token are transmitted to the third-party application server by using the server address. The third-party partial use authorization by the user is realized, the network service quality is improved and the service experience of the user is improved.
Description
Technical field
The present invention relates to the web services technologies field, relate in particular to a kind of user data authorization method, Apparatus and system.
Background technology
Current, the network service comprehensively has been applied in people's the routine work and life.When using the network service, the user data that the Internet Service Provider preserves according to its inside is for the user provides corresponding service.
With the online game is example; When this network service of user's enjoy network recreation; The user data that relates to possibly comprise: a plurality of game roles that user basic information (for example address name, age of user, ownership place etc.), user gradation, this user create, the distinctive information of each game role (for example the game article of role's grade, configuration, and other user roles between relation) etc.; Internet Service Provider's game server just can be according to the above-mentioned user data of its inside preservation, for the user provides game services.
Along with the continuous development of information technology, for the maximum value of excavating the data of Internet Service Provider's preservation, each macroreticular service provider releases open platform one after another, and the data opening of itself storing is gone out, and confession third party developer uses.Yet; Because include the higher user data of security requirement in the data that the Internet Service Provider opens away, therefore, when the third party need visit this part user data; To obtain user's use authority on the one hand; Also to have only and satisfy this two aspects requirement simultaneously the user data that third party's ability access network services provider preserves on the other hand through Internet Service Provider's authentication.
To obtain this requirement of use authority of user for the third party; Be that unit accomplishes with user by the authorization method of extensive employing at present; That is to say; User or the third party carried out use authority, or the third party is not carried out use authority, can not realize that the user is to third-party part use authority.Yet, generally speaking, tend to include a plurality of sub-numbers of the account under user's the number of the account, if only wanting the parton number of the account corresponding user data that it is had, the user carries out use authority to the third party, existing technical scheme just can't satisfy this demand.
It still is example with the online game; A plurality of game roles in the user data just are equivalent to a plurality of sub-number of the account under the user account; If the user only wants to the mandate of third party's application server one of them or several game role, when the scheme that adopts prior art is carried out use authority, as long as the user carries out use authority to third party's application server; What third party's application server obtained so is exactly the use authority of all game roles of user's establishment; This authorization obvious and user is contrary, can not satisfy user's demand, has reduced the service experience of user to online game.
Summary of the invention
Technical problem to be solved by this invention is a kind of user data authorization method, Apparatus and system to be provided, to realize the purpose of user to the part use authority of third party's application server.
For solving the problems of the technologies described above, the embodiment of the invention provides a kind of user data authorization method, comprising:
Authorization server receives the authorization requests that third party's application server sends, and said authorization requests comprises server identification and server address;
Send ID authentication request to authentication gateway, so that said authentication gateway carries out authentication to the client user;
Receive the authentication response that said authentication gateway returns, said authentication response comprises the ID of authentication through the user;
In authorization server, search the sub-number of the account of the user who is complementary with said ID, and be sent to client, supply the client user to select to authorize sub-number of the account;
Receive the sub-number of the account of mandate that client is returned, set up and preserve the corresponding relation between the sub-number of the account of said server identification, ID and mandate;
Utilize said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
Preferably, said authentication gateway carries out authentication to the client user, specifically comprises:
Obtain client user's logging status, if, judge that then the user passes through the user for authentication for successfully login; If not successfully login then points out the user to carry out the username and password checking, and after the username and password checking is passed through, judges that the user passes through the user for authentication;
Convert the user name of said authentication through the user into ID, and said ID added in the authentication response be sent to authorization server.
Preferably, said method also comprises: after the sub-number of the account of mandate that said reception client is returned,
The user data that the sub-number of the account of said mandate is comprised is sent to client, supplies the client user to select the authorized user data; Then,
Said foundation is also preserved said corresponding relation and is specifically comprised: after receiving the authorized user data that said client returns, set up and preserve the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data;
Saidly utilize said server address to be specially: ID, to authorize sub-number of the account, authorized user data and access token to the information that said third party's application server sends.
Preferably, said method also comprises: before said foundation and preserving the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data,
Judge whether the sub-number of the account of said mandate is contained in the sub-number of the account of said user, and judge whether said authorized user data are contained in said user data, if judged result is are, then continue to carry out the step of setting up and preserving said corresponding relation.
Preferably, said utilize said server address with said ID, authorize sub-number of the account and access token to be sent to said third party's application server, specifically comprise:
Generate authorization code, and utilize said server address that said ID, the sub-number of the account of mandate and authorization code are sent to said third party's application server;
Receive server identification and authorization code that said third party's application server sends; If said server identification conforms to server identification in the said authorization requests; And said authorization code conforms to the authorization code of said generation, then said access token is sent to said third party's application server.
Preferably, said method also comprises:
Receive the access request of said third party's application server transmission of open platform gateway forwards; Said access request comprises server identification, access token, ID, four information of sub-number of the account, and the digital signature of said four information and the endorsement method that generates said digital signature employing;
Said access request is carried out the legitimacy authentication, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication comprises:
Utilize said endorsement method that said four information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID and sub-number of the account in the said access request satisfies the corresponding relation between the sub-number of the account of said authorization server, ID and mandate that said authorization server preserves; If satisfy, judge that then authorization server, ID and the sub-number of the account in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
Preferably, said method also comprises:
Said access request also comprises user data, then,
Digital signature in the said access request is specially the digital signature of utilizing server identification, access token, ID, sub-number of the account and five information of user data to generate;
Said legitimacy authentication specifically comprises:
Utilize said endorsement method that said five information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID, sub-number of the account and user data in the said access request satisfy the sub-number of the account of said authorization server, ID, mandate of said authorization server preservation and the corresponding relation between the authorized user data; If satisfy, judge that then authorization server, ID, sub-number of the account and the user data in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
Preferably, said method also comprises:
Said access request also comprises the current time stamp; Then,
Said legitimacy authentication also comprises:
Judge that whether said current time stab in preset time of delay section, if judge that then said current time stamp is legal.
The embodiment of the invention also provides a kind of user data authorization device, comprising:
The authorization requests receiving element is used to receive the authorization requests that third party's application server sends, and said authorization requests comprises server identification and server address;
The authentication request transmitting element is used for sending ID authentication request to authentication gateway, so that said authentication gateway carries out authentication to the client user;
The authentication response receiving element is used to receive the authentication response that said authentication gateway returns, and said authentication response comprises the ID of authentication through the user;
Search the unit, be used in authorization server, searching the sub-number of the account of the user who is complementary with said ID, and be sent to client, supply the client user to select to authorize sub-number of the account;
Corresponding relation is set up the unit, is used to receive the sub-number of the account of mandate that client is returned, and sets up and preserve the corresponding relation between the sub-number of the account of said server identification, ID and mandate;
The authorization message transmitting element is used to utilize said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
Preferably, said device also comprises:
The user data transmitting element is used for the user data that the sub-number of the account of said mandate comprises is sent to client, supplies the client user to select the authorized user data;
Said corresponding relation is set up the unit, is used for after receiving the authorized user data that said client returns, setting up and preserve the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data;
Said authorization message transmitting element, be used to utilize said server address with said ID, authorize sub-number of the account, authorized user data and access token to be sent to said third party's application server.
Preferably, said device also comprises:
Judging unit; Be used to judge whether the sub-number of the account of said mandate is contained in the sub-number of the account of said user; And judge whether said authorized user data are contained in said user data, if judged result is are, then notify said corresponding relation to set up the unit and set up and preserve said corresponding relation.
Preferably, said authorization message transmitting element specifically comprises:
The authorization code generation unit is used to generate authorization code;
Communication unit is used to utilize said server address that said ID, the sub-number of the account of mandate and authorization code are sent to said third party's application server; And receive server identification and the authorization code that said third party's application server sends;
Comparing unit; Whether be used for comparing said server identification conforms to the server identification of said authorization requests; And whether said authorization code conforms to the authorization code of said generation, if all conform to, then said access token is sent to said third party's application server.
Preferably, said device also comprises:
The access request receiving element; Be used to receive the access request that said third party's application server of open platform gateway forwards sends; Said access request comprises server identification, access token, ID, four information of sub-number of the account, and the digital signature of said four information and the endorsement method that generates said digital signature employing;
Authenticating unit is used for said access request is carried out the legitimacy authentication, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication comprises:
Utilize said endorsement method that said four information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID and sub-number of the account in the said access request satisfies the corresponding relation between the sub-number of the account of said authorization server, ID and mandate that said authorization server preserves; If satisfy, judge that then authorization server, ID and the sub-number of the account in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
The embodiment of the invention also provides a kind of user data authoring system, and said system comprises: authorization server, third party's application server, authentication gateway, client,
Said authorization server; Be used to receive the authorization requests that said third party's application server sends; And to authentication gateway transmission ID authentication request, so that said authentication gateway carries out authentication to the client user, said authorization requests comprises server identification and server address;
Said authentication gateway is used for the client user is carried out authentication, and sends to said authorization server and to comprise that authentication passes through the authentication response of user's ID;
Said authorization server also is used to receive said authentication response, and searches the sub-number of the account of the user who is complementary with said ID, and is sent to client;
Said client is used to receive the sub-number of the account of said user, and therefrom selects to authorize sub-number of the account to be sent to said authorization server;
Said authorization server also is used to receive the sub-number of the account of mandate that client is returned, and sets up and preserve the corresponding relation between the sub-number of the account of said server identification, ID and mandate; And utilize said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
Preferably, said authentication gateway specifically comprises:
The logging status acquiring unit is used to obtain client user's logging status, if for successfully login, judge that then the user passes through the user for authentication; If not successfully login then points out the user to carry out the username and password checking, and after the username and password checking is passed through, judges that the user passes through the user for authentication;
Converting unit is used for converting the user name of said authentication through the user into ID, and said ID added in the authentication response is sent to authorization server.
Preferably; Said authorization server; Also be used for the user data that the sub-number of the account of said mandate comprises is sent to client; And after receiving the authorized user data that said client returns, set up and preserve the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data; And utilize said server address with said ID, authorize sub-number of the account, authorized user data and access token to be sent to said third party's application server.
Preferably; Said authorization server is used to also judge whether the sub-number of the account of said mandate is contained in the sub-number of the account of said user, and judges whether said authorized user data are contained in said user data; Be then to continue to carry out the step of setting up and preserving said corresponding relation if judged result is.
Preferably, said system also comprises the open platform gateway;
Said open platform gateway; Be used to receive the access request that said third party's application server sends; And be forwarded to said authorization server; Said access request comprises server identification, access token, ID, four information of sub-number of the account, and the digital signature of said four information and the endorsement method that generates said digital signature employing;
Said authorization server is used for said access request is carried out the legitimacy authentication, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication comprises:
Utilize said endorsement method that said four information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID and sub-number of the account in the said access request satisfies the corresponding relation between the sub-number of the account of said authorization server, ID and mandate that said authorization server preserves; If satisfy, judge that then authorization server, ID and the sub-number of the account in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
Preferably; Also comprise user data in the said access request that said authorization server receives, and the digital signature in the said access request is specially the digital signature of utilizing server identification, access token, ID, sub-number of the account and five information of user data to generate;
Then, said authorization server carries out the legitimacy authentication and specifically comprises:
Utilize said endorsement method that said five information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID, sub-number of the account and user data in the said access request satisfy the sub-number of the account of said authorization server, ID, mandate of said authorization server preservation and the corresponding relation between the authorized user data; If satisfy, judge that then authorization server, ID, sub-number of the account and the user data in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
Preferably, also comprise the current time stamp in the said access request that said authorization server receives;
Then, said authorization server carries out the legitimacy authentication and also comprises:
Judge that whether said current time stab in preset time of delay section, if judge that then said current time stamp is legal.
The user data authorization method of the embodiment of the invention, Apparatus and system; Preserve a plurality of sub-account information under the user account in the authorization server; Thereby when the guiding user carries out use authority to third party's application server; Can therefrom select the parton number of the account as the mode of authorizing sub-number of the account by the user through searching a plurality of sub-account information that is complementary with ID, realize the part use authority of user third party's application server; Improve the service quality of network service, improved user service experience.
Description of drawings
In order to be illustrated more clearly in the application embodiment or technical scheme of the prior art; To do to introduce simply to the accompanying drawing of required use in embodiment or the description of the Prior Art below; Obviously, the accompanying drawing in describing below only is some embodiment that put down in writing among the application, for those of ordinary skills; Under the prerequisite of not paying creative work, can also obtain other accompanying drawing according to these accompanying drawings.
Fig. 1 is the schematic flow sheet of the inventive method embodiment 1;
Fig. 2 is the schematic flow sheet of the inventive method embodiment 2;
Fig. 3 is the schematic flow sheet of the inventive method embodiment 3;
Fig. 4 is the schematic flow sheet of the inventive method embodiment 4;
Fig. 5 is the schematic flow sheet of the inventive method embodiment 5;
Fig. 6 is the schematic flow sheet of the inventive method embodiment 6;
Fig. 7 is the structural representation of apparatus of the present invention embodiment 1;
Fig. 8 is the structural representation of authorization message transmitting element 706 among apparatus of the present invention embodiment 1;
Fig. 9 is the structural representation of apparatus of the present invention embodiment 2;
Figure 10 is the structural representation of apparatus of the present invention embodiment 3;
Figure 11 is the structural representation of apparatus of the present invention embodiment 4;
Figure 12 is the structural representation of system embodiment 1 of the present invention;
Figure 13 is the structural representation of authentication gateway 113 in the system embodiment 1 of the present invention;
Figure 14 is the structural representation of system embodiment 2 of the present invention.
Embodiment
In order to make those skilled in the art person understand the present invention program better; To combine the accompanying drawing in the embodiment of the invention below; Technical scheme in the embodiment of the invention is carried out clear, intactly description; Obviously, described embodiment only is the present invention's part embodiment, rather than whole embodiment.Based on the embodiment among the present invention, those of ordinary skills are not making the every other embodiment that is obtained under the creative work prerequisite, all belong to the scope of the present invention's protection.
User data authorization method of the present invention, Apparatus and system are intended to realize the user to third-party part use authority this purpose, understand for ease, at first introduce applied environment of the present invention.
Original network service only relates to two sides; The one, as user's user, the one, as the service provider who serves the provider, the user saves the data in service provider's the server; And send request to server when needed, be that the user provides corresponding network service by the service provider.For example; User A has created a user account on the game server of game services provider magnificence; And (for example on this game server, preserved the user data relevant with user A; The user basic information of filling in during registration, the user data such as role of the user gradation that produces in the game process, game article, establishment), so when user A wants this network service of enjoy network recreation; Only need with game server between sets up and communicates by letter, game server just can provide game services for user A according to the user data of preservation.
Development along with information technology; Open platform arises at the historic moment; The service provider is open to third party (can be that company also can be the individual) with the data of its preservation, and at this new network service mode, the user just can enjoy the network service that the third party provide through service provider's platform; For example, user A can enjoy the stars that provide of playing more and becomes the network service that recreation is supplemented with money through the magnificence open platform of playing; Also can equip inquiry service or the like through the magnificence AION role that open platform enjoys Sina's microblogging and provide that plays.
For this new network service mode; If the user wants to enjoy the service that the third party provides through open platform; So just must can obtain its user data from the service provider with the third party is prerequisite; Otherwise the third party just can't depend on that the user is to third-party use authority and can the third party get access to user data for the user provides service.The user can only do himself as a wholely in the prior art, is that unit carries out use authority to the third party with user, but can not the implementation part use authority, and the present invention has proposed a kind of little user data authorization method of granularity of authorizing under this demand.
Embodiment one
Referring to Fig. 1, show the flow chart of a kind of user data authorization method embodiment 1 of the present invention, can may further comprise the steps:
If user A has registered a user account on the platform of game services provider, under this user account, created three sub-numbers of the account simultaneously, be respectively game role A
1, A
2And A
3(game role can be presented as game identifier, Game Zone sign, game sign and the game role sign that each role has), these data just have been stored in game services merchant's the platform so.In addition, if two third party B have been given in game services merchant's platform opening
1And B
2, that is to say third party B
1And B
2On platform, accomplished registration, platform is also preserved B so
1And B
2Log-on message (for example third-party server identification ID
1, communication with information such as keys).
If user A wants with sub-number of the account A
1Identity login third party B
1, enjoy B
1The network service that provides, B so
1Receiving A
1Logging request after, can go open platform to obtain sub-number of the account A
1Corresponding user data, B like this
1Could corresponding network service be provided for user A.If user A is to third party B
1Carried out sub-number of the account A
1Use authority, open platform will be to B so
1Access request carry out authentication, and after judging that request is legal, with B
1The A of request
1User data return to B
1, and then by B
1For the user provides services on the Internet.But, if user A is not to B
1Carry out sub-number of the account A
1Use authority or open platform to B
1Authentication do not pass through, open platform will be pointed out third party B so
1Guide user A that it is carried out sub-number of the account A
1Use authority.
The authorization requests that this step authorization server receives the transmission of third party's application server promptly is that the third party guides the user to carry out the setting up procedure of use authority.Wherein, comprise server identification ID in the authorization requests
1Purpose be for make authorization server know the third party who carries out this authorization requests be who (in addition, authorization server can also be according to ID
1Judge whether this third party registered at open platform; Because the third party who only registered at open platform just has the authority request user that it is carried out use authority); The purpose that comprises server address is for after accomplishing use authority the user, the third party that authorization server can be authorized the authorization message request of sending to accurately.
Need to prove that so-called " guiding " promptly is that webpage is redirected, just forward the fixed again direction of diverse network request to other position through various methods.Guiding in this step is meant that the page that is shown to user A is from third party B
1Login interface jump to the prompting user to B
1Carry out the process at interface of the mandate website of use authority.
Step 102 is sent ID authentication request to authentication gateway, so that said authentication gateway carries out authentication to the client user.
Step 103 receives the authentication response that said authentication gateway returns, and said authentication response comprises the ID of authentication through the user.
After authorization server receives third-party authorization requests, directly do not point out user A to third party B
1Carry out use authority; But to guide user A to carry out authentication (the guiding here is meant the interface that the page that is shown to A is jumped to authentication from the interface of authorizing the website) earlier to authentication gateway; If being, this user is not carried out the identity information that authentication just can't be known the user; And then also just can't know the sub-account information that this user has, cause Authorized operation to be obstructed.
Authentication gateway can be presented as the mode that the user carries out authentication:
At first, obtain the logging status of user A, if, judge that then the user passes through the user for authentication for successfully login; If not successfully login then points out user A to carry out the username and password checking, and after the username and password checking is passed through, judges that the user passes through the user for authentication.
Logging status for the user need be explained here; The user who is directed to authentication gateway through authorization server generally speaking is the user that success is logined; But also possibly (interconnect because of interconnecting between the network; Being meant between different telecommunication networks to set up effectively to connect, make between the user of heterogeneous networks and can communicate by letter, or the user of a network can using the service of another network) situation causes user's logging status for successfully logining.
Secondly, convert the user name of said authentication through the user into ID, and said ID added in the authentication response be sent to authorization server.
Convert the user name of successful login user into ID ID
2Purpose be in order to guarantee safety of user data, directly user's privacy information (for example user name) is not revealed and is given the third party.
Step 104 is searched the sub-number of the account of the user who is complementary with said ID, and is sent to client in authorization server, supply the client user to select to authorize sub-number of the account.
Authorization server extracts ID ID from the authentication response
2, and in this authorization server, search the sub-number of the account of the user who is complementary with this sign, for example find the sub-number of the account that the sign with user A is complementary and comprise A
1, A
2And A
3, then these three sub-numbers of the account are sent to client, show to the user, supply the user therefrom to select desire to third party B
2The sub-number of the account of authorizing, for example the user has selected sub-number of the account A
1
Step 105 receives the sub-number of the account of mandate that client is returned, and sets up and preserve the corresponding relation between the sub-number of the account of said server identification, ID and mandate.
Authorization server is pushed to the whole sub-number of the account of user A after the user checks, just wait for the feedback information that receives the user, and the sub-number of the account that the user is selected licenses to B as this
1The sub-number of the account of mandate, set up server identification ID then
1, ID ID
2With the sub-number of the account A of mandate
1Between corresponding relation.Like this, which user authorization server has just known has licensed to which sub-number of the account of its subordinate for which third party, so that when the third party sends access request, authorization server can carry out the legitimacy authentication to access request.
Step 106 utilizes said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
Authorization server has just been known the authorization conditions between third party, user and the sub-number of the account after execution in step 105; And if accomplish the user to third-party use authority; Also need let the third party also know the use authority that it has obtained which sub-number of the account of which user, thus authorization server also need according to the server address in step 101 authorization requests with ID, authorize the access token of sub-number of the account and expression access rights to be sent to the third party.So far, just accomplished the user to third-party part use authority process.
According to above-mentioned as an exampleBSEMGVR takeN-PSVSEMOBJ, just realized that through carrying out step of the present invention user A is to third party B
1Authorize sub-number of the account A
1Rights of using (come down to B to the third party
1Authorized its antithetical phrase number of the account A
1The access rights of corresponding user data) this purpose.
A kind of implementation as step 106 can be embodied as:
At first, generate authorization code, and utilize said server address that said ID, the sub-number of the account of mandate and authorization code are sent to said third party's application server.
Secondly; Receive server identification and authorization code that said third party's application server sends; If said server identification conforms to server identification in the said authorization requests; And said authorization code conforms to the authorization code of said generation, then said access token is sent to said third party's application server.
Authorization server can directly send to third party's application server with ID, the sub-number of the account of mandate and access token; But; For fail safe and the reliability that guarantees to communicate by letter between authorization server and third party's application server; Authorization server generates one group of random number as authorization code, and ID, the sub-number of the account of mandate and authorization code are sent to third party's application server; Third party's application server then after receiving above-mentioned authorization message, feeds back to authorization server with authorization code and the server identification of self, exchanges access token for this.
Embodiment two
On the basis of embodiment 1, the also further refinement of the present invention is that unit carries out use authority to the third party to third-party mandate granularity with sub-number of the account corresponding user data.Referring to Fig. 2, show the flow chart of a kind of user data authorization method embodiment 2 of the present invention, can may further comprise the steps:
Step 202 is sent ID authentication request to authentication gateway, so that said authentication gateway carries out authentication to the client user.
Step 203 receives the authentication response that said authentication gateway returns, and said authentication response comprises the ID of authentication through the user.
Step 204 is searched the sub-number of the account of the user who is complementary with said ID, and is sent to client in authorization server, supply the client user to select to authorize sub-number of the account.
Step 201 ~ step 204 is identical with step 101 ~ step 104, repeats no more here.
Step 205 receives the sub-number of the account of mandate that client is returned, and the user data that the sub-number of the account of said mandate is comprised is sent to client, supplies the client user to select the authorized user data.
Different with embodiment 1; The further refinement of present embodiment the granularity of authorizing to the third party, after authorization server receives the sub-number of the account of mandate that the user selects, also further remove to obtain the user data that this sub-number of the account comprises; For example; The pet name of sub-number of the account, grade, head portrait, good friend, dynamic dispatching push to client with these user data that sub-number of the account comprises then, are shown to the user and check; So that the user can therefrom select which user data of wanting to authorize to the third party sub-number of the account, promptly select its desire with sub-number of the account A by user A
1Which user data license to third party B
1, for example the user has selected A
1" head portrait " user data.
Step 206 receives the authorized user data that said client is returned, and sets up and preserve the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data.
Through after the step 205; Authorization server is known in this step, and which third party is exactly which user licensed to which user data of which sub-number of the account of its subordinate; Therefore, the corresponding relation that need set up of authorization server is exactly the corresponding relation between server identification, ID, the sub-number of the account of mandate and authorized user data.
According to above-mentioned as an exampleBSEMGVR takeN-PSVSEMOBJ, that authorization server is set up at this moment and preserved is server identification ID
1, ID ID
2, authorize sub-number of the account A
1And the corresponding relation between the authorized user data " head portrait ".
Embodiment three
In order to improve the mandate reliability, prevent that user's the act of authorization is maliciously tampered, referring to Fig. 3, show the flow chart of a kind of user data authorization method embodiment 3 of the present invention, can may further comprise the steps:
Step 302 is sent ID authentication request to authentication gateway, so that said authentication gateway carries out authentication to the client user.
Step 303 receives the authentication response that said authentication gateway returns, and said authentication response comprises the ID of authentication through the user.
Step 304 is searched the sub-number of the account of the user who is complementary with said ID, and is sent to client in authorization server, supply the client user to select to authorize sub-number of the account.
Step 301 ~ step 304 is identical with step 101 ~ step 104, repeats no more here.
Step 305 receives the sub-number of the account of mandate that client is returned, and judges whether the sub-number of the account of said mandate is contained in the sub-number of the account of said user.
The corresponding relation between the sub-number of the account of said server identification, ID and mandate is set up and preserved to step 306 when the sub-number of the account of said mandate is contained in the sub-number of the account of said user.
Authorization server is before setting up and preserving said corresponding relation; Judge the legitimacy of its sub-number of the account of mandate that receives earlier; Whether promptly judge to authorize sub-number of the account is one or more in a plurality of sub-number of the account of user underling; If judge that then the sub-number of the account of mandate that receives is legal, and then set up said corresponding relation.If through authorization server judges, (the sub-number of the account of the mandate that for example, receives is A not have the sub-number of the account of the mandate that receives in the sub-number of the account of discovery user underling
4, user A subordinate's sub-number of the account A
1, A
2And A
3All can't match), the sub-number of the account of mandate of user's selection possibly be maliciously tampered so, judged that the sub-number of the account of mandate that receives is illegal this moment, no longer continued to set up said corresponding relation, also can alarm to the user simultaneously.
Step 307 utilizes said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
Step 307 is identical with step 106, also repeats no more here.
Embodiment four
Likewise,, prevent that user's the act of authorization is maliciously tampered,, show the flow chart of a kind of user data authorization method embodiment 4 of the present invention, can may further comprise the steps referring to Fig. 4 in order to improve the mandate reliability:
Step 402 is sent ID authentication request to authentication gateway, so that said authentication gateway carries out authentication to the client user.
Step 403 receives the authentication response that said authentication gateway returns, and said authentication response comprises the ID of authentication through the user.
Step 404 is searched the sub-number of the account of the user who is complementary with said ID, and is sent to client in authorization server, supply the client user to select to authorize sub-number of the account.
Step 405 receives the sub-number of the account of mandate that client is returned, and the user data that the sub-number of the account of said mandate is comprised is sent to client, supplies the client user to select the authorized user data.
Step 401 ~ step 405 is identical with step 201 ~ step 205, repeats no more here.
Need to prove, after step 405 receives the sub-number of the account of mandate that client returns, also can utilize the sub-number of the account of user underling to judge the legitimacy of the sub-number of the account of mandate that receives, guarantee the mandate reliability of sub-number of the account.
Step 406 receives the authorized user data that said client is returned, and judges whether said authorized user data are contained in said user data.
The corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data is set up and preserved to step 407 when said authorized user packet is contained in said user data.
Authorization server is before setting up and preserving said corresponding relation; Judge the legitimacy of its authorized user data that receive earlier; Judge that promptly whether the authorized user data are to authorize one or more in a plurality of user data that sub-number of the account comprises; If judge that then the authorized user data that receive are legal, and then set up said corresponding relation.If through authorization server judges, there is not authorized user data (for example, the sub-number of the account A of user A that receives in the user data of finding to authorize sub-number of the account to comprise
1The user data that comprises is grade, head portrait, good friend, dynamic, and the authorized user data that authorization server receives are " pet name ", so sub-number of the account A
1The all customer data that comprises all can't match), then the authorized user data of user's selection possibly be maliciously tampered, and judged that the authorized user data that receive are illegal this moment, no longer continued to set up said corresponding relation, also can alarm to the user simultaneously.
Embodiment five
Referring to Fig. 5; Show the flow chart of a kind of user data authorization method embodiment 5 of the present invention; After embodiment shown in Figure 11 and embodiment 3 shown in Figure 3 are sent to third party's application server with ID, the sub-number of the account of mandate and access token; Said method can also comprise the process of the access request that authentication third party application server sends, and is embodied as following steps:
Step 502 is carried out the legitimacy authentication to said access request, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication comprises:
(1) utilize said endorsement method that said four information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
(2) judge whether server identification, ID and sub-number of the account in the said access request satisfies the corresponding relation between the sub-number of the account of said authorization server, ID and mandate that said authorization server preserves; If satisfy, judge that then authorization server, ID and the sub-number of the account in the said access request is legal;
(3) judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
If access request, authorization server, ID, sub-number of the account and access token are all legal, judge that then authentication passes through.
Embodiment six
Referring to Fig. 6; Show the flow chart of a kind of user data authorization method embodiment 6 of the present invention; Embodiment shown in Figure 22 and embodiment 4 shown in Figure 4 with ID, authorize after sub-number of the account, authorized user data and access token be sent to third party's application server; Said method can also comprise the process of the access request that authentication third party application server sends, and is embodied as following steps:
Step 602 is carried out the legitimacy authentication to said access request, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication specifically comprises:
(1) utilize said endorsement method that said five information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
(2) judge whether server identification, ID, sub-number of the account and user data in the said access request satisfy the sub-number of the account of said authorization server, ID, mandate of said authorization server preservation and the corresponding relation between the authorized user data; If satisfy, judge that then authorization server, ID, sub-number of the account and the user data in the said access request is legal;
(3) judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
If access request, authorization server, ID, sub-number of the account, user data and access token are all legal, judge that then authentication passes through.
Embodiment seven
In order to prevent Replay Attack, on the basis of embodiment shown in Figure 55 and embodiment 6 shown in Figure 6, the access request that the present invention also can send according to following method authentication third party application server particularly, comprise also in the said access request that the current time stabs; Then said legitimacy authentication also comprises: judge that whether said current time stab in preset time of delay section, if judge that then said current time stamp is legal.
If it is all legal that access request, authorization server, ID, sub-number of the account, user data, access token and current time stab, judge that then authentication passes through.
Embodiment eight
Referring to Fig. 7, show the structured flowchart of a kind of user data authorization device embodiment 1 of the present invention, said device comprises:
Authorization requests receiving element 701 is used to receive the authorization requests that third party's application server sends, and said authorization requests comprises server identification and server address;
Authentication request transmitting element 702 is used for sending ID authentication request to authentication gateway, so that said authentication gateway carries out authentication to the client user;
Authentication response receiving element 703 is used to receive the authentication response that said authentication gateway returns, and said authentication response comprises the ID of authentication through the user;
Corresponding relation is set up unit 705, is used to receive the sub-number of the account of mandate that client is returned, and sets up and preserve the corresponding relation between the sub-number of the account of said server identification, ID and mandate;
Authorization message transmitting element 706 is used to utilize said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
Further, as shown in Figure 8, said authorization message transmitting element specifically can comprise:
Authorization code generation unit 7061 is used to generate authorization code;
Comparing unit 7063; Whether be used for comparing said server identification conforms to the server identification of said authorization requests; And whether said authorization code conforms to the authorization code of said generation, if all conform to, then said access token is sent to said third party's application server.
Embodiment nine
Referring to Fig. 9, show the structured flowchart of a kind of user data authorization device embodiment 2 of the present invention, said device also comprises:
User data transmitting element 707 is used for the user data that the sub-number of the account of said mandate comprises is sent to client, supplies the client user to select the authorized user data;
Said corresponding relation is set up unit 705, is used for after receiving the authorized user data that said client returns, setting up and preserve the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data;
Said authorization message transmitting element 706, be used to utilize said server address with said ID, authorize sub-number of the account, authorized user data and access token to be sent to said third party's application server.
Embodiment ten
Referring to Figure 10, show the structured flowchart of a kind of user data authorization device embodiment 3 of the present invention, said device also comprises:
Judging unit 708; Be used to judge whether the sub-number of the account of said mandate is contained in the sub-number of the account of said user; And judge whether said authorized user data are contained in said user data, if judged result is are, then notify said corresponding relation to set up the unit and set up and preserve said corresponding relation.
Embodiment 11
Referring to Figure 11, show the structured flowchart of a kind of user data authorization device embodiment 4 of the present invention, said device also comprises:
Access request receiving element 709; Be used to receive the access request that said third party's application server of open platform gateway forwards sends; Said access request comprises server identification, access token, ID, four information of sub-number of the account, and the digital signature of said four information and the endorsement method that generates said digital signature employing;
Authenticating unit 710 is used for said access request is carried out the legitimacy authentication, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication comprises:
Utilize said endorsement method that said four information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID and sub-number of the account in the said access request satisfies the corresponding relation between the sub-number of the account of said authorization server, ID and mandate that said authorization server preserves; If satisfy, judge that then authorization server, ID and the sub-number of the account in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
Embodiment 12
Referring to Figure 12, show the structured flowchart of a kind of user data authoring system embodiment 1 of the present invention, said system comprises: authorization server 111, third party's application server 112, authentication gateway 113, client 114, wherein,
Said authorization server; Be used to receive the authorization requests that said third party's application server sends; And to authentication gateway transmission ID authentication request, so that said authentication gateway carries out authentication to the client user, said authorization requests comprises server identification and server address;
Said authentication gateway is used for the client user is carried out authentication, and sends to said authorization server and to comprise that authentication passes through the authentication response of user's ID;
Said authorization server also is used to receive said authentication response, and searches the sub-number of the account of the user who is complementary with said ID, and is sent to client;
Said client is used to receive the sub-number of the account of said user, and therefrom selects to authorize sub-number of the account to be sent to said authorization server;
Said authorization server also is used to receive the sub-number of the account of mandate that client is returned, and sets up and preserve the corresponding relation between the sub-number of the account of said server identification, ID and mandate; And utilize said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
Authorization server in the user data authoring system of the present invention, third party's application server, authentication gateway and client cooperatively interact and have just realized the purpose of user of the present invention to third party's part use authority.Referring to Figure 13, show the structured flowchart of authentication gateway, specifically comprise:
Logging status acquiring unit 1131 is used to obtain client user's logging status, if for successfully login, judge that then the user passes through the user for authentication; If not successfully login then points out the user to carry out the username and password checking, and after the username and password checking is passed through, judges that the user passes through the user for authentication;
Converting unit 1132 is used for converting the user name of said authentication through the user into ID, and said ID added in the authentication response is sent to authorization server.
Further; But the present invention also refinement user realizes that the user data that comprises with sub-number of the account is that unit is authorized, at this moment to the granularity of third party's mandate; Said authorization server; Also be used for the user data that the sub-number of the account of said mandate comprises is sent to client, and after receiving the authorized user data that said client returns, set up and preserve the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data; And utilize said server address with said ID, authorize sub-number of the account, authorized user data and access token to be sent to said third party's application server.
Further; In order to improve the mandate reliability, prevent that user's the act of authorization is maliciously tampered, said authorization server; Be used to also judge whether the sub-number of the account of said mandate is contained in the sub-number of the account of said user; And judge whether said authorized user data are contained in said user data, if judged result is are, then continue to carry out the step of setting up and preserving said corresponding relation.
Embodiment 13
Referring to Figure 14, show the structured flowchart of a kind of user data authoring system embodiment 2 of the present invention, said system also comprises open platform gateway 115;
Said open platform gateway; Be used to receive the access request that said third party's application server sends; And be forwarded to said authorization server; Said access request comprises server identification, access token, ID, four information of sub-number of the account, and the digital signature of said four information and the endorsement method that generates said digital signature employing;
Said authorization server is used for said access request is carried out the legitimacy authentication, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication comprises:
Utilize said endorsement method that said four information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID and sub-number of the account in the said access request satisfies the corresponding relation between the sub-number of the account of said authorization server, ID and mandate that said authorization server preserves; If satisfy, judge that then authorization server, ID and the sub-number of the account in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
Further; If the user data that the user comprises with sub-number of the account is a unit third party is carried out use authority; So when authentication third party access request legitimacy; Also comprise user data in the said access request that said authorization server receives, and the digital signature in the said access request is specially the digital signature of utilizing server identification, access token, ID, sub-number of the account and five information of user data to generate; Then,
Said authorization server carries out the legitimacy authentication and specifically comprises:
Utilize said endorsement method that said five information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID, sub-number of the account and user data in the said access request satisfy the sub-number of the account of said authorization server, ID, mandate of said authorization server preservation and the corresponding relation between the authorized user data; If satisfy, judge that then authorization server, ID, sub-number of the account and the user data in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
Further, in order to prevent Replay Attack, when authentication third party access request legitimacy, also comprise the current time stamp in the said access request that said authorization server receives so; Then,
Said authorization server carries out the legitimacy authentication and also comprises:
Judge that whether said current time stab in preset time of delay section, if judge that then said current time stamp is legal.
The present invention can describe in the general context of the computer executable instructions of being carried out by computer, for example program module.Usually, program module comprises the routine carrying out particular task or realize particular abstract, program, object, assembly, data structure or the like.Also can in DCE, put into practice the present invention, in these DCEs, by through communication network connected teleprocessing equipment execute the task.In DCE, program module can be arranged in this locality and the remote computer storage medium that comprises memory device.
Need to prove; In this article; Relational terms such as first and second grades only is used for an entity or operation are made a distinction with another entity or operation, and not necessarily requires or hint relation or the order that has any this reality between these entities or the operation.And; Term " comprises ", " comprising " or its any other variant are intended to contain comprising of nonexcludability; Thereby make and comprise that process, method, article or the equipment of a series of key elements not only comprise those key elements; But also comprise other key elements of clearly not listing, or also be included as this process, method, article or equipment intrinsic key element.Under the situation that do not having much more more restrictions, the key element that limits by statement " comprising ... ", and be not precluded within process, method, article or the equipment that comprises said key element and also have other identical element.
For device embodiment, because it corresponds essentially to method embodiment, so relevant part gets final product referring to the part explanation of method embodiment.Device embodiment described above only is schematic; Wherein said unit as the separating component explanation can or can not be physically to separate also; The parts that show as the unit can be or can not be physical locations also; Promptly can be positioned at a place, perhaps also can be distributed on a plurality of NEs.Can realize the purpose of present embodiment scheme according to the needs selection some or all of module wherein of reality.Those of ordinary skills promptly can understand and implement under the situation of not paying creative work.
The above only is an embodiment of the present invention; Should be pointed out that for those skilled in the art, under the prerequisite that does not break away from the principle of the invention; Can also make some improvement and retouching, these improvement and retouching also should be regarded as protection scope of the present invention.
Claims (20)
1. a user data authorization method is characterized in that, comprising:
Authorization server receives the authorization requests that third party's application server sends, and said authorization requests comprises server identification and server address;
Send ID authentication request to authentication gateway, so that said authentication gateway carries out authentication to the client user;
Receive the authentication response that said authentication gateway returns, said authentication response comprises the ID of authentication through the user;
In authorization server, search the sub-number of the account of the user who is complementary with said ID, and be sent to client, supply the client user to select to authorize sub-number of the account;
Receive the sub-number of the account of mandate that client is returned, set up and preserve the corresponding relation between the sub-number of the account of said server identification, ID and mandate;
Utilize said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
2. method according to claim 1 is characterized in that, said authentication gateway carries out authentication to the client user, specifically comprises:
Obtain client user's logging status, if, judge that then the user passes through the user for authentication for successfully login; If not successfully login then points out the user to carry out the username and password checking, and after the username and password checking is passed through, judges that the user passes through the user for authentication;
Convert the user name of said authentication through the user into ID, and said ID added in the authentication response be sent to authorization server.
3. method according to claim 1 is characterized in that, said method also comprises: after the sub-number of the account of mandate that said reception client is returned,
The user data that the sub-number of the account of said mandate is comprised is sent to client, supplies the client user to select the authorized user data; Then,
Said foundation is also preserved said corresponding relation and is specifically comprised: after receiving the authorized user data that said client returns, set up and preserve the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data;
Saidly utilize said server address to be specially: ID, to authorize sub-number of the account, authorized user data and access token to the information that said third party's application server sends.
4. method according to claim 3 is characterized in that, said method also comprises: before said foundation and preserving the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data,
Judge whether the sub-number of the account of said mandate is contained in the sub-number of the account of said user, and judge whether said authorized user data are contained in said user data, if judged result is are, then continue to carry out the step of setting up and preserving said corresponding relation.
5. method according to claim 1 is characterized in that, said utilize said server address with said ID, authorize sub-number of the account and access token to be sent to said third party's application server, specifically comprise:
Generate authorization code, and utilize said server address that said ID, the sub-number of the account of mandate and authorization code are sent to said third party's application server;
Receive server identification and authorization code that said third party's application server sends; If said server identification conforms to server identification in the said authorization requests; And said authorization code conforms to the authorization code of said generation, then said access token is sent to said third party's application server.
6. according to each described method of claim 1-5, it is characterized in that said method also comprises:
Receive the access request of said third party's application server transmission of open platform gateway forwards; Said access request comprises server identification, access token, ID, four information of sub-number of the account, and the digital signature of said four information and the endorsement method that generates said digital signature employing;
Said access request is carried out the legitimacy authentication, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication comprises:
Utilize said endorsement method that said four information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID and sub-number of the account in the said access request satisfies the corresponding relation between the sub-number of the account of said authorization server, ID and mandate that said authorization server preserves; If satisfy, judge that then authorization server, ID and the sub-number of the account in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
7. method according to claim 6 is characterized in that, said method also comprises:
Said access request also comprises user data, then,
Digital signature in the said access request is specially the digital signature of utilizing server identification, access token, ID, sub-number of the account and five information of user data to generate;
Said legitimacy authentication specifically comprises:
Utilize said endorsement method that said five information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID, sub-number of the account and user data in the said access request satisfy the sub-number of the account of said authorization server, ID, mandate of said authorization server preservation and the corresponding relation between the authorized user data; If satisfy, judge that then authorization server, ID, sub-number of the account and the user data in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
8. method according to claim 6 is characterized in that, said method also comprises:
Said access request also comprises the current time stamp; Then,
Said legitimacy authentication also comprises:
Judge that whether said current time stab in preset time of delay section, if judge that then said current time stamp is legal.
9. a user data authorization device is characterized in that, comprising:
The authorization requests receiving element is used to receive the authorization requests that third party's application server sends, and said authorization requests comprises server identification and server address;
The authentication request transmitting element is used for sending ID authentication request to authentication gateway, so that said authentication gateway carries out authentication to the client user;
The authentication response receiving element is used to receive the authentication response that said authentication gateway returns, and said authentication response comprises the ID of authentication through the user;
Search the unit, be used in authorization server, searching the sub-number of the account of the user who is complementary with said ID, and be sent to client, supply the client user to select to authorize sub-number of the account;
Corresponding relation is set up the unit, is used to receive the sub-number of the account of mandate that client is returned, and sets up and preserve the corresponding relation between the sub-number of the account of said server identification, ID and mandate;
The authorization message transmitting element is used to utilize said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
10. device according to claim 9 is characterized in that, said device also comprises:
The user data transmitting element is used for the user data that the sub-number of the account of said mandate comprises is sent to client, supplies the client user to select the authorized user data;
Said corresponding relation is set up the unit, is used for after receiving the authorized user data that said client returns, setting up and preserve the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data;
Said authorization message transmitting element, be used to utilize said server address with said ID, authorize sub-number of the account, authorized user data and access token to be sent to said third party's application server.
11. device according to claim 10 is characterized in that, said device also comprises:
Judging unit; Be used to judge whether the sub-number of the account of said mandate is contained in the sub-number of the account of said user; And judge whether said authorized user data are contained in said user data, if judged result is are, then notify said corresponding relation to set up the unit and set up and preserve said corresponding relation.
12. device according to claim 9 is characterized in that, said authorization message transmitting element specifically comprises:
The authorization code generation unit is used to generate authorization code;
Communication unit is used to utilize said server address that said ID, the sub-number of the account of mandate and authorization code are sent to said third party's application server; And receive server identification and the authorization code that said third party's application server sends;
Comparing unit; Whether be used for comparing said server identification conforms to the server identification of said authorization requests; And whether said authorization code conforms to the authorization code of said generation, if all conform to, then said access token is sent to said third party's application server.
13., it is characterized in that said device also comprises according to each described device of claim 9-12:
The access request receiving element; Be used to receive the access request that said third party's application server of open platform gateway forwards sends; Said access request comprises server identification, access token, ID, four information of sub-number of the account, and the digital signature of said four information and the endorsement method that generates said digital signature employing;
Authenticating unit is used for said access request is carried out the legitimacy authentication, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication comprises:
Utilize said endorsement method that said four information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID and sub-number of the account in the said access request satisfies the corresponding relation between the sub-number of the account of said authorization server, ID and mandate that said authorization server preserves; If satisfy, judge that then authorization server, ID and the sub-number of the account in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
14. a user data authoring system is characterized in that, said system comprises: authorization server, third party's application server, authentication gateway, client,
Said authorization server; Be used to receive the authorization requests that said third party's application server sends; And to authentication gateway transmission ID authentication request, so that said authentication gateway carries out authentication to the client user, said authorization requests comprises server identification and server address;
Said authentication gateway is used for the client user is carried out authentication, and sends to said authorization server and to comprise that authentication passes through the authentication response of user's ID;
Said authorization server also is used to receive said authentication response, and searches the sub-number of the account of the user who is complementary with said ID, and is sent to client;
Said client is used to receive the sub-number of the account of said user, and therefrom selects to authorize sub-number of the account to be sent to said authorization server;
Said authorization server also is used to receive the sub-number of the account of mandate that client is returned, and sets up and preserve the corresponding relation between the sub-number of the account of said server identification, ID and mandate; And utilize said server address that the access token of said ID, the sub-number of the account of said mandate and expression access rights is sent to said third party's application server.
15. system according to claim 14 is characterized in that, said authentication gateway specifically comprises:
The logging status acquiring unit is used to obtain client user's logging status, if for successfully login, judge that then the user passes through the user for authentication; If not successfully login then points out the user to carry out the username and password checking, and after the username and password checking is passed through, judges that the user passes through the user for authentication;
Converting unit is used for converting the user name of said authentication through the user into ID, and said ID added in the authentication response is sent to authorization server.
16. system according to claim 14 is characterized in that,
Said authorization server; Also be used for the user data that the sub-number of the account of said mandate comprises is sent to client; And after receiving the authorized user data that said client returns, set up and preserve the corresponding relation between said server identification, ID, the sub-number of the account of mandate and authorized user data; And utilize said server address with said ID, authorize sub-number of the account, authorized user data and access token to be sent to said third party's application server.
17. system according to claim 16 is characterized in that,
Said authorization server; Be used to also judge whether the sub-number of the account of said mandate is contained in the sub-number of the account of said user; And judge whether said authorized user data are contained in said user data, if judged result is are, then continue to carry out the step of setting up and preserving said corresponding relation.
18., it is characterized in that said system also comprises the open platform gateway according to each described system of claim 14-17;
Said open platform gateway; Be used to receive the access request that said third party's application server sends; And be forwarded to said authorization server; Said access request comprises server identification, access token, ID, four information of sub-number of the account, and the digital signature of said four information and the endorsement method that generates said digital signature employing;
Said authorization server is used for said access request is carried out the legitimacy authentication, if authentication is passed through all customer data that then allows the sub-number of the account in the said access request of said third party's application server access to comprise;
Wherein, said legitimacy authentication comprises:
Utilize said endorsement method that said four information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID and sub-number of the account in the said access request satisfies the corresponding relation between the sub-number of the account of said authorization server, ID and mandate that said authorization server preserves; If satisfy, judge that then authorization server, ID and the sub-number of the account in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
19. system according to claim 18 is characterized in that,
Also comprise user data in the said access request that said authorization server receives, and the digital signature in the said access request is specially the digital signature of utilizing server identification, access token, ID, sub-number of the account and five information of user data to generate;
Then, said authorization server carries out the legitimacy authentication and specifically comprises:
Utilize said endorsement method that said five information are carried out digital signature, and with said access request in the digital signature comparison that comprises, if identical, judge that then said access request is legal;
Judge whether server identification, ID, sub-number of the account and user data in the said access request satisfy the sub-number of the account of said authorization server, ID, mandate of said authorization server preservation and the corresponding relation between the authorized user data; If satisfy, judge that then authorization server, ID, sub-number of the account and the user data in the said access request is legal;
Judge that whether said access token conforms to the access token that said authorization server sends to third party's application server, if conform to, judges that then said access token is legal.
20. system according to claim 18 is characterized in that,
Also comprise the current time stamp in the said access request that said authorization server receives;
Then, said authorization server carries out the legitimacy authentication and also comprises:
Judge that whether said current time stab in preset time of delay section, if judge that then said current time stamp is legal.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210137848.XA CN102638473B (en) | 2012-05-04 | 2012-05-04 | User data authorization method, device and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210137848.XA CN102638473B (en) | 2012-05-04 | 2012-05-04 | User data authorization method, device and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102638473A true CN102638473A (en) | 2012-08-15 |
| CN102638473B CN102638473B (en) | 2014-12-10 |
Family
ID=46622716
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210137848.XA Active CN102638473B (en) | 2012-05-04 | 2012-05-04 | User data authorization method, device and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102638473B (en) |
Cited By (44)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103490898A (en) * | 2013-09-22 | 2014-01-01 | 新浪网技术(中国)有限公司 | E-mail collection authorization method, device and system |
| WO2014086111A1 (en) * | 2012-12-03 | 2014-06-12 | 鹤山世达光电科技有限公司 | Fingerprint authentication based information management system and information management method |
| CN103888451A (en) * | 2014-03-10 | 2014-06-25 | 百度在线网络技术（北京）有限公司 | Method, device and system for certification authorization |
| WO2014206199A1 (en) * | 2013-06-25 | 2014-12-31 | 华为技术有限公司 | Account login method, equipment and system |
| CN104320265A (en) * | 2014-11-21 | 2015-01-28 | 北京奇虎科技有限公司 | Authentication method and device for software platform |
| CN104468635A (en) * | 2014-12-31 | 2015-03-25 | 广州东海网络科技有限公司 | Upgrading authentication method and system for user permission in network platform |
| CN104702415A (en) * | 2015-03-31 | 2015-06-10 | 北京奇艺世纪科技有限公司 | Account number permission control method and device |
| CN104869102A (en) * | 2014-02-24 | 2015-08-26 | 腾讯科技（北京）有限公司 | Authorization method, device and system based on xAuth protocols |
| CN105187417A (en) * | 2015-08-25 | 2015-12-23 | 北京京东尚科信息技术有限公司 | Authority obtaining method and device |
| CN105306498A (en) * | 2014-06-12 | 2016-02-03 | 中国电信股份有限公司 | Method and system of user for accessing third party application and cloud platform |
| CN105391725A (en) * | 2015-11-27 | 2016-03-09 | 深圳市摩艾客科技股份有限公司 | Real person 3D data reading module and data transmission method thereof |
| CN105488366A (en) * | 2014-10-13 | 2016-04-13 | 阿里巴巴集团控股有限公司 | Data permission control method and system |
| CN105516069A (en) * | 2014-09-28 | 2016-04-20 | 腾讯科技（深圳）有限公司 | Data processing method, data processing device, and data processing system |
| CN105704108A (en) * | 2014-11-28 | 2016-06-22 | 中国电信股份有限公司 | Method for safety certification, ability opening platform and system |
| CN106168899A (en) * | 2015-05-19 | 2016-11-30 | 罗伯特·博世有限公司 | For updating method and the more new gateway of embedded Control equipment |
| WO2017021648A1 (en) * | 2015-08-05 | 2017-02-09 | Orange | Method and device for identifying visited and home authentication servers |
| CN106603462A (en) * | 2015-10-13 | 2017-04-26 | 腾讯科技（深圳）有限公司 | API calling method, device and system |
| CN106856475A (en) * | 2015-12-08 | 2017-06-16 | 佳能株式会社 | Authorization server and certification cooperative system |
| CN106936779A (en) * | 2015-12-29 | 2017-07-07 | 北京网御星云信息技术有限公司 | A kind of data connecting method, system and device |
| CN107070945A (en) * | 2013-06-19 | 2017-08-18 | 华为技术有限公司 | Identity logs method and apparatus |
| CN107124433A (en) * | 2017-07-04 | 2017-09-01 | 中国联合网络通信集团有限公司 | Internet of things system, internet of things equipment access method, access authorization methods and equipment |
| CN107276963A (en) * | 2016-04-06 | 2017-10-20 | 泰康之家（北京）投资有限公司 | A kind of method and device of renewal authority |
| CN107273189A (en) * | 2016-04-06 | 2017-10-20 | 泰康之家（北京）投资有限公司 | A kind of method for managing subapplication and application carry platform |
| CN107545431A (en) * | 2016-06-27 | 2018-01-05 | 李明 | Transaction authorisation method and system and method for commerce and system |
| CN107590662A (en) * | 2017-11-03 | 2018-01-16 | 中国银行股份有限公司 | A kind of authentication method and certificate server, system for calling internet banking system |
| CN107885985A (en) * | 2017-11-23 | 2018-04-06 | 维沃移动通信有限公司 | A kind of application program account sharing method and terminal |
| CN108463982A (en) * | 2015-11-16 | 2018-08-28 | 万事达卡国际股份有限公司 | Carry out the system and method for certification online user for authorization server safe to use |
| CN108920366A (en) * | 2018-06-28 | 2018-11-30 | 腾讯科技（深圳）有限公司 | One seed application adjustment method, apparatus and system |
| CN109033774A (en) * | 2018-08-31 | 2018-12-18 | 阿里巴巴集团控股有限公司 | Acquisition, the method, apparatus of feedback user resource and electronic equipment |
| CN109150864A (en) * | 2018-08-03 | 2019-01-04 | 中国联合网络通信集团有限公司 | Anti-cheating method and device based on re-authentication |
| CN109347729A (en) * | 2018-12-06 | 2019-02-15 | 维沃移动通信有限公司 | A kind of means of communication and terminal |
| CN109472547A (en) * | 2018-10-16 | 2019-03-15 | 平安万家医疗投资管理有限责任公司 | A kind of run-length managment method, run-length management managing device and server |
| CN109511115A (en) * | 2017-09-14 | 2019-03-22 | 华为技术有限公司 | A kind of authorization method and network element |
| CN109587364A (en) * | 2017-09-29 | 2019-04-05 | 中国移动通信集团公司 | Handle method, server and the equipment of data on flows red packet |
| CN110224971A (en) * | 2018-03-02 | 2019-09-10 | 阿里巴巴集团控股有限公司 | Authorize method, authorization server, system, equipment and the storage medium logged in |
| CN110245474A (en) * | 2019-04-19 | 2019-09-17 | 阿里巴巴集团控股有限公司 | A kind of processing method and system for publicly-owned account |
| CN110334153A (en) * | 2019-06-28 | 2019-10-15 | 阿里巴巴集团控股有限公司 | Authorization method, system, device and equipment in block chain type account book |
| CN111031332A (en) * | 2019-11-26 | 2020-04-17 | 北京达佳互联信息技术有限公司 | Data interaction method, device, server and storage medium |
| CN111259363A (en) * | 2020-01-19 | 2020-06-09 | 数字广东网络建设有限公司 | Service access information processing method, system, device, equipment and storage medium |
| CN113746857A (en) * | 2021-09-09 | 2021-12-03 | 深圳市腾讯网域计算机网络有限公司 | Login method, device, equipment and computer readable storage medium |
| US11218314B2 (en) | 2017-09-28 | 2022-01-04 | Huawei Technologies Co., Ltd. | Network function service invocation method, apparatus, and system |
| CN114448720A (en) * | 2022-03-09 | 2022-05-06 | 北京京东振世信息技术有限公司 | Account registration method and device |
| CN114793179A (en) * | 2022-05-09 | 2022-07-26 | 北京明略昭辉科技有限公司 | Method and system for tenant access, server and storage medium |
| US12093419B2 (en) | 2018-09-03 | 2024-09-17 | VeChain Global Technology, S.AR.L | Methods and devices for managing user identity authentication data |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1459068A (en) * | 2000-08-17 | 2003-11-26 | 丹尼尔·A·克恩 | Automated payment system |
| CN101562621A (en) * | 2009-05-25 | 2009-10-21 | 阿里巴巴集团控股有限公司 | User authorization method and system and device thereof |
-
2012
- 2012-05-04 CN CN201210137848.XA patent/CN102638473B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1459068A (en) * | 2000-08-17 | 2003-11-26 | 丹尼尔·A·克恩 | Automated payment system |
| CN101562621A (en) * | 2009-05-25 | 2009-10-21 | 阿里巴巴集团控股有限公司 | User authorization method and system and device thereof |
Cited By (71)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014086111A1 (en) * | 2012-12-03 | 2014-06-12 | 鹤山世达光电科技有限公司 | Fingerprint authentication based information management system and information management method |
| CN107070945A (en) * | 2013-06-19 | 2017-08-18 | 华为技术有限公司 | Identity logs method and apparatus |
| WO2014206199A1 (en) * | 2013-06-25 | 2014-12-31 | 华为技术有限公司 | Account login method, equipment and system |
| US10021098B2 (en) | 2013-06-25 | 2018-07-10 | Huawei Technologies Co., Ltd. | Account login method, device, and system |
| CN103490898B (en) * | 2013-09-22 | 2017-01-18 | 新浪网技术(中国)有限公司 | E-mail collection authorization method, device and system |
| CN103490898A (en) * | 2013-09-22 | 2014-01-01 | 新浪网技术(中国)有限公司 | E-mail collection authorization method, device and system |
| CN104869102A (en) * | 2014-02-24 | 2015-08-26 | 腾讯科技（北京）有限公司 | Authorization method, device and system based on xAuth protocols |
| CN104869102B (en) * | 2014-02-24 | 2019-04-02 | 腾讯科技（北京）有限公司 | Authorization method, device and system based on xAuth agreement |
| CN103888451A (en) * | 2014-03-10 | 2014-06-25 | 百度在线网络技术（北京）有限公司 | Method, device and system for certification authorization |
| CN103888451B (en) * | 2014-03-10 | 2017-09-26 | 百度在线网络技术（北京）有限公司 | Authorization method, the apparatus and system of certification |
| CN105306498B (en) * | 2014-06-12 | 2019-04-16 | 中国电信股份有限公司 | Method, system and the cloud platform of user's access third-party application |
| CN105306498A (en) * | 2014-06-12 | 2016-02-03 | 中国电信股份有限公司 | Method and system of user for accessing third party application and cloud platform |
| CN105516069A (en) * | 2014-09-28 | 2016-04-20 | 腾讯科技（深圳）有限公司 | Data processing method, data processing device, and data processing system |
| WO2016058522A1 (en) * | 2014-10-13 | 2016-04-21 | Alibaba Group Holding Limited | Method and apparatus for controlling data permissions |
| US9866565B2 (en) | 2014-10-13 | 2018-01-09 | Alibaba Group Holding Limited | Method and apparatus for controlling data permissions |
| CN105488366A (en) * | 2014-10-13 | 2016-04-13 | 阿里巴巴集团控股有限公司 | Data permission control method and system |
| CN104320265A (en) * | 2014-11-21 | 2015-01-28 | 北京奇虎科技有限公司 | Authentication method and device for software platform |
| CN104320265B (en) * | 2014-11-21 | 2017-10-24 | 北京奇虎科技有限公司 | Authentication method and authentication device for software platform |
| CN105704108A (en) * | 2014-11-28 | 2016-06-22 | 中国电信股份有限公司 | Method for safety certification, ability opening platform and system |
| CN105704108B (en) * | 2014-11-28 | 2019-02-12 | 中国电信股份有限公司 | For the method for safety certification, ability open platform and system |
| CN104468635A (en) * | 2014-12-31 | 2015-03-25 | 广州东海网络科技有限公司 | Upgrading authentication method and system for user permission in network platform |
| CN104468635B (en) * | 2014-12-31 | 2018-01-26 | 广州东海网络科技有限公司 | The user right step-up authentication method and system of the network platform |
| CN104702415B (en) * | 2015-03-31 | 2018-12-14 | 北京奇艺世纪科技有限公司 | account authority control method and device |
| CN104702415A (en) * | 2015-03-31 | 2015-06-10 | 北京奇艺世纪科技有限公司 | Account number permission control method and device |
| CN106168899B (en) * | 2015-05-19 | 2021-07-27 | 罗伯特·博世有限公司 | Method for updating embedded control equipment and updating gateway |
| CN106168899A (en) * | 2015-05-19 | 2016-11-30 | 罗伯特·博世有限公司 | For updating method and the more new gateway of embedded Control equipment |
| US10856145B2 (en) | 2015-08-05 | 2020-12-01 | Orange | Method and device for identifying visited and home authentication servers |
| FR3039954A1 (en) * | 2015-08-05 | 2017-02-10 | Orange | METHOD AND DEVICE FOR IDENTIFYING VISIT AND HOME AUTHENTICATION SERVERS |
| WO2017021648A1 (en) * | 2015-08-05 | 2017-02-09 | Orange | Method and device for identifying visited and home authentication servers |
| CN105187417A (en) * | 2015-08-25 | 2015-12-23 | 北京京东尚科信息技术有限公司 | Authority obtaining method and device |
| CN106603462A (en) * | 2015-10-13 | 2017-04-26 | 腾讯科技（深圳）有限公司 | API calling method, device and system |
| CN108463982A (en) * | 2015-11-16 | 2018-08-28 | 万事达卡国际股份有限公司 | Carry out the system and method for certification online user for authorization server safe to use |
| CN108463982B (en) * | 2015-11-16 | 2021-11-02 | 万事达卡国际股份有限公司 | System and method for authenticating online users using a secure authorization server |
| CN105391725A (en) * | 2015-11-27 | 2016-03-09 | 深圳市摩艾客科技股份有限公司 | Real person 3D data reading module and data transmission method thereof |
| CN106856475A (en) * | 2015-12-08 | 2017-06-16 | 佳能株式会社 | Authorization server and certification cooperative system |
| CN106856475B (en) * | 2015-12-08 | 2020-11-10 | 佳能株式会社 | Authorization server and authentication collaboration system |
| CN106936779A (en) * | 2015-12-29 | 2017-07-07 | 北京网御星云信息技术有限公司 | A kind of data connecting method, system and device |
| CN107276963B (en) * | 2016-04-06 | 2021-09-03 | 泰康之家（北京）投资有限公司 | Method and device for updating authority |
| CN107273189A (en) * | 2016-04-06 | 2017-10-20 | 泰康之家（北京）投资有限公司 | A kind of method for managing subapplication and application carry platform |
| CN107276963A (en) * | 2016-04-06 | 2017-10-20 | 泰康之家（北京）投资有限公司 | A kind of method and device of renewal authority |
| CN107545431A (en) * | 2016-06-27 | 2018-01-05 | 李明 | Transaction authorisation method and system and method for commerce and system |
| CN107124433B (en) * | 2017-07-04 | 2019-08-06 | 中国联合网络通信集团有限公司 | Internet of things system, internet of things equipment access method, access authorization methods and equipment |
| CN107124433A (en) * | 2017-07-04 | 2017-09-01 | 中国联合网络通信集团有限公司 | Internet of things system, internet of things equipment access method, access authorization methods and equipment |
| CN109511115B (en) * | 2017-09-14 | 2020-09-29 | 华为技术有限公司 | Authorization method and network element |
| US11431695B2 (en) | 2017-09-14 | 2022-08-30 | Huawei Technologies Co., Ltd. | Authorization method and network element |
| CN109511115A (en) * | 2017-09-14 | 2019-03-22 | 华为技术有限公司 | A kind of authorization method and network element |
| US11218314B2 (en) | 2017-09-28 | 2022-01-04 | Huawei Technologies Co., Ltd. | Network function service invocation method, apparatus, and system |
| US11956361B2 (en) | 2017-09-28 | 2024-04-09 | Huawei Technologies Co., Ltd. | Network function service invocation method, apparatus, and system |
| CN109587364A (en) * | 2017-09-29 | 2019-04-05 | 中国移动通信集团公司 | Handle method, server and the equipment of data on flows red packet |
| CN107590662A (en) * | 2017-11-03 | 2018-01-16 | 中国银行股份有限公司 | A kind of authentication method and certificate server, system for calling internet banking system |
| CN107885985A (en) * | 2017-11-23 | 2018-04-06 | 维沃移动通信有限公司 | A kind of application program account sharing method and terminal |
| CN110224971B (en) * | 2018-03-02 | 2022-05-27 | 阿里巴巴集团控股有限公司 | Method, authorization server, system, device and storage medium for authorizing login |
| CN110224971A (en) * | 2018-03-02 | 2019-09-10 | 阿里巴巴集团控股有限公司 | Authorize method, authorization server, system, equipment and the storage medium logged in |
| CN108920366B (en) * | 2018-06-28 | 2020-09-29 | 腾讯科技（深圳）有限公司 | Sub-application debugging method, device and system |
| CN108920366A (en) * | 2018-06-28 | 2018-11-30 | 腾讯科技（深圳）有限公司 | One seed application adjustment method, apparatus and system |
| CN109150864A (en) * | 2018-08-03 | 2019-01-04 | 中国联合网络通信集团有限公司 | Anti-cheating method and device based on re-authentication |
| CN109150864B (en) * | 2018-08-03 | 2021-07-20 | 中国联合网络通信集团有限公司 | Anti-cheating method and device based on secondary authentication |
| CN109033774B (en) * | 2018-08-31 | 2020-08-07 | 阿里巴巴集团控股有限公司 | Method and device for acquiring and feeding back user resources and electronic equipment |
| CN109033774A (en) * | 2018-08-31 | 2018-12-18 | 阿里巴巴集团控股有限公司 | Acquisition, the method, apparatus of feedback user resource and electronic equipment |
| US12093419B2 (en) | 2018-09-03 | 2024-09-17 | VeChain Global Technology, S.AR.L | Methods and devices for managing user identity authentication data |
| CN109472547A (en) * | 2018-10-16 | 2019-03-15 | 平安万家医疗投资管理有限责任公司 | A kind of run-length managment method, run-length management managing device and server |
| CN109347729A (en) * | 2018-12-06 | 2019-02-15 | 维沃移动通信有限公司 | A kind of means of communication and terminal |
| CN110245474A (en) * | 2019-04-19 | 2019-09-17 | 阿里巴巴集团控股有限公司 | A kind of processing method and system for publicly-owned account |
| CN110334153A (en) * | 2019-06-28 | 2019-10-15 | 阿里巴巴集团控股有限公司 | Authorization method, system, device and equipment in block chain type account book |
| CN111031332B (en) * | 2019-11-26 | 2021-09-10 | 北京达佳互联信息技术有限公司 | Data interaction method, device, server and storage medium |
| CN111031332A (en) * | 2019-11-26 | 2020-04-17 | 北京达佳互联信息技术有限公司 | Data interaction method, device, server and storage medium |
| CN111259363A (en) * | 2020-01-19 | 2020-06-09 | 数字广东网络建设有限公司 | Service access information processing method, system, device, equipment and storage medium |
| CN113746857A (en) * | 2021-09-09 | 2021-12-03 | 深圳市腾讯网域计算机网络有限公司 | Login method, device, equipment and computer readable storage medium |
| CN114448720A (en) * | 2022-03-09 | 2022-05-06 | 北京京东振世信息技术有限公司 | Account registration method and device |
| CN114793179A (en) * | 2022-05-09 | 2022-07-26 | 北京明略昭辉科技有限公司 | Method and system for tenant access, server and storage medium |
| CN114793179B (en) * | 2022-05-09 | 2024-07-02 | 北京明略昭辉科技有限公司 | Method and system for tenant access, server and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102638473B (en) | 2014-12-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102638473B (en) | User data authorization method, device and system | |
| KR101195651B1 (en) | System and method for authenticating remote server access | |
| CN101075875B (en) | Method and system for realizing monopoint login between gate and system | |
| CN1852094B (en) | Method and system for protecting account of network business user | |
| CN102811228B (en) | Network login method, equipment and system | |
| CN106779716B (en) | Authentication method, device and system based on block chain account address | |
| CN106375270B (en) | Token generation and authentication method and authentication server | |
| CN101217367B (en) | An operation right judgment system and method realized by introducing right judgment client end | |
| US20210168611A1 (en) | Method for securely sharing a url | |
| CN101087193A (en) | New method for using the mobile number bond with account for identity identification | |
| CN107295011A (en) | The safety certifying method and device of webpage | |
| CN102868702B (en) | System login device and system login method | |
| CN103051647B (en) | Method, equipment and system that a kind of session realizes | |
| CN104967597A (en) | Third-party application message authentication method and system based on secure channel | |
| CN104796436A (en) | User login method and system, first platform server and related platform server | |
| CN104618356B (en) | Auth method and device | |
| CN104837134B (en) | A kind of web authentication user login method, equipment and system | |
| CN105354482A (en) | Single sign-on method and device | |
| CN106453321A (en) | Authentication server, system and method, and to-be-authenticated terminal | |
| CN102143131A (en) | User logout method and authentication server | |
| CN104753872A (en) | Authentication method, authentication platform, service platform, network elements and system | |
| HUE029848T2 (en) | Method and equipment for establishing secure connection on a communication network | |
| CN103428161A (en) | Phone authentication service system | |
| CN105187417B (en) | Authority acquiring method and apparatus | |
| CN104113511B (en) | A kind of method, system and relevant apparatus for accessing IMS network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |