WO2013071836A1

WO2013071836A1 - Method and apparatus for processing client application access authentication

Info

Publication number: WO2013071836A1
Application number: PCT/CN2012/084290
Authority: WO
Inventors: 陈耿华
Original assignee: 华为技术有限公司
Priority date: 2011-11-18
Filing date: 2012-11-08
Publication date: 2013-05-23
Also published as: CN103124252A; CN103124252B

Abstract

Disclosed are a method and apparatus for processing client application access authentication, an apparatus for processing client application service and a client application device, the method comprising: receiving a first authorization request message transmitted by the client application device for requesting the authorization of a specific user or a third party to use the client application service; transmitting a second authorization request message to the user device of the specific user or the third party device, wherein the second authorization request message is used for requesting the authorization of the specific user or the third party to use the client application service; receiving an authorization result returned by the user device of the specific user or the third party device, and according to the authorization result, determining whether the client application device is permitted to provide the client application service to the specific user. The technical solution of the present invention can improve the safety of providing services for a destination user by SP using the telecommunication network capacity of an operator.

Description

Client application access authentication processing method and device

The embodiments of the present invention relate to the field of communications technologies, and in particular, to a client application access authentication processing method and apparatus. Background technique

With the advent of the mobile Internet era, the Internet and telecommunications networks are increasingly integrated. On the Internet and user terminals, more and more colorful Internet applications and terminal applications have emerged, such as Web applications, terminal Widget applications, and native terminal applications. These applications typically require access to the carrier's telecommunications network capabilities to achieve specific business functions. For example, a Widget application for traffic information queries needs to be able to send MMS messages carrying traffic maps to a terminal handset user. Therefore, operators need a secure, open, and controllable means to allow client applications to access the carrier's telecommunications network capabilities.

In the prior art, the opening of the operator's telecommunication network capability is mainly for a service application server of a trusted service provider (Service Provider, hereinafter referred to as SP), and various Internet applications and terminal applications of the SP provide services for users. The ability to access the carrier network mainly includes the following processes: The service application server of the SP sends an access request to the operator's network operation platform, requesting to invoke the operator's telecommunication network capability, for example, the SP web application server may request to invoke the telecommunication network capability. Send a mobile phone report in the form of a multimedia message. The access request sent by the service application server of the SP carries the identity and password of the SP and the mobile phone number of the target user. After the operator's network operation platform authenticates the SP, it will be based on the requirements of the SP service application server. The telecommunications network capability is utilized to provide the target user with the service required by the SP, and further to charge the service provided to the target user.

In the prior art, the SP uses the operator's telecommunication network capability to provide services to the target user with poor security, and is easily used by the SP to provide some illegal services. Summary of the invention The embodiment of the invention provides a client application access authentication processing method and device, and a client application service processing device and a client application device, which are used to improve the scheme security of the SP using the operator's telecommunication network capability to provide services to the target user. Sex.

The embodiment of the present invention provides a client application access authentication processing method, including: receiving a first authorization request message sent by a client application device for requesting a specific user or a third party to authorize the use of the client application service;

Sending a second authorization request message to the user equipment or the third-party device of the specific user, where the second authorization request message is used to request the specific user or a third party to authorize the use of the client application service;

Receiving an authorization result returned by the user equipment or the third party device of the specific user, determining, according to the authorization result, whether the client application device is allowed to provide the client application service to the specific user.

The embodiment of the present invention further provides a client application access authentication processing device, including: a first receiving module, configured to receive, by a client application device, a request for requesting a specific user or a third party to authorize the use of the client application service An authorization request message;

a first sending module, configured to send a second authorization request message to the user equipment or the third-party device of the specific user, where the second authorization request message is used to request the specific user or a third party to authorize use of the client application Business

And a service authorization module, configured to receive an authorization result returned by the user equipment or the third-party device of the specific user, and determine, according to the authorization result, whether the client application device is allowed to provide the client application service to the specific user.

The embodiment of the present invention further provides a client application service processing apparatus, including the client application access authentication processing device and the telecommunication network open gateway module, where the telecommunication network open gateway module is configured to receive the client application device. After sending the call request message carrying the access password, sending an authentication authentication request message requesting authentication to the access password to the client application access authentication processing device, and calling the telecommunication network capability for the client application device after the authentication is passed .

The embodiment of the present invention further provides a client application device, including a telecommunication network access authentication processing module and a telecommunication network service calling module, where the telecommunication network access authentication processing module is configured to send to a telecommunication operator's network system for Request a specific user authorization or a third party to use the client application a first authorization request message of the service, when the specific user accepts the client application service, acquiring an access password that allows the calling telecommunication network to provide the client application service to the specific user; the telecommunication network service calling module is used to And sending, by the network system of the telecommunication operator, an invocation request message carrying the access password, where the invocation request message is used to request to invoke the telecommunication network capability to provide the client application service for the specific user.

According to the above technical solution of the present invention, if the client application device of the SP is to provide the client application service to the user, the first authorization request message is first sent, and then the client application set in the network system of the telecommunication operator accesses the authentication. Processing device processing, by sending a second authorization request message to a user equipment or a third party device of a specific user, asking whether the specific user or the third party authorizes use of the client application service, and then according to the user equipment or the third party device of the specific user The returned authorization result determines whether the client application device is allowed to provide the client application service to the specific user, so that the client application service provided by the client application device for the specific user is authorized by the specific user or a third party. , improve the SP to provide users with the security of the client application business. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a schematic flowchart of Embodiment 1 of a client application access authentication processing method according to the present invention; FIG. 2 is a schematic flowchart of a second embodiment of a client application access authentication processing method according to the present invention; FIG. 4 is a schematic structural diagram of Embodiment 1 of a client application access authentication processing apparatus according to the present invention; FIG. 5 is a schematic structural diagram of Embodiment 2 of a client application access authentication processing apparatus according to the present invention; FIG. 6 is a schematic structural diagram of an embodiment of a client application service processing apparatus according to the present invention; FIG. 7 is a schematic structural diagram of an embodiment of a client application apparatus according to the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is apparent that the described embodiments are a part of the embodiments of the invention, rather than all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The present invention provides a solution for increasing the client application access in the network system of the telecommunication operator by using the problem that the security of the SP is used to provide services to the user. The implementation of the authentication processing device is as follows: FIG. 1 is a schematic flowchart of Embodiment 1 of a client application access authentication processing method, and as shown in FIG. 1 , the following steps are included:

Step 101: Receive a first authorization request message sent by the client application device for requesting a specific user or a third party to authorize the use of the client application service.

Step 102: Send a second authorization request message to the user equipment or the third-party device of the specific user, where the second authorization request message is used to request the specific user or a third party to authorize use of the client application service.

Step 103: Receive an authorization result returned by the user equipment or the third-party device of the specific user, and determine, according to the authorization result, whether the client application device is allowed to provide the client application service to the specific user.

In the foregoing embodiment of the present invention, if the client application device of the SP is to provide the client application service to the client user, the first authorization request message is first sent, and then accessed by the client application set in the network system of the service provider. The authentication processing device processes, by sending a second authorization request message to the user equipment or the third party device of the specific user, asking whether the specific user or the third party authorizes the use of the client application service, and then according to the user equipment or the specific user of the specific user The authorization result returned by the three-party device determines whether the client application device is allowed to provide the client application service to the specific user, so that the client application service provided by the client application device for the specific user is the specific user or the third party. Authorized, improve the SP to provide users with the security of the client application business.

The second authorization request message in the foregoing embodiment of the present invention may be sent to the user equipment held by the specific user, to confirm whether the client application service is accepted by the specific user, or may be sent to the third party device by the third party. It is confirmed that, for example, the third-party device mentioned above may be a device held by a manager of a specific user, and the manager of the specific user confirms whether the specific user accepts the client. The application service is used, or the server of the operator is used as a third-party device, and the operator determines whether the specific user accepts the client application service.

In the above embodiment of the present invention, the operator can determine whether to provide the client application service according to the will of the specific user or the third party, that is, whether to allow the client application device to access the telecommunication network capability, and the corresponding application can be set in the client application device. The telecommunication network access authentication processing device performs corresponding processing. In a specific implementation process, the client application device can be controlled to access the telecommunication network by assigning an access password to the client application device, which may specifically include two types. Implementation.

One is to send the first to the client application access authentication processing device in the network system of the telecommunication operator before the first authorization request message sent by the client application device for requesting the specific user to authorize the use of the client application service. The password application message, after receiving the first password application message sent by the client application device, the client application access authentication processing device returns the first access password assigned to the client application device. The first access password described above can be regarded as a temporary password, which does not take effect. The client application device cannot access the operator's telecommunications network capability according to the temporary password. The nature of the first access password described above may be changed in the local system only when the user equipment or the third party device of the specific user returns the authorization result, and the authorization result accepts the client application service for the specific user. And being an official password, to authorize the client application device to access the telecommunication network capability by using the first access password, and provide the client application service to the specific user. The client application device can perform the client application service by using the first access password. Specifically, the client application device sends a service request message carrying the first access password to the first service processing module in the network system of the telecommunication operator. The first service processing module receives the service request message, and when the first access password is confirmed to be available, allows the client application device to access the telecommunication network capability, and provides the client application service to the specific user, where the specific service can be sent to the telecommunication. The client application access authentication processing device in the operator's network system confirms whether the first access password is available.

In another embodiment, the difference from the foregoing embodiment is that the client application access authentication processing device of the operator does not change the first access when the authorization result is that the specific user accepts the client application service. a nature of the password, but generating a verification code corresponding to the first access password, and transmitting the verification code to the client application device, receiving the client And sending, by the application device, the second password request message carrying the first access password and the verification code, returning a second access password to the client application device, where the second access password is an official password, to authorize the client The application device accesses the telecommunications network capability by using the second access password to provide the client application service to the specific user.

Specifically, when the second access password is used, the client application device sends a service request message carrying the second access password to the second service processing module in the network system of the telecommunication operator, where the second service process receives the service request message, And when the second access password is confirmed to be available, the client application device is allowed to access the telecommunication network capability, and the client application service is provided to the specific user, and the client application in the network system of the telecommunication operator can be specifically The access authentication processing device confirms whether the second access password is available.

In the foregoing embodiment of the present invention, after receiving the authorization result returned by the user equipment or the third-party device of the specific user, and confirming that the authorization result is that the specific user accepts the client application service, the method may further The specific user performs identity authentication, and returns an authorization result to the client application device after the authentication is passed. Specifically, the embodiment that uses the second access password may be a verification code corresponding to the first access password. And sending the verification code to the client application device in the authorization result.

2 is a schematic flowchart of Embodiment 2 of a method for processing access authentication of a client application according to the present invention. As shown in FIG. 2, the method includes the following steps:

Step 201: The telecommunication network access authentication processing device of the client application device applies for a temporary password to the client application access authentication processing device in the network system of the telecommunication operator before accessing the telecommunication network capability of the operator, that is, sends the first The client application device in the embodiment of the present invention may be classified into a mobile terminal client, such as a mobile phone, a PDA, or a computer client, according to the terminal type; according to the client application development language, Widge application client, JAVA application client, Brew application client, Web client, etc. The telecommunication network access authentication processing device is a function module specially set for the authentication of the telecommunication network, which is set internally by the client application device;

Step 202: The client application access authentication processing device of the operator network system returns the first access password assigned to the telecommunication network access authentication processing device after the authentication of the client application device is passed, the first access password. As a temporary password, it does not take effect, that is, the client application The device cannot directly access the telecommunications network using the first access password;

Step 203: The telecommunication network access authentication processing device sends a first authorization request message to the client application access authentication processing device, requesting a specific user or a third party to authorize the use of the client application service. Step 204: The client application access authentication processing device Sending a second authorization request message to the user equipment or the third-party device of the specific user, where the second authorization request message is used to request the specific user or the third-party device to authorize the use of the client application service. Specifically, the request mode may be According to the Web method, the Wireless Application Protocol (hereinafter referred to as WAP), the Unstructured Supplementary Service Data (hereinafter referred to as USSD), and the Interactive Voice Response (hereinafter) Abbreviation: IVR) or short message mode sends a second authorization request message to the user equipment of the specific user. Optionally, the second authorization request message may include telecommunication network capability information corresponding to the client application service, tariff information using the telecommunication network capability, and a term type authorized to use the client application service, for example, authorizing a single use. The client application service, authorizing the use of the client application service multiple times, authorizing the use of the client application service or authorizing the client application service within a set time period before a set period;

Step 205: A specific user or a third party performs an authorization operation, and returns an authorization result to the client application access authentication processing device. For different request methods, the user may submit the identity authentication information and authorize in different manners, for example, for a web or WAP page. The user can submit the personal user name and password on the web or WAP page, and confirm the agreement to use the client application service on the page; for the short message request mode, the user can confirm the reply to the short message to the service provider's network. The client application access authentication processing device in the system returns the authorization result;

Step 206: The client application access authentication processing device identifies the authorization result returned by the user equipment of the specific user or the third party device, and performs identity authentication on the specific user when the specific user accepts the client application service;

Step 207: After the identity authentication of the specific user is passed, the client application access authentication processing device returns the authorization result to the telecommunication network access authentication processing device, and at the same time, the property of the first access password returned in step 202 is modified to an official password. So that the client application device can access the telecommunications network to provide services for a specific user;

Step 208: The client application device initiates a call request message by using the first access password, specifically The telecom network service invoking module of the client application device may send a call request message to the telecommunication network open gateway module in the telecommunication operator's network system, invoke the telecommunication network capability, and access the operator's telecommunication network;

Step 209: After receiving the call request message, the telecommunication network open gateway module obtains the first access password carried in the call request message, and sends an authentication authentication request message to the client application access authentication processing device. Further, For the first access password, after receiving the authorization result of the specific user, the property is converted into an official password, and each of the first access passwords corresponds to a specific user, and therefore, the first access password is only allowed. Providing a service to a specific user, in the call request message in step 208, the user identifier may further be carried, for example, the user uses the SIM card number of the mobile phone, and the user identifier is further authenticated in this step to determine whether it is related to the first user. Corresponding to an access password, to prevent the client application device from using the first access password to provide services for other users;

Step 210: The client application access authentication processing device authenticates the legality and validity period of the user identifier and the first access password.

Step 211: The client application access authentication processing device returns an authentication authentication result to the telecommunication network open gateway module.

Step 212: After the authentication is passed, the telecommunications network open gateway module invokes the telecommunications network capability, and returns the call result to the client application device to provide services for the specific user.

In the foregoing embodiment of the present invention, in step 206, after the specific user accepts the client application service, the identity of the user of the specific user is authenticated. In an actual application, the step is an optional step, and the foregoing identity may not be performed. The authentication process may be performed before the second authorization request message is sent to the user equipment or the third party device of the specific user in the foregoing step 204, and after the identity authentication is passed, the user equipment or the user is executed to the specific user. The step of the third party device sending the second authorization request message. In the foregoing embodiment of the present invention, the client application access authentication processing device may be disposed in each gateway device of the operator network system, and the specific setting position thereof does not affect the implementation of the technical solution of the present invention. In this embodiment, before the telecommunications network capability is invoked, and the client application service is provided for a specific user, the authorization is first requested to a specific user or a third party, and after the authorization is provided, the client application service is provided, which can improve the SP to provide services for the user. safety.

The embodiment shown in FIG. 2 above is an embodiment corresponding to only assigning the first access password, and FIG. 3 is A schematic flowchart of the third embodiment of the client application access authentication processing method of the present invention, in which the client application access authentication processing device further allocates the second access password as an official password, as shown in the figure.

As shown in 3, it includes the following steps:

Steps 301 to 306 complete substantially the same functions as steps 201 to 206 in the above embodiment.

Step 307: After the identity authentication of the specific user is passed, generate a verification code corresponding to the first access password.

Step 308: Return an authorization result to the telecommunication network access authentication processing device, where the authorization result carries the verification code;

Step 309: The telecommunication network access authentication processing device sends a second password application message carrying the first access password and the verification code to the client application access authentication processing device of the operator. Step 310: Client application access authentication The right processing device allocates a second access password, where the second access password is an official password, and is used to authorize the client application device to access the telecommunication network capability by using the second access password, and provide the client application service to the specific user. ;

Step 311: The client application access authentication processing device returns a second access password to the telecommunication network access authentication processing device.

Steps 312 to 316 perform substantially the same functions as steps 208 to 212 of the above embodiment, except that the telecommunication network access authentication processing device initiates the call request message by using the second access password.

In this embodiment, the first access password and the second access password are respectively allocated to the client application device, and finally the client application device invokes the power network capability according to the second access password to provide the client application service for the specific user, which can improve The SP provides users with the security of the customer single application service.

The embodiment of the present invention further provides a client application access authentication processing device, and FIG. 4 is a schematic structural diagram of Embodiment 1 of a client application access authentication processing device according to the present invention. As shown in FIG. 4, the client application access authentication The right processing device 40 includes a first receiving module 11, a first sending module 12, and a service authorization module 13, wherein the first receiving module 11 is configured to receive, by the client application device, a request for a specific user or a third party to authorize the use of the client application. The first authorization request message of the service; the first sending module 12 is configured to send the second authorization to the user equipment or the third party device of the specific user. And the second authorization request message is used to request the specific user or a third party to authorize the use of the client application service; the service authorization module 13 is configured to receive the authorization returned by the user equipment or the third party device of the specific user. As a result, determining, according to the authorization result, whether the client application device is allowed to provide the client application service to the specific user.

In the embodiment of the present invention, after receiving the first authorization request message, the client application access authentication processing device set in the network system of the telecommunication operator sends a second authorization request message to the user equipment or the third party device of the specific user. Inquiring whether the specific user or the third party authorizes the use of the client application service, and then determining whether to allow the client application device to provide the client application service to the specific user according to the authorization result returned by the user device or the third party device of the specific user. Therefore, the client application service provided by the client application device for the specific user is authorized by the specific user, and the SP is provided to provide security for the user.

It has been described in the foregoing method embodiments that the client application device can be controlled by a password to access a telecommunication network to provide services for a specific user, and specifically may include a case where only one access password is assigned and two access passwords are allocated, corresponding to each other. The method embodiments shown in Figures 2 and 3.

For the embodiment shown in FIG. 2 above, for the case where only the first access password needs to be assigned, as shown in FIG. 5, the client application access authentication processing device 50 further includes a first password assigning module 14, the first password. The allocating module 14 is configured to receive the first password request message sent by the client application device, before receiving the first authorization request message sent by the client application device for requesting the specific user or the third party to authorize the use of the client application service, and The client application device returns the first access password assigned to it; and the service authorization module 13 is specifically configured to authorize the client when the authorization result is that the specific user accepts the client application service. The client application device utilizes the first access password to access the telecommunications network capability to provide the client application service to the particular user.

For the embodiment shown in FIG. 3, the first access password and the second access password need to be allocated, and the first password assigning module 14 is further configured to allocate the first access password to the client application device, and the service therein The authorization module 13 is specifically configured to: when the authorization result is that the specific user accepts the client application service, generate a risk code corresponding to the first access password, and send the verification code to the client application The device, after receiving the second password application message sent by the client application device and carrying the first access password and the verification code, applying the device to the client Returning a second access password to authorize the client application device to access the telecommunications network capability by using the second access password to provide the client application service to the specific user.

In addition, in the embodiment of the present invention, the identity of the specific user may be further authenticated, that is, the user identity authentication module 15 is configured in the client application access authentication processing device, and the user identity authentication module 15 is configured to receive the After the authorization result returned by the user equipment or the third-party device of the specific user, and the authorization result is that the specific user accepts the client application service, the specific user is authenticated and sent to the client after the authentication is passed. The end application device returns an authorization result, and if the verification code corresponding to the first access password is generated, the verification code is carried in the authorization result and sent to the client application device.

Further, the embodiment of the present invention further provides a client application service processing apparatus, and FIG. 6 is a schematic structural diagram of an embodiment of a client application service processing apparatus according to the present invention. As shown in FIG. 6, the client application service processing apparatus 60 includes The client application access authentication processing device 21 and the telecommunication network open gateway module 22, wherein the client application access authentication processing device 21 can use the client application provided by any of the above embodiments to access the authentication processing device, and the telecommunication network is open. The gateway module 22 is configured to send, after receiving the call request message carrying the access password sent by the client application device, an authentication authentication request message requesting authentication of the access password to the client application access authentication processing device, and After the authentication is passed, the telecommunications network capability is invoked for the client application device.

The embodiment of the present invention further provides a client application device, and FIG. 7 is a schematic structural diagram of an embodiment of a client application device according to the present invention. As shown in FIG. 7, the client application device 70 includes a telecommunication network access authentication processing module 31 and The telecommunication network service invoking module 32 is configured to send, to the network system of the telecommunication operator, a first authorization request message for requesting the specific user to authorize the use of the client application service, where the specific user accepts the When the client application service is described, obtaining an access password that allows the telecommunications network to be invoked to provide the client application service to the specific user; the telecommunication network service invoking module 32 is configured to send the access password to the network system of the telecommunication operator. The request message is invoked, and the call request message is used to request to invoke the telecommunication network capability to provide the client application service for the specific user.

The client application access authentication processing method and device provided by the foregoing embodiment of the present invention, and the client application service processing device and the client application device, wherein before the calling telecommunication network capability provides the client application service to the user, the user is firstly directed to the specific user. Sended by user device or third party device Authorizing the request message, requesting to authorize the specific user to use the client application service, and after the user accepts the client application service, authorizing the client application device to access the telecommunication network capability, and providing the client with the specific user Through the above-mentioned technical solutions, the SP can provide the security for the client to provide the client application service. In addition, the operator may also provide services for the user's consent and perform charging according to the service, which can effectively prevent the third-party application operator's telecommunication network capability from performing charging fraud.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

A client application access authentication processing method, comprising:

Receiving a first authorization request message sent by the client application device for requesting a specific user or a third party to authorize the use of the client application service;

The client application access authentication processing method according to claim 1, wherein the receiving, by the client application device, a first authorization request for requesting a specific user or a third party to authorize the use of the client application service The message also includes:

Receiving a first password request message sent by the client application device, and returning, to the client application device, the first access password assigned to the client application device;

Determining whether to allow the client application device to provide the client application service to the specific user according to the authorization result includes:

When the authorization result is that the specific user accepts the client application service, authorizing the client application device to access the telecommunication network capability by using the first access password, and providing the client application service to the specific user. .

Receiving a first password request message sent by the client application device, and returning the first access password to the client application device;

And when the authorization result is that the specific user accepts the client application service, generating a verification code corresponding to the first access password, and sending the verification code to the client application setting After receiving the second password request message that is sent by the client application device and carrying the first access password and the verification code, returning a second access password to the client application device to authorize the client application. The device accesses the telecommunications network capability by using the second access password to provide the client application service to the specific user.

The client application access authentication processing method according to claim 1, 2 or 3, wherein after receiving the authorization result returned by the user equipment or the third party device of the specific user, and the authorization As a result, when the specific user accepts the client application service, the method further includes:

The specific user is authenticated, and the authorization result is returned to the client application device after the authentication is passed.

The client application access authentication processing method according to claim 2, further comprising:

Receiving a call request message that is sent by the client application device and carrying the first access password, and when confirming that the first access password is available, allowing the client application device to invoke the telecommunication network capability, and providing the client application to the specific user business.

The client application access authentication processing method according to claim 3, further comprising:

Receiving a service request message that is sent by the client application device and carrying the second access password, and when confirming that the second access password is available, allowing the client application device to access the telecommunication network capability, and providing the client application to the specific user business.

The client application access authentication processing method according to claim 1, 2 or 3, wherein the sending the second authorization request message to the user equipment or the third party device of the specific user includes:

The second authorization request message is sent to the user equipment or the third party device of the specific user according to the web mode, the wireless application protocol mode, the unstructured supplementary data service mode, the interactive voice response, or the short message mode.

The client application access authentication processing method according to claim 1, 2 or 3, wherein the second authorization request message includes telecommunication network capability information corresponding to the client application service, and the using the The tariff information of the network capability and the period of authorization to use the client application service Limit type.

The client application access authentication processing method according to claim 8, wherein the term type of the authorization to use the client application service includes:

Authorizing the client application service for a single use, authorizing the client application service to be used multiple times, authorizing the client application service to be used before a set deadline, or authorizing the client to use within a set time range Application business.

A client application access authentication processing device, comprising:

a first receiving module, configured to receive a first authorization request message sent by the client application device for requesting a specific user or a third party to authorize the use of the client application service;

The client application access authentication processing device according to claim 10, further comprising:

a first password allocation module, configured to receive a first password request message sent by the client application device before receiving the first authorization request message sent by the client application device for requesting the specific user or the third party to authorize the use of the client application service Returning to the client application device the first access password assigned thereto;

The service authorization module is specifically configured to: when the authorization result is that the specific user accepts the client application service, authorize the client application device to access the telecommunication network capability by using the first access password, to the specific The user provides the client application service.

The first password distribution module is configured to receive the first password request sent by the client application device before receiving the first authorization request message sent by the client application device for requesting the specific user or the third party to authorize the use of the client application service Message, and returning to the client application device The first access password configured;

The service authorization module is specifically configured to: when the authorization result is that the specific user accepts the client application service, generate a verification code corresponding to the first access password, and send the verification code to the And the client application device returns a second access password to the client application device after receiving the second password request message that is sent by the client application device and carries the first access password and the verification code, to authorize the The client application device accesses the telecommunications network capability by using the second access password to provide the client application service to the specific user.

The client application access authentication processing device according to claim 10, 11 or 12, further comprising:

a user identity authentication module, configured to: after receiving the authorization result returned by the user equipment or the third-party device of the specific user, and the authorization result is that the specific user accepts the client application service, The user performs identity authentication, and returns an authorization result to the client application device after the authentication is passed. If the verification code corresponding to the first access password is generated, the verification code is carried in the authorization result and sent to the user. Describe the client application device.

A client application service processing device, comprising the client application access authentication processing device and the telecommunication network open gateway module according to any one of claims 10-13, wherein the telecommunication network open gateway module is used for After receiving the call request message carrying the access password sent by the client application device, sending an authentication authentication request message requesting authentication to the access password to the client application access authentication processing device, and after the authentication is passed, the client is authenticated. The end application device invokes the telecommunications network capability.

A client application device, comprising: a telecommunication network access authentication processing module and a telecommunication network service invoking module, wherein the telecommunication network access authentication processing module is configured to send a request to a telecommunication operator's network system. The first authorization request message authorized by the specific user or the third party to use the client application service, when the specific user accepts the client application service, acquires an access password that allows the telecommunication network to be invoked, and provides the client application service to the specific user. The telecommunication network service invoking module is configured to send, to the network system of the telecommunication operator, a call request message carrying the access password, where the call request message is used to request to invoke a telecommunication network capability to provide a client application service for the specific user. .