WO2016015436A1 - 平台授权方法、平台服务端、应用客户端及系统和存储介质 - Google Patents
平台授权方法、平台服务端、应用客户端及系统和存储介质 Download PDFInfo
- Publication number
- WO2016015436A1 WO2016015436A1 PCT/CN2014/094200 CN2014094200W WO2016015436A1 WO 2016015436 A1 WO2016015436 A1 WO 2016015436A1 CN 2014094200 W CN2014094200 W CN 2014094200W WO 2016015436 A1 WO2016015436 A1 WO 2016015436A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- verification message
- client
- platform server
- verification
- application
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
Definitions
- the present invention relates to the field of computer communication technologies, and in particular, to a platform authorization method, a platform server, an application client and system, and a non-volatile computer storage medium.
- Open platform refers to an open basic service platform provided by the website and intended for third parties, such as Baidu, Tencent, Ali, Sina Weibo and other open cloud platforms.
- the third-party application clients will support the open authorization interfaces provided by the major platforms to obtain the authorizations for users to authorize the application clients on these platforms.
- the generated access token is authorized, and the OpenAPI (Open Application Programming Interface) provided by each major platform is used to obtain the cloud capability required by the application client and the related data of the user on the corresponding open platform.
- OpenAPI Open Application Programming Interface
- the user needs to log in to the open platform based on the user's existing account before authorizing the application client. Otherwise, the open platform cannot know which user is to authorize the corresponding application client, and in order to ensure security, generally Need application client to provide network view (WebView) or external browsing
- WebView network view
- the device loads the login authorization page provided by the corresponding platform, and the user performs login authorization on the login authorization page, so that the application client cannot directly access sensitive information such as the user's account and password. But such a process experience is very unfriendly in many cases, including:
- the third-party application since the web page is uniformly provided by the open platform, the third-party application generally cannot flexibly customize the style, layout, content, etc. of the page.
- the style of the web page and the application client are The style of the user is very different, making third-party applications difficult to accept, especially in third-party game applications;
- the application client loads the login authorization page through an external browser, the user experience will be drastically reduced. If the application is loaded through the WebView, the third-party application still has the means to obtain sensitive information such as an account and a password input by the user. Its safety is not high enough;
- the embodiments of the present invention provide a platform authorization method, a platform server, an application client and a system, and a non-volatile computer storage medium, so as to improve the mechanism for the application client to obtain the platform server authorization.
- an embodiment of the present invention provides a platform authorization method for a platform server, including:
- the platform server records the mapping relationship between the received first verification message and the client identifier
- the platform server verifies that the first verification message and the second verification message match, extracting the client identifier from the recorded mapping relationship according to the first verification message, and according to the client The identifier generates an authorized access token and is sent to the application client and/or the application server.
- the embodiment of the present invention further provides a platform authorization method for an application client, including:
- the application client sends a first verification message to the platform server through the first path, so that the platform server records the mapping relationship between the first verification message and the client identifier of the application client.
- the application client forwards the second verification message to the platform server by using the second path, so that if the platform server verifies that the first verification message and the second verification message match, according to the first verification message, Extracting the client identifier from the recorded mapping relationship, and generating an authorized access token according to the client identifier, and sending the identifier to the application client and/or the application server;
- the application client receives the authorized access token sent by the platform server.
- the embodiment of the present invention further provides a platform authorization method, including:
- the application client sends the first verification message to the platform server by using the first path;
- the application client forwards the second verification message to the platform server by using the second path;
- the platform server verifies that the first verification message and the second verification message match, extracting the client identifier from the recorded mapping relationship according to the first verification message, and according to the client The identifier generates an authorization access token, and sends the authorization access token to the application client and/or the application server;
- the application client receives the authorized access token sent by the platform server and/or the application server.
- the embodiment of the present invention further provides a platform server, including:
- a first verification message receiving unit configured to receive a first verification message sent by the application client by using the first path, and obtain a client identifier of the application client;
- mapping relationship record unit configured to record a mapping relationship between the received first verification message and the client identifier
- a second verification message receiving unit configured to receive a second verification message that is sent by the application client by using the second path
- a verification and authorization unit configured to: if the first verification message and the second verification message match, verify the client identifier from the recorded mapping relationship according to the first verification message, and according to the The client identifier generates an authorized access token and sends it to the application client and/or the application server.
- an embodiment of the present invention further provides an application client, including:
- a first verification message sending unit configured to send, by using the first path, a first verification message to the platform server, for the mapping between the first verification message and the client identifier of the application client by the platform server Relationship is recorded;
- a second verification message sending unit configured to forward the second verification to the platform server by using the second path And the message is obtained, if the platform server verifies that the first verification message and the second verification message match, extracting the client identifier from the recorded mapping relationship according to the first verification message, and Generating an authorized access token according to the client identifier, and sending the authorization access token to the application client and/or the application server;
- an authorized access token receiving unit configured to receive an authorized access token sent by the platform server.
- the embodiment of the present invention further provides a platform authorization system, including: the platform server provided by any embodiment of the present invention, and the application client provided by any embodiment of the present invention.
- the embodiment of the present invention further provides a non-volatile computer storage medium, where the computer storage medium stores one or more programs, when the one or more programs are executed by the platform server,
- the platform server performs the following operations:
- the platform server verifies that the first verification message and the second verification message match, extracting the client identifier from the recorded mapping relationship according to the first verification message, and according to the client The identifier generates an authorized access token and is sent to the application client and/or the application server.
- an embodiment of the present invention further provides a non-volatile computer storage medium, where the computer storage medium stores one or more programs, when the one or more programs are executed by an application client, The application client performs the following operations:
- the second path Forwarding, by the second path, the second verification message to the platform server, if the platform service If the server verifies that the first verification message and the second verification message match, the client identifier is extracted from the recorded mapping relationship according to the first verification message, and an authorized access is generated according to the client identifier. a token sent to the application client and/or application server;
- the application client sends the first verification message to the platform server through the first path, and the second verification message sent by the second path, if the platform server verifies the first verification If the message is matched with the second verification message, the client identifier is extracted from the recorded mapping relationship, and an authorized access token is generated according to the client identifier, and sent to the application client and/or the application server. No need to log in through the webpage, which enables the user to have no awareness of the authorization process and further enhance the security of the authorization.
- FIG. 1 is a flowchart of a platform authorization method of a platform server according to Embodiment 1 of the present invention
- FIG. 2 is a flowchart of a platform authorization method of a platform server according to Embodiment 2 of the present invention
- FIG. 3 is a flowchart of a platform authorization method of an application client according to Embodiment 3 of the present invention.
- FIG. 4 is a flowchart of a platform authorization method of an application client according to Embodiment 4 of the present invention.
- FIG. 5 is a flowchart of a platform authorization method according to Embodiment 5 of the present invention.
- FIG. 6 is a structural block diagram of a platform server according to Embodiment 6 of the present invention.
- FIG. 7 is a structural block diagram of an application client according to Embodiment 7 of the present invention.
- Embodiment 8 is a platform server and an application client in a platform authorization method according to Embodiment 8 of the present invention; And the interaction diagram of the application server.
- FIG. 1 is a flowchart of a platform authorization method of a platform server provided by the embodiment of the present invention.
- the embodiment is applicable to an application client requesting an OpenAPI to obtain an authorized access token when an OpenAPI is required to be authorized by a terminal user.
- the application client can be an application software installed on the terminal, an instant messaging client, a game entertainment client or a system tool on the terminal, that is, a third-party application.
- the method can be executed by the platform server, and the platform server is a server capable of providing the platform service to the third-party application.
- the platform authorization method of the platform server according to the embodiment includes:
- the platform server receives the first verification message sent by the application client by using the first path, and obtains the terminal identifier of the terminal where the application client is located, where the first verification message includes a random string.
- the first verification message sent by the first path is preferably a first verification message sent to the platform server by calling the system interface provided by the terminal system, for example, the callable message interface is adopted.
- the short message gateway forwards the first verification message.
- the application client generates a random string and creates a verification message containing the random string and the destination address being the platform server.
- Sending, by the application client, the verification short message to the short message gateway, instructing the short message gateway to perform protocol conversion on the verification short message, and generating the The first verification message of the random string is sent to the platform server.
- the short message gateway can extract the terminal identifier of the short message sender from the verification short message, and carry it in the first verification message for sending, and the platform server receives the random character string and the terminal identifier after receiving.
- the platform server records the mapping relationship between the received random string and the terminal identifier.
- the terminal identifier is an identifier for uniquely distinguishing the terminal.
- the platform server receives the first verification message sent by the application client through the first path, it can be used to identify which terminal is the terminal identifier. This includes, but is not limited to, phone numbers and device identification of the terminal.
- the terminal identity is usually used by the user to identify his or her account and can be used to obtain account information.
- the platform server receives a second verification message that is forwarded by the application client by using an application server, where the second verification message includes the random string and identity authentication information.
- each application client or application server also submits authentication information (such as an application key) to the platform server for identity authentication during the registration process.
- authentication information such as an application key
- the mapping relationship between the identity identifier and the identity authentication information is recorded in the database on the platform server for association lookup.
- Each application client or application server needs to send identity authentication information for identity authentication when initiating an access request to the platform server.
- the identity authentication information includes a package name and a package signature.
- the platform server further includes: if the platform The server verifies that the identity authentication information is valid, and triggers a subsequent operation. That is, the platform server first determines the validity of the identity authentication information. If invalid, the application client is denied to obtain the relevant data of the platform side, and the corresponding error information may be returned for prompting. If it is valid, subsequent operations may be allowed.
- the platform will set different permission information for each registered application client to Control data access permissions for each application client. If the platform server determines that the identity authentication information of the application client is valid, the corresponding authority information needs to be read from the database according to the identity authentication information.
- the second verification message may further include a data access permission list that the application client desires to acquire.
- the second verification message may be forwarded by a second path different from the first path.
- the second path may be based on an SSL (Secure Sockets Layer) protocol, and further, the The second path may be based on the HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer) protocol.
- the second verification message sent based on the second path may be an HTTPS request sent based on HTTPS.
- the SOCKET interface replaces the HTTP (Hypertext Transfer Protocol) interface, and performs symmetric or asymmetric encryption on the second verification message to increase the anti-cross-site request forgery attack processing strategy.
- the platform server generates an authorized access token according to the user account information and the identity authentication information, and sends the authorization access token to the application client and/or the application server.
- the platform server may send the generated authorization access token to the application client and/or the application server through the first path or a second path different from the first path, due to a data size problem and a received
- the data usage convenience problem is preferably transmitted through the second path.
- the identity authentication information of the corresponding application server can be found according to the identity authentication information of the application client. Then, the address of the corresponding application server is searched for, or the address of the second path corresponding to the application server is searched according to the information of the sender of the second verification message, and then the authorized access token is sent to the application service through the second path. end.
- the application server may determine whether the access token needs to be saved on the application server according to requirements, and whether The authorized access token is forwarded to the application client to further control the authorization security of the application client.
- the third-party application client can obtain the corresponding cloud capability and user data by using the OpenAPI interface provided by the platform.
- the second verification message further includes the application client expecting data access permission list, and the operation may further include: generating an authorization access order according to the user account information, the identity authentication information, and the expected data access permission list. brand.
- the new user account information is acquired according to the terminal identifier registration. That is, if the account information does not exist, a user account can be automatically registered according to the terminal identifier acquired through the first path.
- the access token may further include permission information that is opened by the platform server for the application client and/or a data access permission list that is expected to be acquired. It should be noted that the embodiment is applicable to an application client requesting to obtain an authorized access token of one or more open platforms.
- the timing at which the application client sends the first verification message through the first path and the second verification message through the application server may be the same, or may be different in sequence, and only needs to satisfy the random string according to the operation in S104.
- Step of extracting the corresponding terminal identifier from the recorded mapping relationship Previously, the operation S102 may be completed, preferably the first verification message and the second verification message are simultaneously sent, or the first verification message is sent earlier than the second verification message.
- the technical solution provided by the embodiment of the present invention receives, by the platform server, a first verification message that is sent by the application client from the first path, including a random string, and receives the random string and the application client forwards through the application server.
- a second verification message of the identity authentication information if the random string in the first verification message and the second verification message are consistent, the corresponding user account information is obtained according to the random character string, and according to the user account information and
- the identity authentication information generates an authorization access token, which is sent to the application client and/or the application server, and does not need to log in through the webpage, so that the user has no perception of the authorization process, and can further improve the security of the authorization.
- Embodiment 2 is a flowchart of a platform authorization method of a platform server provided by Embodiment 2 of the present invention.
- This embodiment is applicable to an application client requesting an OpenAPI to obtain an authorized access token when an OpenAPI is required to be authorized by an end user, where
- the application client can be an application software installed on the terminal, an instant messaging client, a game entertainment client or a system tool on the terminal, that is, a third-party application.
- the method can be executed by the platform server, and the platform server is a server capable of providing the platform service to the third-party application.
- the platform authorization method of the platform server according to the embodiment includes:
- the platform server receives the first verification message sent by the application client by using the first path, and obtains the client identifier of the application client.
- the client identifier is an identifier that can represent the application client, and is used to finally obtain the account information of the user to generate an access token.
- the client identifier may be the user identifier of the user served by the client or the terminal identifier of the terminal where the client is located, as long as it can correspond to the account information of the user.
- obtaining the client identifier of the application client includes, but is not limited to, obtaining a terminal identifier of the terminal where the application client is located, preferably obtaining the And applying the terminal identifier of the terminal where the client is located, and further, the terminal where the application client is located is preferably a mobile phone, and the terminal identifier of the terminal where the application client is located is preferably a mobile phone number.
- the first verification message includes, but is not limited to, a random character string generated by the application client, a signature value, and an encrypted character string, and the like, and is preferably generated information generated by the application client, and is preferably generated in real time. Reduce the possibility of the information being stolen.
- the signature value can be generated by the application client according to the identity authentication information, and the encrypted string can be obtained by the application client's preset encryption algorithm to increase its reliability. Techniques such as random strings, signature values, and encrypted strings can also be combined.
- the platform server records the mapping relationship between the received first verification message and the client identifier.
- the operation is actually to record the association between the information generated by the application client carried in the first verification message and the client identifier.
- the information generated by the application client will be used for subsequent verification.
- the platform server receives the second verification message sent by the application client by using the second path.
- the second verification message is sent through the second path, and the second path and the first path are different paths, but are the interaction paths between the platform server and the application client, for example, the short message path and the HTTP message interaction. Path, forwarding path through other network elements, and so on. Sending verification messages through different paths can reduce the possibility of authentication messages being stolen and improve authentication security.
- the second verification message may be a message sent by the application client directly to the platform server, or may be a message sent by the application client to the platform server indirectly.
- the platform server receives the second verification message directly sent by the application client.
- Manner 2 The platform server receives the second verification message that is forwarded by the application client by using the application server.
- the platform server verifies that the first verification message and the second verification message match, extracting the client identifier from the recorded mapping relationship according to the first verification message, and according to the The client identifier generates an authorized access token and sends it to the application client and/or the application server.
- the matching of the two verification messages can be verified by matching the information carried therein.
- the first verification message includes a random string
- the second verification message also includes the random string if the platform server verifies a random string in the first verification message and the second verification message. Consistent, it is determined that the two verification messages match.
- the client identifier for example, the terminal identifier
- the client identifier may be extracted from the recorded mapping relationship according to the random string, and the corresponding user account information is obtained according to the terminal identifier.
- the platform server may generate an authorized access token according to the user account information and the identity authentication information, and send the authorization access token to the application client and/or the application server.
- the identity authentication information is information required in the process of generating an authorized access token, which may be preferably carried by the verification message, that is, the second verification message preferably includes the random string and identity authentication information.
- the application client sends the first verification message to the platform server through the first path, and the second verification message sent by the second path, if the platform server verifies the first verification If the message is matched with the second verification message, the client identifier is extracted from the recorded mapping relationship, and an authorized access token is generated according to the client identifier, and sent to the application client and/or the application server. No need to log in through the webpage, which enables the user to have no awareness of the authorization process and further enhance the security of the authorization.
- FIG. 3 is a flowchart of a platform authorization method of an application client according to Embodiment 3 of the present invention.
- This embodiment may be applicable to an application client requesting an OpenAPI that requires end user authorization in an open platform.
- the authorization access token is obtained, wherein the application client may be an application software installed on the terminal, an instant messaging client, a game entertainment client or a system tool on the terminal, that is, a third-party application.
- the method may be performed by an application client.
- the platform authorization method of the application client in this embodiment includes:
- the application client sends a first verification message to the platform server by using the first path, where the first verification message includes a random string.
- the first verification message sent by the first path is preferably a first verification message sent to the platform server by using a system interface provided by the calling system, for example, may be forwarded through the SMS gateway.
- the first verification message is described.
- the application client generates a random string and creates a verification message containing the random string and the destination address being the platform server.
- the platform server receives the random string and the terminal identifier after receiving.
- the short message gateway can extract the terminal identifier of the short message sender from the verification short message, and carry it in the first verification message for sending, and the platform server receives the random character string and the terminal identifier after receiving.
- the application client forwards the second verification message to the platform server by using the application server, where the second verification message includes the random string and the identity authentication information.
- the application client may only send the random string to the application server, or may simultaneously send the random string and the identity authentication information of the application client when the platform is registered to the application server.
- the application server After the application server receives the random string sent by the application client, it also needs to find the identity authentication information of the application client when registering with the platform, so as to include the random A second verification message of the string and the identity authentication information is sent to the platform server.
- the second verification message may further include a data access permission list that the application client desires to obtain, and the data range for the application client to explicitly present the access permission of the data that needs to be applied to the platform server.
- the second path may be based on an SSL protocol, and further, the second path may be based on an HTTPS protocol.
- the second verification message sent based on the second path may be an HTTPS request sent based on the HTTPS protocol.
- the application server needs to perform necessary security protection to improve the difficulty and cost of maliciously obtaining the user data of the platform side by other clients, for example, providing a SOCKET interface instead.
- the HTTP interface performs corresponding symmetric encryption or asymmetric encryption on the second verification message, and adds a cross-site request forgery attack processing strategy.
- the application client receives an authorized access token sent by the platform server or the application server.
- timing at which the application client sends the first verification message through the first path and the second verification message through the application server may be the same, or may be different in sequence, and only needs to satisfy the platform server according to the random string.
- sending the first verification message to the platform server by using the first path is successful, preferably sending the first verification message and the second verification message simultaneously, or A verification message is sent first than the second verification message.
- the technical solution provided by the embodiment of the present invention sends a first verification message including a random string to the platform server through the first path, and forwards the second string including the random string and the identity authentication information by using the application server.
- a verification message if the platform server verifies that the random string in the first verification message and the second verification message are consistent, acquiring corresponding user account information according to the random string, and according to the user account information and The identity authentication information generates an authorization access order
- the card is sent to the application client and/or the application server without logging through the webpage, which enables the user to have no awareness of the authorization process and further enhances the security of the authorization.
- FIG. 4 is a flowchart of a platform authorization method of an application client according to Embodiment 4 of the present invention.
- This embodiment is applicable to an application client requesting an OpenAPI to obtain an authorized access token when an OpenAPI is required to be authorized by an end user, where
- the application client can be an application software installed on the terminal, an instant messaging client, a game entertainment client or a system tool on the terminal, that is, a third-party application.
- the method may be performed by an application client.
- the platform authorization method of the application client in this embodiment includes:
- the application client sends a first verification message to the platform server by using the first path.
- the operation is used for the platform server to record the mapping relationship between the first verification message and the client identifier of the application client.
- the application client forwards the second verification message to the platform server by using the second path.
- the operation is configured to: if the platform server verifies that the first verification message and the second verification message match, extract the client identifier from the recorded mapping relationship according to the first verification message, and Generating an authorized access token according to the client identifier, and sending the authorization access token to the application client and/or the application server;
- the application client receives an authorized access token sent by the platform server.
- the application client sends the verification message to the platform server through two different paths.
- the path may be selected and combined from a short message, an HTTP message, or a path through an application server.
- the application client forwards the first verification message to the platform server through the short message gateway as the first path.
- the application client forwards the second verification message to the platform server by using the application server as the second path.
- Both the first verification message and the second verification message carry information for performing matching verification, and the information is generated by the application client as described above, for example, a random string, a signature value, or an encrypted character string.
- the first verification message includes a random string
- the second verification message includes the random string and identity authentication information.
- the client identifier is an identifier that is used to represent the application client and can be used to search for the corresponding user account information.
- the client identifier is a terminal identifier of the terminal where the application client is located.
- the technical solution provided by the embodiment of the present invention sends a first verification message to the platform server through the first path, and forwards the second verification message to the platform server by using the second path, if the platform service is provided. If the first verification message and the second verification message match, the terminal identifier is extracted from the recorded mapping relationship according to the first verification message, and an authorized access order is generated according to the client identifier.
- the card is sent to the application client and/or the application server without logging through the webpage, which enables the user to have no awareness of the authorization process and further enhances the security of the authorization.
- FIG. 5 is a flowchart of a platform authorization method according to Embodiment 6 of the present invention.
- the embodiment may be applicable to an application client requesting an OpenAPI to obtain an authorized access token when an OpenAPI is required to be authorized by an end user, where the application client is used.
- the terminal can be an application software installed on the terminal, an instant messaging client, a game entertainment client or a system tool on the terminal, that is, a third-party application.
- the method is implemented by the platform server and the application client.
- the platform authorization method described in this embodiment includes:
- the application client sends a first verification message to the platform server by using the first path.
- the platform server receives the first verification message sent by the application client by using the first path, and obtains the client identifier of the application client.
- the platform server records the mapping relationship between the received first verification message and the client identifier.
- the application client forwards the second verification message to the platform server by using the second path.
- the platform server receives the second verification message sent by the application client by using the second path.
- the platform server verifies that the first verification message and the second verification message match, extracting the client identifier from the recorded mapping relationship according to the first verification message, and according to the The client identifier generates an authorized access token and sends it to the application client and/or the application server.
- the application client receives an authorized access token sent by the platform server and/or the application server.
- said second path is forwarded by an application server.
- said first verification message comprises a random string, said second verification message comprising said random string and identity authentication information;
- the client identifier is a terminal identifier of the terminal where the client is located.
- FIG. 6 is a structural block diagram of a platform server according to Embodiment 3 of the present invention. As shown in FIG. 6, the platform server according to this embodiment includes:
- the first verification message receiving unit 601 is configured to receive a first verification message sent by the application client by using the first path, and obtain a client identifier of the application client;
- the mapping relationship record unit 602 is configured to record a mapping relationship between the received first verification message and the client identifier.
- the second verification message receiving unit 603 is configured to receive a second verification message that is sent by the application client by using the second path.
- the verification and authorization unit 604 is configured to: if the first verification message and the second verification message are matched, the client identifier is extracted from the recorded mapping relationship according to the first verification message, and according to the The client identifier generates an authorized access token and sends it to the application client and/or the application server.
- the second verification message receiving unit 603 is specifically configured to:
- the first verification message includes a random string
- the second verification message includes the random string and identity authentication information
- the verification and authorization unit 604 is specifically configured to: verify that the random string in the first verification message and the second verification message are consistent.
- the client identifier is a terminal identifier of the terminal where the client is located, and the verification and authorization unit 604 is specifically configured to:
- the first verification message receiving unit 601 is specifically configured to:
- the application client And receiving, by the application client, a first verification message that is forwarded by the short message gateway, where the first verification message is a protocol format that is sent by the short message gateway according to the verification short message sent by the application client.
- the replaced message the verification short message carrying the random string;
- a terminal identifier of the terminal where the application client is located where the terminal identifier is a short message originator terminal identifier extracted by the short message gateway from the verification short message.
- the second verification message is forwarded by a second path, where the second path is an HTTPS request sent according to a secure hypertext transfer protocol HTTPS; and/or
- the second verification message further includes a list of desired data access rights provided by the application client; and/or
- the identity authentication information includes a package name and a package signature; and/or
- the identifier of the terminal is a mobile phone number.
- the platform server provided in this embodiment can implement the platform authorization method of the platform server provided by the first embodiment and the second embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
- FIG. 7 is a structural block diagram of an application client according to Embodiment 4 of the present invention. As shown in FIG. 7, the application client in this embodiment includes:
- a first verification message sending unit 701 configured to send, by using the first path, a first verification message to the platform server, where the platform server is between the first verification message and the client identifier of the application client Mapping relationships are recorded;
- the second verification message sending unit 702 is configured to forward, by using the second path, the second verification message to the platform server, so that if the platform server verifies that the first verification message and the second verification message match,
- the first verification message extracts the client identifier from the recorded mapping relationship, and generates an authorized access token according to the client identifier, and sends the identifier to the application client and/or the application server.
- An authorized access token receiving unit 703, configured to receive an authorized access order sent by the platform server brand.
- the second verification message sending unit 702 is specifically configured to:
- the first verification message includes a random string
- the second verification message includes the random string and identity authentication information.
- the client identifier is a terminal identifier of a terminal where the application client is located.
- first verification message sending unit 701 is specifically configured to:
- the platform server sends.
- the second verification message sending unit 702 is specifically configured to:
- the second verification message sending unit 702 is specifically configured to:
- the second verification message is forwarded to the platform server by the application server.
- the application client provided in this embodiment can execute the platform authorization method of the application client provided by the third embodiment and the fourth embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
- FIG. 8 is a schematic diagram of the interaction between the platform server and the application client and the application server in the platform authorization method according to the eighth embodiment of the present invention.
- the embodiment is mainly applied to the mobile phone application of the Android system (hereinafter referred to as an application client).
- an application client Based on a system consisting of a platform server, an application client, an application server, and a short message gateway.
- the method described in this embodiment includes:
- the application client sends a first verification message that includes a random string to the platform server.
- the application client sends a short message to the platform server, and the application client generates a short message content string containing a random string according to the format required by the platform, and sends the message content string to the interface directly sent by calling the system, Sending the message content string to the short message gateway provided by the platform to instruct the interface to perform protocol conversion on the verification short message and extract the short message originator terminal identifier of the verification short message, and generate a first verification message including the random character string.
- the application client may invoke an interface provided by a software development kit SDK (Software Development Kit) provided by the platform to obtain a short message content string in a specific format.
- SDK Software Development Kit
- the short message gateway sends the terminal identifier and the first verification message of the client to the platform server.
- the short message gateway forwards the short message content string and the mobile phone number for sending the short message to the platform server of the platform side by sending an HTTP request based on HTTP.
- the platform server After receiving the short message content string and the mobile phone number, the platform server stores a mapping relationship data of the short message content string to the mobile phone number to the cache system, and sets a certain expiration time (the general time is short, for example, 1 minute).
- the application client sends a random string to the application server.
- the system interface can be called to send a random string and other data to the application server.
- the application client can only send a random string to the application server, or can The application server simultaneously sends a random string and identity authentication information when the application client registers with the platform.
- the application server After the application server receives the random string sent by the application client, it also needs to find the identity authentication information of the application client when registering with the platform, to use the random string and the second verification message. Send it to the platform server together.
- the application server needs to perform necessary security protection on the interface to improve the difficulty and cost of using the interface by others, such as providing
- the socket interface is not the HTTP interface, and the data is symmetrically encrypted or asymmetrically encrypted, and the anti-attack processing strategy is added.
- the application server sends a second verification message to the platform server, which includes a random string, an identity authentication information of the application client, and a list of expected data access rights.
- the second verification message includes at least a random string, identity authentication information of the application client, and may further include a data access permission list that is expected to be acquired.
- the application server sends a second verification message, where the random authentication string, the identity authentication information (such as the identity identifier, the application key, and the like) of the application client when the platform is registered, and the data access permission list that is expected to be acquired are sent to the platform server.
- the identity authentication information such as the identity identifier, the application key, and the like
- this network request generally needs to be based on SSL (Secure Sockets Layer), such as sending through an HTTPS request.
- the platform server returns the generated authorization access token to the application server.
- the platform server receives the second verification message, and the identity authentication information (such as the identity identifier, the application key, and the like) of the application client when the platform is registered, and the data access permission that is expected to be obtained, first determines the identity authentication of the application client. If the validity of the information is invalid, the corresponding error information is returned. Otherwise, the platform side reads the relevant authority information from the database according to the identity authentication information, and proceeds to the next step.
- the identity authentication information such as the identity identifier, the application key, and the like
- the platform server reads the corresponding mobile phone number from the corresponding cache system according to the first verification message, and obtains corresponding user account information according to the mobile phone number (if the account information does not exist, the mobile phone number is automatically registered according to the mobile phone number a user account), and generating an authorized access token according to the user account information, the application identity authentication information, the permission information opened by the platform server for the application client, and the data access permission, and the access order is The card is returned to the application server.
- the application server sends an authorized access token to the application client.
- the application server may decide, according to needs, whether the access token needs to be stored in the application server local or corresponding database, and whether the token is returned to the application client.
- the access token can be used to invoke the OpenAPI interface provided by the platform to obtain the corresponding cloud capability and user data.
- OpenAPI is a common application of service-oriented websites.
- the service providers of the website encapsulate their own website services into a series of APIs (Application Programming Interfaces), which are used by developers of the client.
- APIs Application Programming Interfaces
- the open APIs are used.
- Called OpenAPI After the application client obtains the authorized access token, the access token can be used to invoke the OpenAPI interface provided by the platform to obtain the corresponding cloud capability and user data.
- the application client can call through multiple interfaces. The acquisition of the authorization access token for each platform is completed, thereby solving the problem of the fourth aspect mentioned above.
- the embodiment of the present invention further provides a platform authorization system, including: the platform server provided by any embodiment of the present invention and the application client provided by any embodiment of the present invention.
- the embodiment of the invention further provides a non-volatile computer storage medium, the computer storage medium
- the quality storage has one or more programs, and when the one or more programs are executed by the platform server, the platform server performs the following operations:
- the platform server verifies that the first verification message and the second verification message match, extracting the client identifier from the recorded mapping relationship according to the first verification message, and according to the client The identifier generates an authorized access token and is sent to the application client and/or the application server.
- An embodiment of the present invention further provides a non-volatile computer storage medium, where the computer storage medium stores one or more programs, when the one or more programs are executed by an application client, causing the application client Do the following:
- An embodiment of the present invention further provides an apparatus, including:
- One or more processors are One or more processors;
- One or more programs the one or more programs being stored in the memory, when When one or more processors are executed, the following operations are performed:
- the platform server verifies that the first verification message and the second verification message match, extracting the client identifier from the recorded mapping relationship according to the first verification message, and according to the client The identifier generates an authorized access token and is sent to the application client and/or the application server.
- An embodiment of the present invention further provides an apparatus, including:
- One or more processors are One or more processors;
- One or more programs the one or more programs being stored in the memory, and when executed by the one or more processors, do the following:
- All or part of the technical solutions provided by the above embodiments may be implemented by software programming, and the software programs thereof are stored in a readable storage medium such as a hard disk, an optical disk or a floppy disk in a computer.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Information Transfer Between Computers (AREA)
Abstract
本发明实施例公开了一种平台授权方法、平台服务端、应用客户端及系统和非易失性计算机存储介质，该方法包括：平台服务端接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；所述平台服务端对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；所述平台服务端接收所述应用客户端通过第二路径发送的第二验证消息；如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。本发明实施例的技术方案能使得用户对授权过程无感知，并能进一步提高授权的安全性。
Description
相关申请的交叉引用
本专利申请要求于2014年7月28日提交的、申请号为201410363395.1、申请人为百度在线网络技术(北京)有限公司、发明名称为“一种平台授权方法、平台服务端及应用客户端和系统”的中国专利申请的优先权，该申请的全文以引用的方式并入本文中。
本发明涉及计算机通信技术领域，尤其涉及一种平台授权方法、平台服务端、应用客户端及系统和非易失性计算机存储介质。
开放平台是指由网站提供的、面向第三方的开放式基础服务平台，例如百度、腾讯、阿里、新浪微博等开放云平台。第三方的应用客户端为了获得这些开放平台提供的各种高价值的云能力和用户数据，都会去支持各大平台所提供的开放授权接口，以获取用户在这些平台上给本应用客户端授权后产生的授权访问令牌，并通过访问令牌调用各大平台提供的OpenAPI(Open Application Programming Interface，开放应用程序接口)来获取本应用客户端需要的云能力和用户在对应开放平台上的相关数据。
现有技术中，用户给应用客户端授权前需要先基于用户的已有账户登录该开放平台，否则该开放平台无法知道是哪个用户要为对应的应用客户端授权，而为了保证安全，一般都需要应用客户端提供网络视图(WebView)或外部浏览
器来加载对应平台所提供的登录授权页面，用户在该登录授权页面进行登录授权，以便应用客户端不能直接接触到用户的账号、密码等敏感信息。但这样的流程体验在很多时候是很不友好的，包括：
第一、由于授权时需要加载一个web页(网页)，而web页的加载速度取决于用户移动设备的网络速度，在大多数2G移动通信网络环境下，这个页面的加载速度是极慢的，用户需要等待很长时间才能看到登录授权界面；
第二、由于web页是由开放平台端统一提供的，第三方应用一般是无法对该页面的风格、布局、内容等进行灵活自定义的，很多时候，这个web页的风格会与应用客户端自身的风格出入很大，使得第三方应用难以接受，尤其是在第三方游戏应用中；
第三、应用客户端如果通过外部浏览器加载登录授权页则会导致用户体验的急剧下降，如果通过WebView加载，则第三方应用仍然是有办法拿到用户输入的账号、密码等敏感信息的，其安全性不够高；
第四、当应用客户端同时需要多个开放平台所提供的用户数据和云能力来实现一项功能时，就得想办法引导用户逐一在该多个开放平台上进行登录授权，在每次登录授权都要生成一个登录授权界面的情况下，这样的工作基本上无法有效开展。应用客户端需要的是，在用户不受干扰的情况下，顺畅完成多个平台的授权问题，这样才能获得最大的转化率。
发明内容
有鉴于此，本发明实施例提供一种平台授权方法、平台服务端、应用客户端及系统和非易失性计算机存储介质，以改善应用客户端得到平台服务端授权的机制。
第一方面，本发明实施例提供了一种平台服务端的平台授权方法，包括：
平台服务端接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；
所述平台服务端对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；
所述平台服务端接收所述应用客户端通过第二路径发送的第二验证消息；
如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
第二方面，本发明实施例还提供了一种应用客户端的平台授权方法，包括：
应用客户端通过第一路径向平台服务端发送第一验证消息，以供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录；
应用客户端通过第二路径向所述平台服务端转发第二验证消息，以供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；
应用客户端接收所述平台服务端发送的授权访问令牌。
第三方面，本发明实施例还提供了一种平台授权方法，包括：
应用客户端通过第一路径向平台服务端发送第一验证消息；
平台服务端接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；
所述平台服务端对所接收的第一验证消息与所述客户端标识之间的映射关
系进行记录；
应用客户端通过第二路径向所述平台服务端转发第二验证消息；
所述平台服务端接收所述应用客户端通过第二路径发送的第二验证消息；
如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；
应用客户端接收所述平台服务端和/或应用服务端发送的授权访问令牌。
第四方面，本发明实施例还提供了一种平台服务端，包括：
第一验证消息接收单元，用于接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；
映射关系记录单元，用于对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；
第二验证消息接收单元，用于接收所述应用客户端通过第二路径发送的第二验证消息；
验证与授权单元，用于如果验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
第五方面，本发明实施例还提供了一种应用客户端，包括：
第一验证消息发送单元，用于通过第一路径向平台服务端发送第一验证消息，以供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录；
第二验证消息发送单元，用于通过第二路径向所述平台服务端转发第二验
证消息，以供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；
授权访问令牌接收单元，用于接收所述平台服务端发送的授权访问令牌。
第六方面，本发明实施例还提供了一种平台授权系统，包括：本发明任意实施例所提供的平台服务端和本发明任意实施例所提供的应用客户端。
第七方面，本发明实施例还提供了一种非易失性计算机存储介质，所述计算机存储介质存储有一个或者多个程序，当所述一个或者多个程序被平台服务端执行时，使得所述平台服务端进行如下操作：
接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；
对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；
接收所述应用客户端通过第二路径发送的第二验证消息；
如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
第八方面，本发明实施例还提供了一种非易失性计算机存储介质，所述计算机存储介质存储有一个或者多个程序，当所述一个或者多个程序被应用客户端执行时，使得所述应用客户端进行如下操作：
通过第一路径向平台服务端发送第一验证消息，以供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录；
通过第二路径向所述平台服务端转发第二验证消息，以供如果所述平台服
务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；
接收所述平台服务端发送的授权访问令牌。
本发明实施例提出的技术方案，应用客户端通过第一路径向平台服务端发送第一验证消息，并通过第二路径发送的第二验证消息，如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则从所记录的映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端，无需通过网页进行登录，能使得用户对授权过程无感知，并能进一步提高授权的安全性。
为了更清楚地说明本发明实施例中的技术方案，下面将对本发明实施例描述中所需要使用的附图作简单的介绍，显然，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据本发明实施例的内容和这些附图获得其他的附图。
图1是本发明实施例一所述的平台服务端的平台授权方法的流程图；
图2是本发明实施例二所述的平台服务端的平台授权方法的流程图；
图3是本发明实施例三所述的应用客户端的平台授权方法的流程图；
图4是本发明实施例四所述的应用客户端的平台授权方法的流程图；
图5是本发明实施例五所述的平台授权方法的流程图；
图6是本发明实施例六所述的平台服务端的结构框图；
图7是本发明实施例七所述的应用客户端的结构框图；
图8是本发明实施例八所述的平台授权方法中平台服务端与应用客户端以
及应用服务端的交互示意图。
为使本发明解决的技术问题、采用的技术方案和达到的技术效果更加清楚，下面将结合附图对本发明实施例的技术方案作进一步的详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
下面结合附图并通过具体实施方式来进一步说明本发明的技术方案。
实施例一
图1是本发明实施例一提供的平台服务端的平台授权方法流程图，本实施例可适用于应用客户端请求调用开放平台中需要终端用户授权的OpenAPI时获取授权访问令牌情况，其中，所述应用客户端可以为安装于终端上的应用软件、即时通讯客户端、游戏娱乐客户端或终端上的系统工具，即第三方应用。该方法可以由平台服务端来执行，平台服务端是能够向第三方应用提供平台服务的服务器，如图1所示，本实施例所述的平台服务端的平台授权方法包括：
S101、平台服务端接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端所在终端的终端标识，所述第一验证消息包括随机字符串。
为了防止应用客户端恶意获取平台方的用户数据，通过第一路径发送的第一验证消息优选为通过调用终端系统提供的系统接口向平台服务端发送的第一验证消息，例如可调用短信接口通过短信网关转发所述第一验证消息。
作为优选，所述应用客户端生成随机字符串，并创建包含所述随机字符串且目的地址为所述平台服务端的验证短信。所述应用客户端发送所述验证短信至短信网关，指示所述短信网关将所述验证短信进行协议转换，生成包含所述
随机字符串的第一验证消息，发送给所述平台服务端。短信网关可以从验证短信中提取短信发送方的终端标识，携带在第一验证消息中进行发送，则所述平台服务端接收后提取所述随机字符串和终端标识。
S102、所述平台服务端对所接收的随机字符串与所述终端标识之间的映射关系进行记录。
所述终端标识为用于唯一区分终端的标识码，只要平台服务端接收应用客户端通过第一路径发送的第一验证消息时，能用来识别出是哪一个终端即可，所述终端标识包括但不限于电话号码和终端的设备标识。终端标识通常被用户用来标识自己的账户，能据此获取账户信息。
S103、所述平台服务端接收所述应用客户端通过应用服务端转发的第二验证消息，所述第二验证消息包括所述随机字符串和身份认证信息。
为了安全起见，在注册过程中，各应用客户端或应用服务器还会向平台服务端提交身份认证信息(例如应用密钥)，以进行身份认证。在平台服务端会在数据库中对所述身份标识和所述身份认证信息之间的映射关系进行记录，用于关联查找。各应用客户端或应用服务器在向平台服务端发起访问请求时，需要发送身份认证信息用以进行身份认证，身份认证信息包括包名和包签名。
进一步地，为了安全起见，所述平台服务端接收到所述身份认证信息后，根据所述随机字符串从所记录的所述映射关系中提取所述终端标识之前，还包括：如果所述平台服务器验证所述身份认证信息为有效，则触发后续操作。即平台服务端先判断所述身份认证信息的有效性。若无效，则拒绝该应用客户端获取平台方的相关数据，可返回对应的错误信息进行提示，若有效，则可允许进行后续操作。
一般来说，平台方会为已注册的各应用客户端设置有差异的权限信息，以
控制各应用客户端的数据访问权限。若平台服务端判定应用客户端的身份认证信息的有效，则需要根据所述身份认证信息从数据库中读取出对应的权限信息。
进一步地，所述第二验证消息还可包括所述应用客户端期望获取的数据访问权限列表。
作为优选所述第二验证消息可通过与第一路径不同的第二路径转发，为了保证安全，所述第二路径可基于SSL(Secure Sockets Layer，安全套接层)协议，进一步地，所述第二路径可基于HTTPS(Hyper Text Transfer Protocol over Secure Socket Layer，安全超文本传输协议)协议。例如，基于所述第二路径发送的第二验证消息可为基于HTTPS发送的HTTPS请求。为了防止应用客户端利用所述第二路径恶意获取平台方的用户数据，应用客户端需要针对所述第二路径作必要的安全防护以提升其他客户端利用该路径的难度和成本，例如提供套接字SOCKET接口代替HTTP(Hypertext Transfer Protocol，超文本传输协议)接口，对所述第二验证消息作相应的对称加密或非对称加密，增加防跨站请求伪造攻击处理策略等。
S104、如果所述平台服务端验证所述第一验证消息和第二验证消息中的随机字符串一致，则根据所述随机字符串从所记录的所述映射关系中提取所述终端标识，并根据所述终端标识获取对应的用户账号信息。
S105、所述平台服务端根据所述用户账号信息和所述身份认证信息生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
平台服务端可将生成授权访问令牌通过所述第一路径或与所述第一路径不同的第二路径发送给所述应用客户端和/或应用服务端，由于数据大小问题和对收到的数据使用便捷性问题，优选为通过所述第二路径进行发送。
可根据应用客户端的身份认证信息查找对应的应用服务端的身份认证信
息，从而再查找对应的应用服务端的地址，或者根据第二验证消息的发送端的信息查找所述应用服务端对应的第二路径的地址，进而，授权访问令牌通过第二路径发送给应用服务端。
若平台服务端将生成授权访问令牌发送给应用服务端，则所述应用服务端接收到授权访问令牌后，可根据需要决定是否需要将访问令牌在应用服务端作保存，以及是否将所述授权访问令牌转发给应用客户端，以进一步对应用客户端的授权安全性进行控制。
第三方应用的应用客户端从平台服务端或应用服务端获取到的授权访问令牌后，即可通过所述授权访问令牌调用平台方提供的OpenAPI接口来获取相应的云能力和用户数据。
作为优选，所述第二验证消息还包括所述应用客户端期望数据访问权限列表，本操作还可包括：根据所述用户账号信息、所述身份认证信息和期望数据访问权限列表生成授权访问令牌。
进一步地，如果根据所述终端标识获取对应的用户账号信息的操作失败，则根据所述终端标识注册获取新的用户账号信息。即，如果不存在所述账号信息，可以根据通过所述第一路径获取的终端标识自动注册一个用户账号。
进一步地，所述访问令牌中还可包含所述平台服务端为所述应用客户端开通的权限信息和/或期望获取的数据访问权限列表。需要说明的是，本实施例可适用于一个应用客户端请求获取一个或一个以上的开放平台的授权访问令牌情况。
需要说明的是，应用客户端通过第一路径发送第一验证消息和通过应用服务端转发第二验证消息的时机可以相同，也可以先后不同，只需要满足操作S104中根据所述随机字符串从所记录的所述映射关系中提取对应的终端标识的步骤
之前，操作S102已完成即可，优选为第一验证消息和第二验证消息同时发送，或第一验证消息比第二验证消息先发送。
本发明实施例提出的技术方案通过平台服务端接收应用客户端从第一路径发送的包括随机字符串的第一验证消息，并接收应用客户端通过应用服务端转发的包括所述随机字符串和身份认证信息的第二验证消息，验证所述第一验证消息和第二验证消息中的随机字符串一致，则根据所述随机字符串获取对应的用户账号信息，并根据所述用户账号信息和所述身份认证信息生成授权访问令牌，发送给所述应用客户端和/或应用服务端，无需通过网页进行登录，能使得用户对授权过程无感知，并能进一步提高授权的安全性。
实施例二
图2是本发明实施例二提供的平台服务端的平台授权方法流程图，本实施例可适用于应用客户端请求调用开放平台中需要终端用户授权的OpenAPI时获取授权访问令牌情况，其中，所述应用客户端可以为安装于终端上的应用软件、即时通讯客户端、游戏娱乐客户端或终端上的系统工具，即第三方应用。该方法可以由平台服务端来执行，平台服务端是能够向第三方应用提供平台服务的服务器，如图2所示，本实施例所述的平台服务端的平台授权方法包括：
S201、平台服务端接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识。
本操作包括但不限于实施例一的S101所述的操作。其中，客户端标识是能够代表应用客户端的标识，用于最终获取用户的账户信息，以生成访问令牌。客户端标识可以为客户端所服务的用户的用户标识或客户端所在终端的终端标识，只要能对应于用户的账户信息即可。所以，获取所述应用客户端的客户端标识包括但不限于获取所述应用客户端所在终端的终端标识，优选为获取所述
应用客户端所在终端的终端标识，更进一步地，所述应用客户端所在终端优选为手机，所述应用客户端所在终端的终端标识优选为手机号。
所述第一验证消息包括但不限于：所述应用客户端生成的随机字符串，签名值，以及加密字符串等由该应用客户端生成的标示性信息，且优选是实时生成的信息，以减少该信息被盗用的可能。优选的，对于签名值可以由应用客户端根据其身份认证信息生成，加密字符串则可以由应用客户端的预设加密算法加密获得，以增加其可靠性。随机字符串、签名值、加密字符串等技术也可以结合采用。
S202、所述平台服务端对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录。
该操作实际上是记录第一验证消息中携带的应用客户端生成的信息与客户端标识之间的关联。应用客户端生成的信息将用于后续验证。
S203、所述平台服务端接收所述应用客户端通过第二路径发送的第二验证消息。
本操作中，第二验证消息通过第二路径发送，第二路径和第一路径为不同路径，但均为平台服务端与应用客户端之间的交互路径，例如可以为短信路径、HTTP消息交互路径、通过其他网元的转发路径等。通过不同路径发送验证消息，可以降低验证消息被盗取的可能性，提高验证安全性。
其中，所述第二验证消息可以是所述应用客户端直接向所述平台服务端发送的消息，也可以是所述应用客户端间接向所述平台服务端发送的消息。例如：
方式一、所述平台服务端接收所述应用客户端直接发送的第二验证消息；
方式二、所述平台服务端接收所述应用客户端通过应用服务端转发的第二验证消息。
S204、如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
两个验证消息的匹配可通过其中携带的信息进行匹配来验证。
例如，所述第一验证消息包括随机字符串，所述第二验证消息也包括所述随机字符串，如果所述平台服务端验证所述第一验证消息和第二验证消息中的随机字符串一致，则确定两验证消息匹配。
当验证消息匹配时，可以根据所述随机字符串从所记录的所述映射关系中提取所述客户端标识，例如终端标识，并根据所述终端标识获取对应的用户账号信息。进而，所述平台服务端可以根据所述用户账号信息和所述身份认证信息生成授权访问令牌，发送给所述应用客户端和/或应用服务端。身份认证信息为生成授权访问令牌过程中所需的信息，其优选可通过验证消息携带发送，即，所述第二验证消息优选是包括所述随机字符串和身份认证信息。
本发明实施例提出的技术方案，应用客户端通过第一路径向平台服务端发送第一验证消息，并通过第二路径发送的第二验证消息，如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则从所记录的映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端，无需通过网页进行登录，能使得用户对授权过程无感知，并能进一步提高授权的安全性。
实施例三
图3是本发明实施例三提供的应用客户端的平台授权方法流程图，本实施例可适用于应用客户端请求调用开放平台中需要终端用户授权的OpenAPI时获
取授权访问令牌情况，其中，所述应用客户端可以为安装于终端上的应用软件、即时通讯客户端、游戏娱乐客户端或终端上的系统工具，即第三方应用。该方法可以由应用客户端来执行，如图3所示，本实施例所述的应用客户端的平台授权方法包括：
S301、应用客户端通过第一路径向平台服务端发送第一验证消息，所述第一验证消息包括随机字符串。
为了防止应用客户端恶意获取平台方的用户数据，通过第一路径发送的第一验证消息优选为通过调用系统提供的系统接口向平台服务端发送的第一验证消息，例如可通过短信网关转发所述第一验证消息。
作为优选，所述应用客户端生成随机字符串，并创建包含所述随机字符串且目的地址为所述平台服务端的验证短信。所述应用客户端发送所述验证短信至短信网关，指示所述短信网关将所述验证短信进行协议转换，生成包含所述随机字符串的第一验证消息，发送给所述平台服务端，所述平台服务端接收后提取所述随机字符串和终端标识。短信网关可以从验证短信中提取短信发送方的终端标识，携带在第一验证消息中进行发送，则所述平台服务端接收后提取所述随机字符串和终端标识。
S302、应用客户端通过应用服务端向所述平台服务端转发第二验证消息，所述第二验证消息包括所述随机字符串和身份认证信息。
需要说明的是，应用客户端可以向应用服务端仅发送所述随机字符串，或可以向应用服务端同时发送所述随机字符串和该应用客户端在平台方注册时的身份认证信息。
若为第一种情况，则应用服务端接收到应用客户端发送的随机字符串以后，还需要查找该应用客户端在平台方注册时的身份认证信息，以将包括所述随机
字符串和身份认证信息的第二验证消息发送给所述平台服务端。
进一步地，所述第二验证消息还可包括所述应用客户端期望获取的数据访问权限列表，用于应用客户端向平台服务端明确提出需要申请的数据的访问权限的数据范围。
为了保证安全，所述第二路径可基于SSL协议，进一步地，所述第二路径可基于HTTPS协议。
例如，基于所述第二路径发送的第二验证消息可为基于HTTPS协议发送的HTTPS请求。为了防止应用客户端利用所述第二路径恶意获取平台方的用户数据，应用服务端需要作必要的安全防护以提升其他客户端恶意获取平台方的用户数据的难度和成本，例如提供SOCKET接口代替HTTP接口，对所述第二验证消息作相应的对称加密或非对称加密，增加防跨站请求伪造攻击处理策略等。
S303、应用客户端接收所述平台服务端或所述应用服务端发送的授权访问令牌。
需要说明的是，应用客户端通过第一路径发送第一验证消息和通过应用服务端转发第二验证消息的时机可以相同，也可以先后不同，只需要满足平台服务端根据所述随机字符串从所记录的所述映射关系中提取对应的终端标识的操作之前，通过第一路径向平台服务端发送第一验证消息成功即可，优选为第一验证消息和第二验证消息同时发送，或第一验证消息比第二验证消息先发送。
本发明实施例提出的技术方案通过应用客户端通过第一路径向平台服务端发送包括随机字符串的第一验证消息，并通过应用服务端转发包括所述随机字符串和身份认证信息的第二验证消息，如果所述平台服务端验证所述第一验证消息和第二验证消息中的随机字符串一致，则根据所述随机字符串获取对应的用户账号信息，并根据所述用户账号信息和所述身份认证信息生成授权访问令
牌，发送给所述应用客户端和/或应用服务端，无需通过网页进行登录，能使得用户对授权过程无感知，并能进一步提高授权的安全性。
实施例四
图4是本发明实施例四提供的应用客户端的平台授权方法流程图，本实施例可适用于应用客户端请求调用开放平台中需要终端用户授权的OpenAPI时获取授权访问令牌情况，其中，所述应用客户端可以为安装于终端上的应用软件、即时通讯客户端、游戏娱乐客户端或终端上的系统工具，即第三方应用。该方法可以由应用客户端来执行，如图4所示，本实施例所述的应用客户端的平台授权方法包括：
S401、应用客户端通过第一路径向平台服务端发送第一验证消息。
本操作用于供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录。
S401、应用客户端通过第二路径向所述平台服务端转发第二验证消息。
本操作用于供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；
S401、应用客户端接收所述平台服务端发送的授权访问令牌。
与前述实施例二相应的是，应用客户端通过两条不同的路径向平台服务端发送验证消息。路径可以从短信、HTTP消息或通过应用服务端转发等路径中进行选择和组合，优选是，应用客户端通过短信网关向所述平台服务端转发第一验证消息，作为第一路径。应用客户端通过应用服务端向所述平台服务端转发第二验证消息，作为第二路径。
第一验证消息和第二验证消息中均携带用于进行匹配验证的信息，该信息如前所述，由应用客户端生成，例如为随机字符串、签名值、或加密字符串等信息。一个优选实例为，所述第一验证消息包括随机字符串，所述第二验证消息包括所述随机字符串和身份认证信息。
所述客户端标识为代表应用客户端，并能够用于查找对应的用户账户信息的标识，优选地，所述客户端标识为所述应用客户端所在终端的终端标识。
本发明实施例提出的技术方案通过应用客户端通过第一路径向平台服务端发送第一验证消息，并通过第二路径向所述平台服务端转发第二验证消息，以供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端，无需通过网页进行登录，能使得用户对授权过程无感知，并能进一步提高授权的安全性。
实施例五
图5是本发明实施例六提供的平台授权方法流程图，本实施例可适用于应用客户端请求调用开放平台中需要终端用户授权的OpenAPI时获取授权访问令牌情况，其中，所述应用客户端可以为安装于终端上的应用软件、即时通讯客户端、游戏娱乐客户端或终端上的系统工具，即第三方应用。该方法由平台服务端和应用客户端配合来执行，如图5所示，本实施例所述的平台授权方法包括：
S501、应用客户端通过第一路径向平台服务端发送第一验证消息。
S502、平台服务端接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识。
S503、所述平台服务端对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录。
S504、应用客户端通过第二路径向所述平台服务端转发第二验证消息；
S505、所述平台服务端接收所述应用客户端通过第二路径发送的第二验证消息。
S506、如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
S507、应用客户端接收所述平台服务端和/或应用服务端发送的授权访问令牌。
作为优选，所述第二路径为通过应用服务端转发。
作为优选，所述第一验证消息包括随机字符串，所述第二验证消息包括所述随机字符串和身份认证信息；
作为优选，所述客户端标识为所述客户端所在终端的终端标识。
本实施例提出的技术方案中各操作的说明详见实施例一、实施例二、实施例三和实施例四的对应操作，具有实施例一、实施例二、实施例三和实施例四的有益效果。
实施例六
图6是本发明实施例三所述的平台服务端的结构框图，如图6所示，本实施例所述的平台服务端包括：
第一验证消息接收单元601，用于接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；
映射关系记录单元602，用于对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；
第二验证消息接收单元603，用于接收所述应用客户端通过第二路径发送的第二验证消息；
验证与授权单元604，用于如果验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
进一步地，所述第二验证消息接收单元603具体用于：
接收所述应用客户端通过应用服务端转发的第二验证消息。
进一步地：
所述第一验证消息包括随机字符串，所述第二验证消息包括所述随机字符串和身份认证信息；
所述验证与授权单元604具体用于：验证所述第一验证消息和第二验证消息中的随机字符串一致。
进一步地，所述客户端标识为所述客户端所在终端的终端标识，则所述验证与授权单元604具体用于：
根据所述终端标识获取对应的用户账号信息；
根据所述用户账号信息和所述身份认证信息生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
进一步地，所述第一验证消息接收单元601具体用于：
接收所述应用客户端通过短信网关转发的第一验证消息，其中，所述第一验证消息为所述短信网关根据所述应用客户端发送的验证短信进行协议格式转
换后的消息，所述验证短信中携带有所述随机字符串；
从所述第一验证消息中获取所述应用客户端所在终端的终端标识，所述终端标识为所述短信网关从所述验证短信中提取的短信发起方终端标识。
进一步地：所述第二验证消息通过第二路径转发，所述第二路径为基于安全超文本传输协议HTTPS发送的HTTPS请求；和/或
所述第二验证消息还包括所述应用客户端提供的期望数据访问权限列表；和/或
所述身份认证信息包括包名和包签名；和/或
所述终端的标识为手机号。
本实施例提供的平台服务端可执行本发明实施例一和实施例二所提供的平台服务端的平台授权方法，具备执行方法相应的功能模块和有益效果。
实施例七
图7是本发明实施例四所述的应用客户端的结构框图，如图7所示，本实施例所述的应用客户端包括：
第一验证消息发送单元701，用于通过第一路径向平台服务端发送第一验证消息，以供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录；
第二验证消息发送单元702，用于通过第二路径向所述平台服务端转发第二验证消息，以供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；
授权访问令牌接收单元703，用于接收所述平台服务端发送的授权访问令
牌。
进一步地，所述第二验证消息发送单元702具体用于：
通过应用服务端向所述平台服务端转发第二验证消息。
进一步地：
所述第一验证消息包括随机字符串，所述第二验证消息包括所述随机字符串和身份认证信息。
进一步地，所述客户端标识为所述应用客户端所在终端的终端标识。
进一步地，所述第一验证消息发送单元701具体用于：
生成随机字符串，并创建包含所述随机字符串且目的地址为所述平台服务端的验证短信；
发送所述验证短信至短信网关，以指示所述短信网关将所述验证短信进行协议转换并提取所述验证短信的短信发起方终端标识，生成包含所述随机字符串的第一验证消息，向所述平台服务端发送。
进一步地，所述第二验证消息发送单元702具体用于：
将所述随机字符串发送给所述应用服务端，以指示所述应用服务端将所述随机字符串和身份认证信息携带在第二验证消息中向平台服务端发送，所述第二验证消息为基于安全超文本传输协议HTTPS发送的HTTPS请求。
进一步地，所述第二验证消息发送单元702具体用于：
在发送所述第一验证消息的同时或发送所述第一验证消息成功之后，通过应用服务端向所述平台服务端转发第二验证消息。
本实施例提供的应用客户端可执行本发明实施例三和实施例四所提供的应用客户端的平台授权方法，具备执行方法相应的功能模块和有益效果。
实施例八
图8是本发明实施例八所述的平台授权方法中，平台服务端与应用客户端以及应用服务端的交互示意图，本实施例主要应用在安卓系统的手机应用程序(下称应用客户端)中，基于由平台服务端、应用客户端、应用服务端和短信网关组成的系统。如图8所示，本实施例所述的方法包括：
801、应用客户端向平台服务端发送内含随机字符串的第一验证消息。
即应用客户端向平台服务端发送短信，应用客户端按照平台方要求的格式生成一个包含随机的的字符串的短信内容串，并发送到通过调用系统提供的直接发送短信的接口，将所述短信内容串发送到平台方提供的短信网关，以指示所述接口将所述验证短信进行协议转换并提取所述验证短信的短信发起方终端标识，生成包含所述随机字符串的第一验证消息，向所述平台服务端发送。
具体地，应用客户端可调用平台方提供的软件开发工具包SDK(Software Development Kit，软件开发工具包)包提供的接口来获取一个特定格式的短信内容串。
802、短信网关向平台服务端发送客户端所在终端标识和第一验证消息。
例如，短信网关将短信内容串及发送短信的手机号基于HTTP通过发送HTTP请求转发给平台方的平台服务端。
平台服务端接收到短信内容串和手机号后，往缓存系统存储一条所述短信内容串到手机号的映射关系数据，并设一定的过期时间(一般时间较短，例如1分钟)。
803、应用客户端向应用服务端发送随机字符串。
应用客户端在短信发送成功后，可以调用系统接口向应用服务端发送随机字符串等数据。
需要说明的是，应用客户端可以向应用服务端仅发送随机字符串，或可向
应用服务端同时发送随机字符串和所述应用客户端在平台方注册时的身份认证信息。
若为第一种情况，则应用服务端接收到应用客户端发送的随机字符串以后，还需要查找该应用客户端在平台方注册时的身份认证信息，以将随机字符串和第二验证消息一起发送给平台服务端。
为了防止恶意应用客户端利用该接口来获取平台方颁发给该应用客户端的授权访问令牌，应用服务端需要对该接口作必要的安全防护以提升其他人利用该接口的难度与成本，如提供套接字接口而不是HTTP接口，数据作相应的对称加密或非对称加密处理，增加防攻击处理策略等。
804、应用服务端向平台服务端发送第二验证消息，内含随机字符串、应用客户端的身份认证信息和期望数据访问权限列表。
需要说明的是，所述第二验证消息至少包括随机字符串、应用客户端的身份认证信息，还可包括期望获取的数据访问权限列表。
应用服务端将第二验证消息，其中携带随机字符串、应用客户端在平台注册时的身份认证信息(如身份标识，应用密钥等)、以及期望获取的数据访问权限列表发送给平台服务器以获取访问令牌，为了保证安全，本次网络请求一般需要基于SSL(Secure Sockets Layer，安全套接层)，如通过HTTPS请求来发送。
805、平台服务端向应用服务端返回所生成的授权访问令牌。
平台服务端接收到所述第二验证消息，应用客户端在平台注册时的身份认证信息(如身份标识，应用密钥等)，以及期望获取的数据访问权限后，先判断应用客户端的身份认证信息的有效性，若无效，则返回对应的错误信息，否则根据所述身份认证信息从数据库中读取出平台方给所述应用客户端开通相关权限信息，并继续下一步。
平台服务端根据所述第一验证消息从相应缓存系统中读取出对应的手机号，并根据所述手机号获取对应的用户账号信息(如果不存在所述账号信息，则根据手机号自动注册一个用户账号)，并根据所述用户账号信息、所述应用身份认证信息、平台服务端为所述应用客户端开通的权限信息以及所述数据访问权限生成一个授权访问令牌，并将访问令牌返回给应用服务端。
806、应用服务端向应用客户端发送授权访问令牌。
应用服务端接收到授权访问令牌后，可以根据需要决定是否需要将访问令牌在应用服务端本地或对应数据库中存储，以及是否将所述令牌返回给所述应用客户端。
应用客户端获取到授权访问令牌后，即可通过访问令牌调用平台方提供的OpenAPI接口来获取相应的云能力和用户数据。
OpenAPI是服务型网站常见的一种应用，网站的服务商将自己的网站服务封装成一系列API(Application Programming Interface，应用编程接口)开放出去，供应用客户端的开发者使用，所开放的API就被称作OpenAPI。应用客户端获取到授权访问令牌后，即可通过访问令牌调用平台方提供的OpenAPI接口来获取相应的云能力和用户数据。
由于在用户触发手机号一键授权请求后，整个过程都不会出现任何其他的用户界面，因此，如果有多个平台都支持该技术，则应用客户端就可以通过多次接口调用的方式来完成每个平台的授权访问令牌的获取，从而解决前面提到的第四方面的问题。
本发明实施例还提供了一种平台授权系统，包括：本发明任意实施例所提供的平台服务端和本发明任意实施例所提供的应用客户端。
本发明实施例还提供了一种非易失性计算机存储介质，所述计算机存储介
质存储有一个或者多个程序，当所述一个或者多个程序被平台服务端执行时，使得所述平台服务端进行如下操作：
接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；
对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；
接收所述应用客户端通过第二路径发送的第二验证消息；
如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
本发明实施例还提供了一种非易失性计算机存储介质，所述计算机存储介质存储有一个或者多个程序，当所述一个或者多个程序被应用客户端执行时，使得所述应用客户端进行如下操作：
通过第一路径向平台服务端发送第一验证消息，以供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录；
通过第二路径向所述平台服务端转发第二验证消息，以供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；
接收所述平台服务端发送的授权访问令牌。
本发明实施例还提供了一种设备，包括：
一个或者多个处理器；
存储器；
一个或者多个程序，所述一个或者多个程序存储在所述存储器中，当被所
述一个或者多个处理器执行时进行如下操作：
接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；
对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；
接收所述应用客户端通过第二路径发送的第二验证消息；
如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
本发明实施例还提供了一种设备，包括：
一个或者多个处理器；
存储器；
一个或者多个程序，所述一个或者多个程序存储在所述存储器中，当被所述一个或者多个处理器执行时进行如下操作：
通过第一路径向平台服务端发送第一验证消息，以供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录；
通过第二路径向所述平台服务端转发第二验证消息，以供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；
接收所述平台服务端发送的授权访问令牌。以上实施例提供的技术方案中的全部或部分内容可以通过软件编程实现，其软件程序存储在可读取的存储介质中，存储介质例如：计算机中的硬盘、光盘或软盘。
注意，上述仅为本发明的较佳实施例及所运用技术原理。本领域技术人员
会理解，本发明不限于这里所述的特定实施例，对本领域技术人员来说能够进行各种明显的变化、重新调整和替代而不会脱离本发明的保护范围。因此，虽然通过以上实施例对本发明进行了较为详细的说明，但是本发明不仅仅限于以上实施例，在不脱离本发明构思的情况下，还可以包括更多其他等效实施例，而本发明的范围由所附的权利要求范围决定。
Claims (34)
- 一种平台服务端的平台授权方法，其特征在于，包括：平台服务端接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；所述平台服务端对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；所述平台服务端接收所述应用客户端通过第二路径发送的第二验证消息；如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
- 根据权利要求1所述的方法，其特征在于，所述平台服务端接收所述应用客户端通过第二路径发送的第二验证消息包括：所述平台服务端接收所述应用客户端通过应用服务端转发的第二验证消息。
- 根据权利要求2所述的方法，其特征在于：所述第一验证消息包括随机字符串，所述第二验证消息包括所述随机字符串和身份认证信息；则所述平台服务端验证所述第一验证消息和第二验证消息匹配包括：所述平台服务端验证所述第一验证消息和第二验证消息中的随机字符串一致。
- 根据权利要求3所述的方法，其特征在于，所述客户端标识为所述客户端所在终端的终端标识，则根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端包括：所述平台服务端根据所述终端标识获取对应的用户账号信息；所述平台服务端根据所述用户账号信息和所述身份认证信息生成授权访问 令牌，发送给所述应用客户端和/或应用服务端。
- 根据权利要求4所述的方法，其特征在于，平台服务端接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端所在终端的终端标识包括：所述平台服务端接收所述应用客户端通过短信网关转发的第一验证消息，其中，所述第一验证消息为所述短信网关根据所述应用客户端发送的验证短信进行协议格式转换后的消息，所述验证短信中携带有所述随机字符串；所述平台服务端从所述第一验证消息中获取所述应用客户端所在终端的终端标识，所述终端标识为所述短信网关从所述验证短信中提取的短信发起方终端标识。
- 根据权利要求4所述的方法，其特征在于：所述第二验证消息通过第二路径转发，所述第二路径为基于安全超文本传输协议HTTPS发送的HTTPS请求。
- 根据权利要求4所述的方法，其特征在于，在所述平台服务端根据所述随机字符串从所记录的所述映射关系中提取所述终端标识之前，还包括：如果所述平台服务器验证所述身份认证信息为有效，则触发后续操作。
- 根据权利要求4所述的方法，其特征在于，所述第二验证消息还包括所述应用客户端提供的期望数据访问权限列表；所述平台服务端根据所述用户账号信息和所述身份认证信息生成授权访问令牌包括：所述平台服务端根据所述用户账号信息、所述身份认证信息和所述期望数据访问权限列表生成授权访问令牌。
- 根据权利要求4-8任一所述的方法，其特征在于，所述身份认证信息包 括包名和包签名。
- 一种应用客户端的平台授权方法，其特征在于，包括：应用客户端通过第一路径向平台服务端发送第一验证消息，以供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录；应用客户端通过第二路径向所述平台服务端转发第二验证消息，以供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；应用客户端接收所述平台服务端发送的授权访问令牌。
- 根据权利要求10所述的方法，其特征在于，应用客户端通过第二路径向所述平台服务端转发第二验证消息包括：应用客户端通过应用服务端向所述平台服务端转发第二验证消息。
- 根据权利要求11所述的方法，其特征在于：所述第一验证消息包括随机字符串，所述第二验证消息包括所述随机字符串和身份认证信息。
- 根据权利要求12所述的方法，其特征在于，所述客户端标识为所述应用客户端所在终端的终端标识。
- 根据权利要求13所述的方法，其特征在于，应用客户端通过第一路径向平台服务端发送第一验证消息包括：所述应用客户端生成随机字符串，并创建包含所述随机字符串且目的地址为所述平台服务端的验证短信；所述应用客户端发送所述验证短信至短信网关，以指示所述短信网关将所 述验证短信进行协议转换并提取所述验证短信的短信发起方终端标识，生成包含所述随机字符串的第一验证消息，向所述平台服务端发送。
- 根据权利要求13所述的方法，其特征在于，应用客户端通过应用服务端向所述平台服务端转发第二验证消息包括：所述应用客户端将所述随机字符串发送给所述应用服务端，以指示所述应用服务端将所述随机字符串和身份认证信息携带在第二验证消息中向平台服务端发送，所述第二验证消息为基于安全超文本传输协议HTTPS发送的HTTPS请求。
- 根据权利要求13所述的方法，其特征在于，应用客户端通过应用服务端向所述平台服务端转发第二验证消息包括：应用客户端在发送所述第一验证消息的同时或发送所述第一验证消息成功之后，通过应用服务端向所述平台服务端转发第二验证消息。
- 一种平台授权方法，其特征在于，包括：应用客户端通过第一路径向平台服务端发送第一验证消息；平台服务端接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；所述平台服务端对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；应用客户端通过第二路径向所述平台服务端转发第二验证消息；所述平台服务端接收所述应用客户端通过第二路径发送的第二验证消息；如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；应用客户端接收所述平台服务端和/或应用服务端发送的授权访问令牌。
- 根据权利要求17所述的方法，其特征在于：所述第二路径为通过应用服务端转发；所述第一验证消息包括随机字符串，所述第二验证消息包括所述随机字符串和身份认证信息；所述客户端标识为所述客户端所在终端的终端标识。
- 一种平台服务端，其特征在于，包括：第一验证消息接收单元，用于接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；映射关系记录单元，用于对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；第二验证消息接收单元，用于接收所述应用客户端通过第二路径发送的第二验证消息；验证与授权单元，用于如果验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
- 根据权利要求19所述的平台服务端，其特征在于，所述第二验证消息接收单元具体用于：接收所述应用客户端通过应用服务端转发的第二验证消息。
- 根据权利要求20所述的平台服务端，其特征在于：所述第一验证消息包括随机字符串，所述第二验证消息包括所述随机字符串和身份认证信息；所述验证与授权单元具体用于：验证所述第一验证消息和第二验证消息中的随机字符串一致。
- 根据权利要求21所述的平台服务端，其特征在于，所述客户端标识为所述客户端所在终端的终端标识，则所述验证与授权单元具体用于：根据所述终端标识获取对应的用户账号信息；根据所述用户账号信息和所述身份认证信息生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
- 根据权利要求22所述的平台服务端，其特征在于，所述第一验证消息接收单元具体用于：接收所述应用客户端通过短信网关转发的第一验证消息，其中，所述第一验证消息为所述短信网关根据所述应用客户端发送的验证短信进行协议格式转换后的消息，所述验证短信中携带有所述随机字符串；从所述第一验证消息中获取所述应用客户端所在终端的终端标识，所述终端标识为所述短信网关从所述验证短信中提取的短信发起方终端标识。
- 根据权利要求22所述的平台服务端，其特征在于：所述第二验证消息通过第二路径转发，所述第二路径为基于安全超文本传输协议HTTPS发送的HTTPS请求；和/或所述第二验证消息还包括所述应用客户端提供的期望数据访问权限列表；和/或所述身份认证信息包括包名和包签名；和/或所述终端的标识为手机号。
- 一种应用客户端，其特征在于，包括：第一验证消息发送单元，用于通过第一路径向平台服务端发送第一验证消 息，以供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录；第二验证消息发送单元，用于通过第二路径向所述平台服务端转发第二验证消息，以供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；授权访问令牌接收单元，用于接收所述平台服务端发送的授权访问令牌。
- 根据权利要求25所述的应用客户端，其特征在于，所述第二验证消息发送单元具体用于：通过应用服务端向所述平台服务端转发第二验证消息。
- 根据权利要求26所述的应用客户端，其特征在于：所述第一验证消息包括随机字符串，所述第二验证消息包括所述随机字符串和身份认证信息。
- 根据权利要求27所述的应用客户端，其特征在于，所述客户端标识为所述应用客户端所在终端的终端标识。
- 根据权利要求28所述的应用客户端，其特征在于，所述第一验证消息发送单元具体用于：生成随机字符串，并创建包含所述随机字符串且目的地址为所述平台服务端的验证短信；发送所述验证短信至短信网关，以指示所述短信网关将所述验证短信进行协议转换并提取所述验证短信的短信发起方终端标识，生成包含所述随机字符串的第一验证消息，向所述平台服务端发送。
- 根据权利要求28所述的应用客户端，其特征在于，所述第二验证消息发送单元具体用于：将所述随机字符串发送给所述应用服务端，以指示所述应用服务端将所述随机字符串和身份认证信息携带在第二验证消息中向平台服务端发送，所述第二验证消息为基于安全超文本传输协议HTTPS发送的HTTPS请求。
- 根据权利要求28所述的应用客户端，其特征在于，所述第二验证消息发送单元具体用于：在发送所述第一验证消息的同时或发送所述第一验证消息成功之后，通过应用服务端向所述平台服务端转发第二验证消息。
- 一种平台授权系统，其特征在于，包括：权利要求19-24任一所述的平台服务端和权利要求25-31任一所述的应用客户端。
- 一种非易失性计算机存储介质，所述计算机存储介质存储有一个或者多个程序，当所述一个或者多个程序被平台服务端执行时，使得所述平台服务端进行如下操作：接收应用客户端通过第一路径发送的第一验证消息并获取所述应用客户端的客户端标识；对所接收的第一验证消息与所述客户端标识之间的映射关系进行记录；接收所述应用客户端通过第二路径发送的第二验证消息；如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端。
- 一种非易失性计算机存储介质，所述计算机存储介质存储有一个或者 多个程序，当所述一个或者多个程序被应用客户端执行时，使得所述应用客户端进行如下操作：通过第一路径向平台服务端发送第一验证消息，以供所述平台服务端对所述第一验证消息与所述应用客户端的客户端标识之间的映射关系进行记录；通过第二路径向所述平台服务端转发第二验证消息，以供如果所述平台服务端验证所述第一验证消息和第二验证消息匹配，则根据所述第一验证消息从所记录的所述映射关系中提取所述客户端标识，并根据所述客户端标识生成授权访问令牌，发送给所述应用客户端和/或应用服务端；接收所述平台服务端发送的授权访问令牌。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410363395.1 | 2014-07-28 | ||
| CN201410363395.1A CN104113549B (zh) | 2014-07-28 | 2014-07-28 | 一种平台授权方法、平台服务端及应用客户端和系统 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2016015436A1 true WO2016015436A1 (zh) | 2016-02-04 |
Family
ID=51710182
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2014/094200 WO2016015436A1 (zh) | 2014-07-28 | 2014-12-18 | 平台授权方法、平台服务端、应用客户端及系统和存储介质 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN104113549B (zh) |
| WO (1) | WO2016015436A1 (zh) |
Cited By (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109522726A (zh) * | 2018-10-16 | 2019-03-26 | 平安万家医疗投资管理有限责任公司 | 小程序的鉴权方法、服务器及计算机可读存储介质 |
| CN110175466A (zh) * | 2019-04-16 | 2019-08-27 | 平安科技（深圳）有限公司 | 开放平台的安全管理方法、装置、计算机设备及存储介质 |
| CN111262819A (zh) * | 2018-11-30 | 2020-06-09 | 中移（杭州）信息技术有限公司 | 一种voip sdk接入控制方法及装置 |
| CN111901437A (zh) * | 2020-08-04 | 2020-11-06 | 北京一起教育信息咨询有限责任公司 | 一种消息传输方法、装置和系统 |
| CN112035809A (zh) * | 2020-08-13 | 2020-12-04 | 刘乾春 | 一种基于教育云的统一访问授权平台 |
| CN112491614A (zh) * | 2020-11-26 | 2021-03-12 | 许昌许继软件技术有限公司 | 一种用于嵌入式设备的配置信息在线自动生效方法及系统 |
| CN112491836A (zh) * | 2020-11-16 | 2021-03-12 | 新华三技术有限公司合肥分公司 | 通信系统、方法、装置及电子设备 |
| CN112615926A (zh) * | 2020-12-23 | 2021-04-06 | 中铁信弘远(北京)软件科技有限责任公司 | 一种铁路移动数据传输方法及系统 |
| CN113315637A (zh) * | 2021-05-31 | 2021-08-27 | 中国农业银行股份有限公司 | 安全认证方法、装置及存储介质 |
| CN113630447A (zh) * | 2021-07-22 | 2021-11-09 | 济南浪潮数据技术有限公司 | 一种基于web的云服务提供方法、系统及存储介质 |
| CN113709162A (zh) * | 2021-08-30 | 2021-11-26 | 康键信息技术（深圳）有限公司 | 内网数据的获取方法、装置、设备及存储介质 |
| CN113783829A (zh) * | 2020-11-26 | 2021-12-10 | 北京沃东天骏信息技术有限公司 | 跨平台实现设备接入的方法和装置 |
| CN113848737A (zh) * | 2021-09-15 | 2021-12-28 | 珠海格力电器股份有限公司 | 智能设备控制方法、装置、系统、云服务器和存储介质 |
| CN114915462A (zh) * | 2022-04-29 | 2022-08-16 | 中国电信股份有限公司 | 跨站请求伪造攻击防御方法及装置、电子设备及介质 |
Families Citing this family (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104113549B (zh) * | 2014-07-28 | 2017-07-18 | 百度在线网络技术（北京）有限公司 | 一种平台授权方法、平台服务端及应用客户端和系统 |
| CN104320265B (zh) * | 2014-11-21 | 2017-10-24 | 北京奇虎科技有限公司 | 用于软件平台的认证方法和认证装置 |
| CN106161420A (zh) * | 2015-05-13 | 2016-11-23 | 王正伟 | Guid迁移设置方法 |
| CN106331772A (zh) * | 2015-06-17 | 2017-01-11 | 阿里巴巴集团控股有限公司 | 数据校验方法、装置和智能电视系统 |
| CN105262717A (zh) * | 2015-08-31 | 2016-01-20 | 福建天晴数码有限公司 | 一种网络服务安全管理方法及装置 |
| CN109154802A (zh) * | 2016-03-31 | 2019-01-04 | 江森自控科技公司 | 分布式建筑物管理系统中的hvac装置注册 |
| CN106506494B (zh) * | 2016-10-27 | 2019-10-11 | 上海斐讯数据通信技术有限公司 | 一种开放平台的应用接入方法 |
| CN106846562B (zh) * | 2016-12-26 | 2020-01-07 | 努比亚技术有限公司 | 一种验证装置以及发送验证信息的方法 |
| WO2018187960A1 (zh) * | 2017-04-12 | 2018-10-18 | 福建联迪商用设备有限公司 | 一种 Root 权限管控的方法及系统 |
| CN107645506B (zh) * | 2017-09-28 | 2020-06-16 | 世纪龙信息网络有限责任公司 | 信息的验证方法、装置、计算机可读存储介质和计算机设备 |
| EP3881258A4 (en) * | 2018-11-14 | 2022-01-12 | Visa International Service Association | SUPPLY OF TOKENS IN THE CLOUD OF MULTIPLE TOKENS |
| CN109587148A (zh) * | 2018-12-11 | 2019-04-05 | 上海宜延电子商务有限公司 | 一种数据计算客户端、数据计算服务器及数据计算系统 |
| CN111698248B (zh) * | 2020-06-11 | 2021-06-11 | 杭州商湾网络科技有限公司 | 一种基于标签的网络授权管理方法及系统 |
| CN111526166B (zh) * | 2020-07-03 | 2020-12-15 | 支付宝(杭州)信息技术有限公司 | 一种信息验证方法、装置及设备 |
| CN112862590A (zh) * | 2021-01-15 | 2021-05-28 | 中国建设银行股份有限公司上海市分行 | 业务授权方法、计算设备和介质 |
| CN114301685B (zh) * | 2021-12-29 | 2024-01-26 | 杭州安恒信息安全技术有限公司 | 一种系统授权验证方法及系统 |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2009139673A1 (en) * | 2008-05-13 | 2009-11-19 | Telefonaktiebolaget Lm Ericsson (Publ) | Verifying a message in a communication network |
| CN102231736A (zh) * | 2010-10-13 | 2011-11-02 | 天维讯达无线电设备检测（北京）有限责任公司 | 一种网络访问控制方法及系统 |
| CN102347942A (zh) * | 2011-07-01 | 2012-02-08 | 飞天诚信科技股份有限公司 | 一种基于图像采集的信息安全方法及系统 |
| CN103905457A (zh) * | 2014-04-10 | 2014-07-02 | 北京数码视讯科技股份有限公司 | 服务器、客户端、认证系统及用户认证和数据访问方法 |
| CN104113549A (zh) * | 2014-07-28 | 2014-10-22 | 百度在线网络技术（北京）有限公司 | 一种平台授权方法、平台服务端及应用客户端和系统 |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040059686A1 (en) * | 2002-09-19 | 2004-03-25 | Levesque Daniel Robert | On-line cryptographically based payment authorization method and apparatus |
| US8201226B2 (en) * | 2007-09-19 | 2012-06-12 | Cisco Technology, Inc. | Authorizing network access based on completed educational task |
| CN101562621B (zh) * | 2009-05-25 | 2013-05-22 | 阿里巴巴集团控股有限公司 | 一种用户授权的方法、系统和装置 |
| CN103001936B (zh) * | 2011-09-16 | 2016-05-25 | 北京新媒传信科技有限公司 | 一种第三方应用接口授权方法和系统 |
| CN103581140B (zh) * | 2012-08-03 | 2018-02-27 | 腾讯科技（深圳）有限公司 | 授权控制方法及装置和系统、授权请求方法及装置 |
| CN103051630B (zh) * | 2012-12-21 | 2016-01-27 | 微梦创科网络科技（中国）有限公司 | 基于开放平台实现第三方应用授权的方法、装置及系统 |
| CN103888451B (zh) * | 2014-03-10 | 2017-09-26 | 百度在线网络技术（北京）有限公司 | 认证的授权方法、装置及系统 |
-
2014
- 2014-07-28 CN CN201410363395.1A patent/CN104113549B/zh active Active
- 2014-12-18 WO PCT/CN2014/094200 patent/WO2016015436A1/zh active Application Filing
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2009139673A1 (en) * | 2008-05-13 | 2009-11-19 | Telefonaktiebolaget Lm Ericsson (Publ) | Verifying a message in a communication network |
| CN102231736A (zh) * | 2010-10-13 | 2011-11-02 | 天维讯达无线电设备检测（北京）有限责任公司 | 一种网络访问控制方法及系统 |
| CN102347942A (zh) * | 2011-07-01 | 2012-02-08 | 飞天诚信科技股份有限公司 | 一种基于图像采集的信息安全方法及系统 |
| CN103905457A (zh) * | 2014-04-10 | 2014-07-02 | 北京数码视讯科技股份有限公司 | 服务器、客户端、认证系统及用户认证和数据访问方法 |
| CN104113549A (zh) * | 2014-07-28 | 2014-10-22 | 百度在线网络技术（北京）有限公司 | 一种平台授权方法、平台服务端及应用客户端和系统 |
Cited By (24)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109522726A (zh) * | 2018-10-16 | 2019-03-26 | 平安万家医疗投资管理有限责任公司 | 小程序的鉴权方法、服务器及计算机可读存储介质 |
| CN111262819A (zh) * | 2018-11-30 | 2020-06-09 | 中移（杭州）信息技术有限公司 | 一种voip sdk接入控制方法及装置 |
| CN111262819B (zh) * | 2018-11-30 | 2022-04-01 | 中移（杭州）信息技术有限公司 | 一种voip sdk接入控制方法及装置 |
| CN110175466B (zh) * | 2019-04-16 | 2024-03-08 | 平安科技（深圳）有限公司 | 开放平台的安全管理方法、装置、计算机设备及存储介质 |
| CN110175466A (zh) * | 2019-04-16 | 2019-08-27 | 平安科技（深圳）有限公司 | 开放平台的安全管理方法、装置、计算机设备及存储介质 |
| CN111901437A (zh) * | 2020-08-04 | 2020-11-06 | 北京一起教育信息咨询有限责任公司 | 一种消息传输方法、装置和系统 |
| CN111901437B (zh) * | 2020-08-04 | 2022-12-20 | 北京一起教育信息咨询有限责任公司 | 一种消息传输方法、装置和系统 |
| CN112035809A (zh) * | 2020-08-13 | 2020-12-04 | 刘乾春 | 一种基于教育云的统一访问授权平台 |
| CN112035809B (zh) * | 2020-08-13 | 2024-01-12 | 陕西碧宝教育科技有限公司 | 一种基于教育云的统一访问授权平台 |
| CN112491836A (zh) * | 2020-11-16 | 2021-03-12 | 新华三技术有限公司合肥分公司 | 通信系统、方法、装置及电子设备 |
| CN112491836B (zh) * | 2020-11-16 | 2022-04-22 | 新华三技术有限公司合肥分公司 | 通信系统、方法、装置及电子设备 |
| CN113783829B (zh) * | 2020-11-26 | 2024-03-05 | 北京沃东天骏信息技术有限公司 | 跨平台实现设备接入的方法和装置 |
| CN113783829A (zh) * | 2020-11-26 | 2021-12-10 | 北京沃东天骏信息技术有限公司 | 跨平台实现设备接入的方法和装置 |
| CN112491614B (zh) * | 2020-11-26 | 2023-08-11 | 许昌许继软件技术有限公司 | 一种用于嵌入式设备的配置信息在线自动生效方法及系统 |
| CN112491614A (zh) * | 2020-11-26 | 2021-03-12 | 许昌许继软件技术有限公司 | 一种用于嵌入式设备的配置信息在线自动生效方法及系统 |
| CN112615926A (zh) * | 2020-12-23 | 2021-04-06 | 中铁信弘远(北京)软件科技有限责任公司 | 一种铁路移动数据传输方法及系统 |
| CN113315637B (zh) * | 2021-05-31 | 2023-07-04 | 中国农业银行股份有限公司 | 安全认证方法、装置及存储介质 |
| CN113315637A (zh) * | 2021-05-31 | 2021-08-27 | 中国农业银行股份有限公司 | 安全认证方法、装置及存储介质 |
| CN113630447B (zh) * | 2021-07-22 | 2023-04-07 | 济南浪潮数据技术有限公司 | 一种基于web的云服务提供方法、系统及存储介质 |
| CN113630447A (zh) * | 2021-07-22 | 2021-11-09 | 济南浪潮数据技术有限公司 | 一种基于web的云服务提供方法、系统及存储介质 |
| CN113709162A (zh) * | 2021-08-30 | 2021-11-26 | 康键信息技术（深圳）有限公司 | 内网数据的获取方法、装置、设备及存储介质 |
| CN113848737A (zh) * | 2021-09-15 | 2021-12-28 | 珠海格力电器股份有限公司 | 智能设备控制方法、装置、系统、云服务器和存储介质 |
| CN114915462A (zh) * | 2022-04-29 | 2022-08-16 | 中国电信股份有限公司 | 跨站请求伪造攻击防御方法及装置、电子设备及介质 |
| CN114915462B (zh) * | 2022-04-29 | 2023-09-08 | 中国电信股份有限公司 | 跨站请求伪造攻击防御方法及装置、电子设备及介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104113549B (zh) | 2017-07-18 |
| CN104113549A (zh) | 2014-10-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2016015436A1 (zh) | 平台授权方法、平台服务端、应用客户端及系统和存储介质 | |
| US11165581B2 (en) | System for improved identification and authentication | |
| US10491587B2 (en) | Method and device for information system access authentication | |
| US11764966B2 (en) | Systems and methods for single-step out-of-band authentication | |
| US9979719B2 (en) | System and method for converting one-time passcodes to app-based authentication | |
| US20200099677A1 (en) | Security object creation, validation, and assertion for single sign on authentication | |
| US11122047B2 (en) | Invitation links with enhanced protection | |
| Boyd | Getting started with OAuth 2.0 | |
| US9531714B2 (en) | Enterprise authentication via third party authentication support | |
| US10904218B2 (en) | Secure proxy to protect private data | |
| WO2016188256A1 (zh) | 一种应用接入鉴权的方法、系统、装置及终端 | |
| US10225260B2 (en) | Enhanced authentication security | |
| WO2019062666A1 (zh) | 一种实现安全访问内部网络的系统、方法和装置 | |
| US11336686B2 (en) | Electronic authentication infrastructure | |
| JP2017521934A (ja) | クライアントとサーバとの間の相互検証の方法 | |
| Ferry et al. | Security evaluation of the OAuth 2.0 framework | |
| US11777942B2 (en) | Transfer of trust between authentication devices | |
| US9332011B2 (en) | Secure authentication system with automatic cancellation of fraudulent operations | |
| CN112468481A (zh) | 一种基于CAS的单页和多页web应用身份集成认证方法 | |
| JP2009282561A (ja) | ユーザ認証システム、ユーザ認証方法およびプログラム | |
| JP4698751B2 (ja) | アクセス制御システム、認証サーバシステムおよびアクセス制御プログラム | |
| AU2018101656A4 (en) | A System and Method for Facilitating the Delivery of Secure Hyperlinked Content via Mobile Messaging | |
| JP2018055582A (ja) | 通信管理プログラム、通信管理方法および通信管理装置 | |
| Wang et al. | A framework for formal analysis of privacy on SSO protocols | |
| JP2012159980A (ja) | 識別情報の不正な取得を防止するためのサーバ |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 14898769 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 14898769 Country of ref document: EP Kind code of ref document: A1 |