WO2016180171A1 - 一种信任登录方法和装置 - Google Patents

一种信任登录方法和装置 Download PDF

Info

Publication number
WO2016180171A1
WO2016180171A1 PCT/CN2016/079555 CN2016079555W WO2016180171A1 WO 2016180171 A1 WO2016180171 A1 WO 2016180171A1 CN 2016079555 W CN2016079555 W CN 2016079555W WO 2016180171 A1 WO2016180171 A1 WO 2016180171A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
login
login state
server
user
Prior art date
Application number
PCT/CN2016/079555
Other languages
English (en)
French (fr)
Inventor
周志章
Original Assignee
阿里巴巴集团控股有限公司
周志章
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 周志章 filed Critical 阿里巴巴集团控股有限公司
Priority to SG11201708989QA priority Critical patent/SG11201708989QA/en
Priority to KR1020177035829A priority patent/KR102150750B1/ko
Priority to JP2017559055A priority patent/JP6756738B2/ja
Priority to EP16792021.4A priority patent/EP3297243B1/en
Publication of WO2016180171A1 publication Critical patent/WO2016180171A1/zh
Priority to US15/809,780 priority patent/US10673834B2/en
Priority to US16/884,966 priority patent/US10917397B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash

Definitions

  • the present application relates to network technologies, and in particular, to a trust login method and apparatus.
  • Trust login can also be called login-free between two applications. For example, the user logs in to the shopping website and jumps to the payment website when payment is required. In this case, the login information of the payment website can be directly charged. This is the trust login from the shopping website to the payment website, that is, the payment website trusts the users who have logged in at the shopping website, so the user can directly operate on the payment website without logging in again at the payment website.
  • the method for trusting login between two applications may be: when the user logs in after the application A, digitally signs the application A, and adds the signature to the website link address of the application B as one of the parameters of the link address.
  • the address carrying the signature may be referred to as a trusted login URL.
  • the application B checks the signature and knows that the login has been applied to the application A, and the set user is also applied to the login B. In this way, if the trusted login URL is arbitrarily copied, for example, copied to another terminal, the application B can still be accessed, which poses a security risk.
  • the present application provides a trust login method and apparatus to improve the security of trust login.
  • a trust login method including:
  • the device identifier information of the user login device is obtained, and the device identifier information is associated with the first login state.
  • a trust login method including:
  • the server of the first application Receiving, by the server of the first application, the first login state and the device identifier information, where the first application is an associated application that is trusted to log in with the second application, and the first login state indicates that the user logs in to the first application.
  • the device identification information is used to indicate that the user logs in to the login device of the first application;
  • an application access response is returned.
  • a trust login device including:
  • a login state generating module configured to acquire device identification information of the user login device, and associate the device identification information with the first login state after the first login state of the first application is established;
  • a login state synchronization module configured to send the device identification information and the first login state to a server of the second application, where the second application is an associated application that trusts the login with the first application, so that the server Establishing a second login state of the user in the second application according to the first login state, and associating the device identification information with the second login state.
  • a trust login device including:
  • the login state receiving module is configured to receive the first login state and the device identifier information sent by the server of the first application, where the first application is an associated application that is trusted to log in with the second application, and the first login state indicates that the user is in the location
  • the first application login is used, and the device identification information is used to indicate that the user logs in to the login device of the first application;
  • a login state establishing module configured to establish, according to the first login state, a second login state of the user in the second application, and associate and store the device identification information and the second login state;
  • the access management module is configured to: when receiving the application access request for the second application, if it is determined that the device identification information for sending the application access request and the corresponding second login state have been stored, returning an application access response.
  • the trust login method and apparatus provided by the present application are provided by an association relationship with a trusted login
  • the login between the first application and the server of the second application is performed, so that the server can learn that the user has logged in to the associated application according to the login state, thereby establishing a trusted login between the associated applications, because the server relies on the server.
  • the mutual notification informs the execution of the trusted login, and the security of the trusted login can be improved compared with the manner in which the login information is transmitted between the clients in the traditional manner.
  • FIG. 1 is a flowchart of a trust login method according to an exemplary embodiment of the present application
  • FIG. 2 is a flowchart of another trust login method according to an exemplary embodiment of the present application.
  • FIG. 3 is a structural diagram of a trust login apparatus according to an exemplary embodiment of the present application.
  • FIG. 4 is a structural diagram of another trust login device according to an exemplary embodiment of the present application.
  • FIG. 5 is a structural diagram of still another trust login device according to an exemplary embodiment of the present application.
  • Trusted login is a login-free way that allows users to seamlessly switch between different applications. For example, after logging in to application A, the user also has access to application B. Application B trust is already registered in application A. User. Generally, the users who can trust the logged-in application A and the application B are the same user (for example, the user registers with the application A and the application B respectively), or the users of the two applications have a binding relationship (for example, the users are respectively located here) The two applications are registered with different accounts, but have binding relationships). In practical applications, for example, the way to jump to a payment website when paying for a shopping website is a way to implement trust login.
  • the trust login method and apparatus of the embodiment of the present application are used to implement trust login between two applications, and the method will implement a more secure trust login.
  • a shopping application and a payment application a trust login between two applications, wherein the shopping application may be referred to as a first application, a payment application It can be called a second application.
  • the application adopts a client/browser mode, and the user can open the website of the shopping website through a browser on the terminal (for example, a computer, a smart phone, etc.) to access the shopping application, and the shopping website accessed on the terminal is the The client of the shopping application, the application content is transmitted by the backend shopping application server to the client resolution display.
  • the server of the shopping application verifies the login information such as the account number and the password. This embodiment assumes verification. Then, in the server 103, the server establishes a first login state, where the first login state indicates “the user corresponding to the account and the password, the login application is registered on the terminal, and the login is successful”, and the login state is the recorded login information, for example, Including: user information (account), login duration, environment for logging in to the device (for example, browser version, terminal model, IP address of the terminal, MAC address, SIM card number of the mobile phone), etc. That is to say, when the user logs in to the application successfully, the application's server will record some information about the application login, and the information is the login state.
  • the transmission between the shopping application server and the payment application server shown in FIG. 1 is described; wherein, the user jumps from the website link of the shopping application to the payment application as an example
  • the shopping application and the payment application are related to each other (an association capable of trust login)
  • the shopping application may be referred to as an associated application of the payment application
  • the payment application may also be referred to as The associated app for the shopping app.
  • the login state established by the shopping application server for the user in 103 may be referred to as a first login state (the "first" is only used to distinguish from other login states that follow).
  • the shopping application server may obtain device identification information of the user login device, and establish an association relationship between the device identification information and the first login state.
  • the device identification information may be used to uniquely identify the terminal device that the user logs in to the shopping application.
  • the device identification information may be information that the shopping application server directly obtains to identify the device; or the device identification information may also be It is calculated by the shopping application server based on some information. For example, in the example of 104 in FIG.
  • the ID of a terminal device can be calculated as device identification information by using information such as the IP address, MAC address, and process ID of the terminal (the process of accessing the application). For example, the MD5 algorithm can be used to calculate the summary information. information. If it is a different terminal device, then the above IP and MAC information is usually Different, so the calculated device identification information is also different, so that the device identification information uniquely identifies the login device.
  • the shopping application server can send both the device identification information and the first login state to the payment application server.
  • the shopping application server may send the device identification information and the first login status to the payment application server when the user wants to jump to the payment application in the shopping application. Since the embodiment of the present application is to perform the trust login process, the user can log in to the shopping application, and the login application can be accessed directly in the payment application. Therefore, the shopping application server can notify the payment application after establishing the first login state of the user.
  • the server causes the payment application server to know that the user has logged in to the shopping application, and accordingly establishes the login state of the user in the payment application server, which is equivalent to determining that the user can log in to the payment application, even though the user has not actually logged into the payment application at this time. , but the payment application has determined that the user can log in at the payment application.
  • the shopping application mainly informs the payment application that the user has logged in to the shopping application, and the information transmitted by the shopping application server to the payment application server can be achieved as long as the above purpose can be achieved.
  • the information content can be flexibly set.
  • the synchronized first login status information includes: the login status is true, the true is used to indicate “already logged in”; and, for example, the terminal information such as the mobile phone model and the browser type may be further included.
  • the information included in the first login state transmitted by the shopping application server to the payment application server may not be completely the same as the first login state information recorded by the shopping application server, and at least the state of the payment application server “already logged in” may be notified, so that the payment application is made.
  • the server knows that the user has logged in to the shopping app.
  • the shopping application can know the server address of the payment application associated with the trust login it generated, and synchronize the first login state to the address.
  • the payment application server may establish a second login state of the user's payment application (ie, the second application) according to the first login state, that is, record information that the user has logged in at the payment application server, such as the above-mentioned user account. And the information of the mobile phone model and the browser type, and the correspondence between the second login state and the device identification information is established, and the corresponding relationship is stored.
  • the shopping application server can return the link address of the payment application to the terminal, for example, the URL of the payment website; In an application embodiment, the shopping application server may not need to add a signature in the link address URL of the payment application.
  • the user can click on the link address to access the payment application.
  • the payment application server After receiving the application access request sent by the user in the 108, the payment application server calculates the device identification information, and the calculation method is the same as the method of the shopping application server, for example, calculating the device identification information according to the IP address and MAC address of the terminal device, and viewing the calculation.
  • the obtained device identification information is stored in the payment application server itself. If the same user jumps to the payment application by the shopping application on the same terminal, the device identification information calculated by the payment application server in 108 is the same as the device identification information calculated by the shopping application server in 104, and the payment application server will be able to The device stores the device identification information and its corresponding second login state.
  • the payment application server may determine that the user has logged in on the associated application, ie, the shopping application, according to which the payment application server may trust the user and allow the user.
  • the access in 111, returns an application access response to the user, such as feeding back the content of the payment application to the user terminal.
  • the payment application server will verify the signature in the trusted login URL to agree to the user accessing the payment application.
  • the payment application server adopts the trusted login method in the application, that is, no longer signs (or The link does not have a signature at all) verification, but the device identification information corresponding to the terminal z2 is calculated.
  • the device identifier information of the terminal z1 and the corresponding login state are stored in the payment application server, and the device identification information corresponding to the terminal z2 and the corresponding login state are not stored, according to which the payment application server can reject the user.
  • the application access request initiated by the terminal z2 prevents random transmission of the login state between different terminals, thereby improving the security of application access.
  • the delivery of the login state in the conventional manner (for example, the payment application knows that the user is in the logged-in state of the shopping application) is transmitted through the front end, for example, the user can click the application jump on the front end terminal browser.
  • Link triggers this transfer (join the shopping app in the link)
  • the signed-in status signature so that the link address is easily copied at will, and the payment application server side cannot recognize and control it.
  • the transmission of the front-end login state is converted to the back-end synchronization, that is, the login state between the shopping application server and the payment application server is synchronized, and the user cannot be seen at the front end, and the server between the back ends is
  • the process of performing the trust login process makes the trust login process invisible, and the payment application server learns the login of the shopping application by the login state synchronization between the servers, and establishes the trust of the user at the same time.
  • the payment application server can also control and prevent random copying between different terminals according to the obtained device identification information of the synchronous login state between the servers, thereby improving the security of the trust login.
  • the trusted login usually requires the same user to access the associated application in a trusted login-free manner on the same terminal.
  • the device identification information may be generated according to the device information and the login information.
  • the device information includes: an IP address, a MAC address, a process ID, and the like of the device.
  • the login information includes, for example, a user account, a password, and the like. If the user logs in using different account information, the calculated device identification information is inconsistent. Therefore, the same terminal and the same user can be guaranteed by the device identification information.
  • the payment application server may also execute 201, that is, establish the first login.
  • the correspondence between the state and the second login state is, established.
  • the two login states correspond to the device identification information described above, and the corresponding first login state and the second login state may be found according to the device identification information; for example, when the shopping application server is in the synchronous login state at 105 , can randomly generate a login state ID (not limited to the generation mode and the specific ID form), the login state ID can The first login state and the second login state are used to identify the first login state and the second login state, and the payment application server associates the first login state and the second login state with the login state ID, and the corresponding login ID can be found according to the login state ID.
  • the first login state and the second login state can randomly generate a login state ID (not limited to the generation mode and the specific ID form)
  • the login state ID can The first login state and the second login state are used to identify the first login state and the second login state
  • the payment application server associates the first login state and the second login state with the login state ID, and the corresponding login ID can be found according to the login state ID.
  • the payment application server may search for the first login state corresponding to the second login state according to the correspondence record, and learn the first A login state is sent by the shopping application server (the address of the source device can be recorded when receiving the first login state of the synchronization), and the payment application server can query the shopping application server for validity of the first login state in 202.
  • the server may set the identification information of the login status validity. For example, if the record status is true, it is valid, and the record status is false, indicating that it has been The server fails to query the validity of the login state based on the identification information.
  • the server may record a valid time threshold, such as 30 minutes. When the payment application server queries the login state, the server compares the login duration with the valid time threshold, and if it exceeds or reaches 30 minutes, the failure may be determined.
  • the shopping application server may feed back to the server of the payment application in 203, the first login state is valid; and the payment application server may determine in 204 that both the first login state and the second login state are valid (the validity of the second login state)
  • the judgment mode is the same as the first login state, and the application access response is returned to the terminal. It can be seen that by establishing an association between the login states of the associated applications, it is easy to track the tracking process of the user and grasp the expiration time of the login state.
  • FIG. 3 illustrates a trust login device that can be applied to, for example, a shopping application server such that the shopping application server can execute the trust login method described above.
  • the device may include: a login state generating module 31 and a login state synchronization module 32;
  • the login state generating module 31 is configured to acquire device identification information of the user login device, and associate the device identifier information with the first login state after the user is in the first login state of the first application.
  • the login state synchronization module 32 is configured to send the device identification information and the first login state to a server of the second application, where the second application is an associated application that trusts the login with the first application, so that the Establishing, by the server, the second login state of the user in the second application according to the first login state, And correlating the device identification information with the second login state.
  • the login state generating module 31 is configured to: when the device identifier information of the user login device is obtained, generate the device identifier information according to the device information and the login information.
  • the device may further include: a login state management module 33, configured to receive a validity query request sent by the server for the first login state, and feed back the validity of the first login state to The server.
  • a login state management module 33 configured to receive a validity query request sent by the server for the first login state, and feed back the validity of the first login state to The server.
  • FIG. 5 illustrates a trust login device that can be applied to, for example, a payment application server such that the payment application server can execute the trust login method described above.
  • the device may include: a login state receiving module 51, a login state establishing module 52, and an access management module 53;
  • the login state receiving module 51 is configured to receive the first login state and the device identifier information sent by the server of the first application, where the first application is an associated application that is trusted to log in with the second application, and the first login state indicates that the user is in the The first application is logged in, and the device identification information is used to indicate that the user logs in to the login device of the first application;
  • the login state establishing module 52 is configured to establish, according to the first login state, the second login state of the user in the second application, and associate and store the device identification information and the second login state;
  • the access management module 53 is configured to: when receiving the application access request for the second application, if it is determined that the device identification information for sending the application access request and the corresponding second login state have been stored, returning an application access response.
  • the login state establishing module 52 is further configured to: after establishing the second login state of the second application, establish a correspondence between the first login state and the second login state;
  • the access management module 53 is further configured to: after determining that the device identification information for sending the application access request and the corresponding second login state have been stored, returning the validity of the first login state to the server before returning the application access response Query the request and determine that the first login state and the second login state are valid.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Power Engineering (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请提供一种信任登录方法和装置，其中方法包括：在建立用户在第一应用的第一登录态后，获取用户登录设备的设备标识信息，关联所述设备标识信息与所述第一登录态；将所述设备标识信息与第一登录态，发送至第二应用的服务器，所述第二应用是与所述第一应用信任登录的关联应用，以使得所述服务器根据所述第一登录态建立所述用户在所述第二应用的第二登录态，并关联所述设备标识信息与所述第二登录态。本申请可以提高信任登录的安全性。

Description

一种信任登录方法和装置 技术领域
本申请涉及网络技术，特别涉及一种信任登录方法和装置。
背景技术
信任登录也可以称为发生在两个应用之间的免登录，例如，用户在购物网站登录购物，当需要付款时跳转到支付网站，此时无需再输入支付网站的登录信息就可以直接支付，这就是从购物网站到支付网站的信任登录，即支付网站对于已经在购物网站登录的用户是信任的，因此用户不用在支付网站再次登录就可以直接在支付网站操作。
相关技术中，两个应用之间信任登录的方式可以是，当用户在应用A登录后，在应用A进行数字签名，并将签名添加到应用B的网站链接地址，作为链接地址的其中一个参数，该携带签名的地址可以称为信任登录网址。当用户点击信任登录网址访问应用B时，应用B校验该签名后获知已在应用A登录，则设置用户也在应用B登录。这种方式下，如果将信任登录网址随意复制，例如将其复制到另一个终端，则仍然能够访问应用B，存在安全隐患。
发明内容
有鉴于此，本申请提供一种信任登录方法和装置，以提高信任登录的安全性。
具体地，本申请是通过如下技术方案实现的：
第一方面，提供一种信任登录方法，包括：
在建立用户在第一应用的第一登录态后，获取用户登录设备的设备标识信息，关联所述设备标识信息与所述第一登录态；
将所述设备标识信息与第一登录态，发送至第二应用的服务器，所述第二应用是与所述第一应用信任登录的关联应用，以使得所述服务器根据所述第一登录态建立所述用户在所述第二应用的第二登录态，并关联所述设备标 识信息与所述第二登录态。
第二方面，提供一种信任登录方法，包括：
接收第一应用的服务器发送的第一登录态和设备标识信息，所述第一应用是与第二应用信任登录的关联应用，所述第一登录态表示用户在所述第一应用登录，所述设备标识信息用于表示用户登录第一应用的登录设备；
根据所述第一登录态，建立所述用户在所述第二应用的第二登录态，关联并存储所述设备标识信息与第二登录态；
在接收到对于所述第二应用的应用访问请求时，若确定发送所述应用访问请求的设备标识信息及对应的第二登录态已经存储，返回应用访问响应。
第三方面，提供一种信任登录装置，包括：
登录态生成模块，用于在建立用户在第一应用的第一登录态后，获取用户登录设备的设备标识信息，关联所述设备标识信息与所述第一登录态；
登录态同步模块，用于将所述设备标识信息与第一登录态，发送至第二应用的服务器，所述第二应用是与所述第一应用信任登录的关联应用，以使得所述服务器根据所述第一登录态建立所述用户在所述第二应用的第二登录态，并关联所述设备标识信息与所述第二登录态。
第四方面，提供一种信任登录装置，包括：
登录态接收模块，用于接收第一应用的服务器发送的第一登录态和设备标识信息，所述第一应用是与第二应用信任登录的关联应用，所述第一登录态表示用户在所述第一应用登录，所述设备标识信息用于表示用户登录第一应用的登录设备；
登录态建立模块，用于根据所述第一登录态，建立所述用户在所述第二应用的第二登录态，关联并存储所述设备标识信息与第二登录态；
访问管理模块，用于在接收到对于所述第二应用的应用访问请求时，若确定发送所述应用访问请求的设备标识信息及对应的第二登录态已经存储，返回应用访问响应。
本申请提供的信任登录方法和装置，通过由具有信任登录的关联关系的 第一应用和第二应用的服务器之间进行登录态的传输，使得服务器可以根据该登录态获知用户已经在关联应用登录，从而在关联应用之间建立信任登录，这种方式由于是依靠服务器之间相互通知获得信任登录的执行，相对于传统方式中的客户端之间传输登录信息的方式，将更可以提高信任登录的安全性。
附图说明
图1是本申请一示例性实施例示出的一种信任登录方法的流程图；
图2是本申请一示例性实施例示出的另一种信任登录方法的流程图；
图3是本申请一示例性实施例示出的一种信任登录装置的结构图；
图4是本申请一示例性实施例示出的另一种信任登录装置的结构图；
图5是本申请一示例性实施例示出的又一种信任登录装置的结构图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
信任登录是一种可以方便用户在不同应用之间无缝切换的免登录方式，例如，用户在登录了应用A之后，也就同时拥有了应用B的访问权限，应用B信任已经在应用A登录的用户。通常，可以信任登录的应用A和应用B的用户是同一用户(例如，用户使用同一账户分别在应用A和应用B注册)，或者两个应用的用户存在绑定关系(例如，用户分别在这两个应用注册的账户不同，但是具有绑定关系)。实际应用中，比如，在购物网站付款时跳转到支付网站的方式，就是一种信任登录的实现方式。
本申请实施例的信任登录方法和装置，用于在两个应用之间实现信任登录，并且，该方法将实现更加安全的信任登录。以购物应用和支付应用，两个应用之间的信任登录为例，其中，购物应用可以称为第一应用，支付应用 可以称为第二应用。应用采用客户端/浏览器(Browser/Server)模式，用户可以在终端(例如，电脑、智能手机等)上通过浏览器打开购物网站的网址，访问该购物应用，终端上访问的购物网站是该购物应用的客户端，应用内容是由后端的购物应用服务器传输至客户端解析显示。
参见图1的示例，在101中，用户在终端上输入账号和密码登录购物应用，在102中，购物应用的服务器对账号、密码等登录信息进行验证，本实施例假设通过验证。则在103中，服务器建立第一登录态，该第一登录态表示“上述账号和密码对应的用户，在终端上登录购物应用，并且登录成功”，登录态是记录的上述登录信息，例如可以包括：用户信息(账号)、登录时长、登录设备的环境(例如，浏览器版本、终端型号、终端的IP地址、MAC地址、手机的SIM卡号)等。也就是说，当用户登录应用成功后，该应用的服务器将会记录关于该应用登录的一些信息，这些信息就是登录态。
本申请实施例的信任登录方法中，描述登录态在图1所示的购物应用服务器与支付应用服务器之间的传输；其中，以用户从购物应用的网站链接跳转到支付应用为例，在这一由购物应用到支付应用的信任登录过程中，购物应用与支付应用是相互关联的(能够进行信任登录的关联)，购物应用可以称为支付应用的关联应用，支付应用也同样可以称为购物应用的关联应用。
继续参见图1所示，购物应用服务器在103中为用户建立的登录态，可以称为第一登录态(该“第一”只是用于与后面的其他登录态相区别)。在104中，购物应用服务器可以获取用户登录设备的设备标识信息，并建立该设备标识信息与第一登录态的关联关系。其中，所述的设备标识信息，可以用于唯一标识用户登录购物应用的终端设备，例如，该设备标识信息可以是购物应用服务器直接获取的可以标识设备的信息；或者，该设备标识信息也可以是购物应用服务器根据一些信息计算得到的。比如图1中的104示例的，可以通过终端的IP、MAC、进程ID(访问应用的进程)等信息计算出一个终端设备的ID作为设备标识信息，比如可以使用MD5算法对上述信息计算得到摘要信息。如果是不同的终端设备，那么通常上述的IP、MAC信息是 不同的，因此计算得到的设备标识信息也不相同，从而使得设备标识信息唯一标识登录设备。
在105中，购物应用服务器可以将设备标识信息与第一登录态都发送至支付应用服务器。例如，购物应用服务器可以在用户在购物应用中要跳转至支付应用时，将上述的设备标识信息和第一登录态发送至支付应用服务器。由于本申请实施例要执行的是信任登录过程，用户登录了购物应用，就可以免登录的直接在支付应用访问，因此，购物应用服务器可以在建立用户的第一登录态后，就通知支付应用服务器，使得支付应用服务器获知用户已经在购物应用登录，并据此建立用户在支付应用服务器的登录态，即相当于确定了用户已经可以在支付应用登录，尽管此时用户实际上尚未登录支付应用，但是支付应用已经确定了该用户可以在支付应用登录。
需要说明的是，在105中的同步登录态的过程中，购物应用主要是通知支付应用用户已经在购物应用登录，购物应用服务器向支付应用服务器传输的信息只要能够达到上述目的即可，具体传输的信息内容可以灵活设定。例如，同步的第一登录态信息包括：登录状态为true，该true用于表示“已经登录”；又例如，还可以进一步包括手机型号、浏览器类型等终端信息。即购物应用服务器向支付应用服务器传输的第一登录态包括的信息，可以不完全与购物应用服务器记录的第一登录态信息相同，至少应通知支付应用服务器“已经登录”的状态，使得支付应用服务器获知用户已经在购物应用登录。
此外，由于支付应用是从购物应用中跳转，因此购物应用能够知道与其产生信任登录关联的支付应用的服务器地址，并向该地址同步第一登录态。
在106中，支付应用服务器可以根据第一登录态，建立用户在本端的支付应用(即第二应用)的第二登录态，即记录用户在支付应用服务器已经登录的信息，比如上述的用户账号、手机型号、浏览器类型等信息；并且建立该第二登录态与设备标识信息的对应关系，以及存储该对应关系。
在107中，由于用户可以从购物应用跳转到支付应用，因此，购物应用服务器可以向终端返回支付应用的链接地址，例如是支付网站的URL；在本 申请实施例中，购物应用服务器可以不需要在支付应用的链接地址URL中添加签名。在108中，用户可以点击该链接地址访问支付应用。
支付应用服务器在接收到108中用户发送的应用访问请求后，将计算设备标识信息，计算方法同购物应用服务器的方法，比如根据终端设备的IP地址、MAC地址等计算设备标识信息，并查看计算得到的设备标识信息在支付应用服务器自身是否有存储。假如是同一用户在同一终端由购物应用跳转到支付应用，那么支付应用服务器在108中计算到的设备标识信息，与104中购物应用服务器计算的设备标识信息是相同的，支付应用服务器将能够找到自身存储有该设备标识信息及其对应的第二登录态。
若支付应用服务器存储有上述的应用访问请求对应的第二登录态，则支付应用服务器可以确定该用户已经在其关联应用即购物应用上登录，据此支付应用服务器可以信任该用户，允许该用户的访问，在111中向用户返回应用访问响应，比如将支付应用的内容反馈至用户终端。
假设一种情况，例如，仍然执行复制信任登录网址的方式，用户本来是在终端z1上登录并访问购物应用，后来复制支付应用的信任登录网址(该网址指的是用于从购物应用网站跳转到支付应用的链接地址)到终端z2，想要从终端z2访问支付应用。按照传统方式，支付应用服务器将验证信任登录网址中的签名即可同意用户访问支付应用，而本实施例中，支付应用服务器采取的是本申请中的信任登录方法，即不再通过签名(或者该链接中根本就没有签名)验证，而是计算终端z2对应的设备标识信息。根据上面描述的方法，支付应用服务器中存储的是终端z1的设备标识信息及对应的登录态，并没有存储终端z2对应的设备标识信息及对应的登录态，则据此支付应用服务器可以拒绝用户从终端z2发起的应用访问请求，防止不同终端之间的登录态的随意传输，提高应用访问的安全性。
由上述的描述可以看到，传统方式中登录态的传递(例如，支付应用获知用户在购物应用的已登录状态)是通过前端传输的，比如用户可以在前端的终端浏览器上点击应用跳转的链接触发这个传输(在链接中加入购物应用 的已登录状态签名)，因此导致链接地址容易被随意复制，支付应用服务器侧也无法辨识和控制。而本申请实施例中，将这种前端登录态的传输转为后端同步，即购物应用服务器与支付应用服务器之间的登录态同步，用户在前端是无法看到的，后端的服务器之间执行信任登录的过程，使得信任登录过程不可见，支付应用服务器通过服务器之间的登录态同步来获知用户在购物应用登录，并同时建立对该用户的信任。并且，支付应用服务器还可以根据获得的服务器之间的同步登录态的设备标识信息，来控制和防止不同终端之间的随意复制，提高了信任登录的安全性。
在另一个例子中，信任登录通常会要求同一用户在同一终端以可信任的免登录的方式访问关联应用，据此可以在生成设备标识信息时，根据设备信息和登录信息生成所述设备标识信息。例如，设备信息包括：设备的IP地址、MAC地址、进程ID等，登录信息例如包括：用户的账号、密码等，如果用户采用不同的账号信息进行登录，那么计算出的设备标识信息将不一致，从而通过该设备标识信息可以保证同一终端和同一用户。
在又一个例子中，实际使用中还可能出现的情况是，信任登录关联的两个应用之间，可能出现其中一个应用的有效时间到达，而另一个应用无法感知仍然继续访问。比如，有些应用是存在有效时间控制的，假设购物应用的有效时间是30分钟，超过30分钟用户在该应用的登录态将失效，用户将重新登录该应用；那么当信任登录时，支付应用服务器也需要再重新查询下当前的购物应用侧的登录态是否有效，如果仍然有效且支付应用自身的登录态也有效，支付应用才执行信任登录。
为实现上述目的，图2示例的流程中(相比图1省略了相同的101-104)，支付应用服务器在建立用户在本端的第二登录态之后，还可以执行201，即建立第一登录态和第二登录态的对应关系。例如，这两个登录态都与上述的设备标识信息对应，只要根据设备标识信息就可以找到对应的第一登录态和第二登录态；又例如，在105中购物应用服务器在同步登录态时，可以随机生成一个登录态ID(不限制生成方式及具体的ID形式)，该登录态ID可以 用于标识具有关联关系的第一登录态和第二登录态，即支付应用服务器会将第一登录态和第二登录态都与该登录态ID对应，根据该登录态ID就可以找到对应的第一登录态和第二登录态。
当支付应用服务器接收到应用访问请求并且获取到对应的第二登录态以后，可以根据上述的对应关系记录，查找到与该第二登录态对应的第一登录态，并据此得知该第一登录态是购物应用服务器发送的(接收同步的第一登录态时可以记录源设备的地址)，支付应用服务器可以在202中向购物应用服务器查询第一登录态的有效性。
在购物应用服务器侧，判断第一登录态的有效性的方式可以有多种，例如，服务器可以设置登录态有效性的标识信息，比如，记录状态为true表示正在有效，记录状态为false表示已经失效；服务器可以根据该标识信息查询登录态的有效性。又例如，服务器可以记录有效时间阈值比如30分钟，当支付应用服务器查询登录态状态时，服务器将登录时长与该有效时间阈值比较，如果超过或达到30分钟则可以确定失效。
购物应用服务器可以在203中向支付应用的服务器反馈，第一登录态有效；并且，支付应用服务器可以在204中确定第一登录态和第二登录态均有效后(第二登录态的有效性判断方式同第一登录态)，向终端返回应用访问响应。可以看到，通过在关联应用的登录态之间也建立关联，可以容易跟踪用户的跟踪过程，掌握登录态的失效时间。
图3示例了一种信任登录装置，该装置可以应用于例如购物应用服务器，使得购物应用服务器可以执行上述的信任登录方法。如图3所示，该装置可以包括：登录态生成模块31和登录态同步模块32；其中，
登录态生成模块31，用于在建立用户在第一应用的第一登录态后，获取用户登录设备的设备标识信息，关联所述设备标识信息与所述第一登录态；
登录态同步模块32，用于将所述设备标识信息与第一登录态，发送至第二应用的服务器，所述第二应用是与所述第一应用信任登录的关联应用，以使得所述服务器根据所述第一登录态建立所述用户在第二应用的第二登录态， 并关联所述设备标识信息与第二登录态。
进一步的，登录态生成模块31，在获取用户登录设备的设备标识信息时，具体用于：根据设备信息和登录信息生成所述设备标识信息。
参见图4的示例，该装置还可以包括：登录态管理模块33，用于接收所述服务器发送的对于第一登录态的有效性查询请求，并将所述第一登录态的有效性反馈至所述服务器。
图5示例了一种信任登录装置，该装置可以应用于例如支付应用服务器，使得支付应用服务器可以执行上述的信任登录方法。如图5所示，该装置可以包括：登录态接收模块51、登录态建立模块52和访问管理模块53；其中，
登录态接收模块51，用于接收第一应用的服务器发送的第一登录态和设备标识信息，所述第一应用是与第二应用信任登录的关联应用，所述第一登录态表示用户在所述第一应用登录，所述设备标识信息用于表示用户登录第一应用的登录设备；
登录态建立模块52，用于根据所述第一登录态，建立所述用户在第二应用的第二登录态，关联并存储所述设备标识信息与第二登录态；
访问管理模块53，用于在接收到对于所述第二应用的应用访问请求时，若确定发送所述应用访问请求的设备标识信息及对应的第二登录态已经存储，返回应用访问响应。
进一步的，登录态建立模块52，还用于：在建立所述用户在第二应用的第二登录态之后，建立第一登录态和第二登录态的对应关系；
所述访问管理模块53，还用于：在确定发送应用访问请求的设备标识信息及对应的第二登录态已经存储之后，返回应用访问响应之前，向所述服务器发送第一登录态的有效性查询请求，并确定第一登录态和第二登录态有效。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (10)

  1. 一种信任登录方法，其特征在于，包括：
    在建立用户在第一应用的第一登录态后，获取用户登录设备的设备标识信息，关联所述设备标识信息与所述第一登录态；
    将所述设备标识信息与第一登录态，发送至第二应用的服务器，所述第二应用是与所述第一应用信任登录的关联应用，以使得所述服务器根据所述第一登录态建立所述用户在所述第二应用的第二登录态，并关联所述设备标识信息与所述第二登录态。
  2. 根据权利要求1所述的方法，其特征在于，所述获取用户登录设备的设备标识信息，包括：根据设备信息和登录信息生成所述设备标识信息。
  3. 根据权利要求1所述的方法，其特征在于，在所述发送至第二应用的服务器之后，还包括：
    接收所述服务器发送的对于第一登录态的有效性查询请求，并将所述第一登录态的有效性反馈至所述服务器。
  4. 一种信任登录方法，其特征在于，包括：
    接收第一应用的服务器发送的第一登录态和设备标识信息，所述第一应用是与第二应用信任登录的关联应用，所述第一登录态表示用户在所述第一应用登录，所述设备标识信息用于表示用户登录第一应用的登录设备；
    根据所述第一登录态，建立所述用户在所述第二应用的第二登录态，关联并存储所述设备标识信息与第二登录态；
    在接收到对于所述第二应用的应用访问请求时，若确定发送所述应用访问请求的设备标识信息及对应的第二登录态已经存储，返回应用访问响应。
  5. 根据权利要求4所述的方法，其特征在于，在建立所述用户在第二应用的第二登录态之后，还包括：建立第一登录态和第二登录态的对应关系；
    在确定发送所述应用访问请求的设备标识信息及对应的第二登录态已经存储之后，返回应用访问响应之前，还包括：向所述服务器发送第一登录态 的有效性查询请求，并确定第一登录态和第二登录态有效。
  6. 一种信任登录装置，其特征在于，包括：
    登录态生成模块，用于在建立用户在第一应用的第一登录态后，获取用户登录设备的设备标识信息，关联所述设备标识信息与所述第一登录态；
    登录态同步模块，用于将所述设备标识信息与第一登录态，发送至第二应用的服务器，所述第二应用是与所述第一应用信任登录的关联应用，以使得所述服务器根据所述第一登录态建立所述用户在所述第二应用的第二登录态，并关联所述设备标识信息与所述第二登录态。
  7. 根据权利要求6所述的装置，其特征在于，
    所述登录态生成模块，在获取用户登录设备的设备标识信息时，具体用于：根据设备信息和登录信息生成所述设备标识信息。
  8. 根据权利要求6所述的装置，其特征在于，还包括：
    登录态管理模块，用于接收所述服务器发送的对于第一登录态的有效性查询请求，并将所述第一登录态的有效性反馈至所述服务器。
  9. 一种信任登录装置，其特征在于，包括：
    登录态接收模块，用于接收第一应用的服务器发送的第一登录态和设备标识信息，所述第一应用是与第二应用信任登录的关联应用，所述第一登录态表示用户在所述第一应用登录，所述设备标识信息用于表示用户登录第一应用的登录设备；
    登录态建立模块，用于根据所述第一登录态，建立所述用户在所述第二应用的第二登录态，关联并存储所述设备标识信息与第二登录态；
    访问管理模块，用于在接收到对于所述第二应用的应用访问请求时，若确定发送所述应用访问请求的设备标识信息及对应的第二登录态已经存储，返回应用访问响应。
  10. 根据权利要求9所述的装置，其特征在于，
    所述登录态建立模块，还用于：在建立所述用户在第二应用的第二登录态之后，建立第一登录态和第二登录态的对应关系；
    所述访问管理模块，还用于：在确定发送应用访问请求的设备标识信息及对应的第二登录态已经存储之后，返回应用访问响应之前，向所述服务器发送第一登录态的有效性查询请求，并确定第一登录态和第二登录态有效。
PCT/CN2016/079555 2015-05-12 2016-04-18 一种信任登录方法和装置 WO2016180171A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
SG11201708989QA SG11201708989QA (en) 2015-05-12 2016-04-18 Trusted login method and apparatus
KR1020177035829A KR102150750B1 (ko) 2015-05-12 2016-04-18 신뢰받는 로그인 방법 및 장치
JP2017559055A JP6756738B2 (ja) 2015-05-12 2016-04-18 信頼できるログイン方法及び装置
EP16792021.4A EP3297243B1 (en) 2015-05-12 2016-04-18 Trusted login method and device
US15/809,780 US10673834B2 (en) 2015-05-12 2017-11-10 Establishing a trusted login procedure
US16/884,966 US10917397B2 (en) 2015-05-12 2020-05-27 Establishing a trusted login procedure

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510239796.0A CN106302308B (zh) 2015-05-12 2015-05-12 一种信任登录方法和装置
CN201510239796.0 2015-05-12

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/809,780 Continuation US10673834B2 (en) 2015-05-12 2017-11-10 Establishing a trusted login procedure

Publications (1)

Publication Number Publication Date
WO2016180171A1 true WO2016180171A1 (zh) 2016-11-17

Family

ID=57247737

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/079555 WO2016180171A1 (zh) 2015-05-12 2016-04-18 一种信任登录方法和装置

Country Status (7)

Country Link
US (2) US10673834B2 (zh)
EP (1) EP3297243B1 (zh)
JP (1) JP6756738B2 (zh)
KR (1) KR102150750B1 (zh)
CN (1) CN106302308B (zh)
SG (1) SG11201708989QA (zh)
WO (1) WO2016180171A1 (zh)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106302308B (zh) 2015-05-12 2019-12-24 阿里巴巴集团控股有限公司 一种信任登录方法和装置
US10469497B2 (en) * 2016-05-26 2019-11-05 Dropbox, Inc. Identifying accounts having shared credentials
CN109379324B (zh) * 2018-08-21 2021-12-14 中至数据集团股份有限公司 网站访问方法、装置、可读存储介质及计算机设备
CN109981677B (zh) * 2019-04-08 2021-02-12 北京深思数盾科技股份有限公司 一种授信管理方法及装置
CN110417863B (zh) * 2019-06-27 2021-01-29 华为技术有限公司 生成身份识别码的方法和装置、身份认证的方法和装置
CN110636061B (zh) * 2019-09-20 2022-03-25 深圳市信锐网科技术有限公司 业务服务器接入方法、存储介质、终端设备及登录服务器
CN111368158A (zh) * 2020-03-31 2020-07-03 中国建设银行股份有限公司 基于人工智能平台的服务查找方法及装置
CN111552944A (zh) * 2020-04-28 2020-08-18 成都新潮传媒集团有限公司 一种登录验证方法及装置
CN111598582A (zh) * 2020-04-28 2020-08-28 华润守正招标有限公司 客服方法、系统、电子设备及存储介质
US20220012701A1 (en) * 2020-07-09 2022-01-13 Jpmorgan Chase Bank, N.A. Systems and methods for facilitating payment service-based checkout with a merchant
CN112231667B (zh) * 2020-11-09 2022-02-18 腾讯科技（深圳）有限公司 身份核验方法、装置、存储介质、系统及设备
CN112462661B (zh) * 2020-11-27 2021-11-16 星控物联科技(山东)有限公司 工业数据采集控制器及其控制方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20040066394A (ko) * 2003-01-17 2004-07-27 신현수 로그인(Login) 정보처리 시스템
CN102622270A (zh) * 2011-01-26 2012-08-01 腾讯科技（深圳）有限公司 一种应用程序的切换管理方法和终端
CN104268457A (zh) * 2014-09-22 2015-01-07 联想(北京)有限公司 信息处理方法、电子设备和服务器
WO2015010558A1 (en) * 2013-07-24 2015-01-29 Tencent Technology (Shenzhen) Company Limited Methods and systems for controlling mobile terminal access to a third-party server

Family Cites Families (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2002335239A (ja) * 2001-05-09 2002-11-22 Nippon Telegr & Teleph Corp <Ntt> シングルサインオン認証方法及びシステム装置
BR0214760A (pt) * 2001-12-06 2004-11-09 Access Co Ltd Sistema e método para fornecer serviços de conteúdo de assinatura para dispositivos móveis
US7437457B1 (en) * 2003-09-08 2008-10-14 Aol Llc, A Delaware Limited Liability Company Regulating concurrent logins associated with a single account
WO2007047183A2 (en) * 2005-10-11 2007-04-26 Citrix Systems, Inc. Systems and methods for facilitating distributed authentication
US8176327B2 (en) * 2006-12-27 2012-05-08 Airvana, Corp. Authentication protocol
JP4828402B2 (ja) * 2006-12-28 2011-11-30 ブラザー工業株式会社 情報処理装置および情報処理プログラム
US7818396B2 (en) * 2007-06-21 2010-10-19 Microsoft Corporation Aggregating and searching profile data from multiple services
US7979899B2 (en) * 2008-06-02 2011-07-12 Microsoft Corporation Trusted device-specific authentication
CN102299936B (zh) * 2010-06-25 2015-07-22 腾讯科技（深圳）有限公司 一种应用网站的访问方法和装置
US9473485B2 (en) * 2011-03-21 2016-10-18 Blue Cedar Networks, Inc. Secure single sign-on for a group of wrapped applications on a computing device and runtime credential sharing
US8869244B1 (en) * 2011-05-03 2014-10-21 Symantec Corporation Techniques for providing role-based access control using dynamic shared accounts
US20130086669A1 (en) * 2011-09-29 2013-04-04 Oracle International Corporation Mobile application, single sign-on management
CN103188207B (zh) * 2011-12-27 2016-07-13 北大方正集团有限公司 一种跨域的单点登录实现方法及系统
CN103188237A (zh) * 2011-12-30 2013-07-03 盛大计算机（上海）有限公司 单点登录系统及方法
JP5988699B2 (ja) * 2012-05-30 2016-09-07 キヤノン株式会社 連携システム、その連携方法、情報処理システム、およびそのプログラム。
JP2013257806A (ja) * 2012-06-14 2013-12-26 Nec Fielding Ltd 認証システム、認証方法、認証処理代行装置、端末装置、認証処理代行方法、端末装置の制御方法、及びプログラム
US8949596B2 (en) * 2012-07-10 2015-02-03 Verizon Patent And Licensing Inc. Encryption-based session establishment
US8769651B2 (en) * 2012-09-19 2014-07-01 Secureauth Corporation Mobile multifactor single-sign-on authentication
US9203838B2 (en) * 2012-10-31 2015-12-01 Google Inc. Providing network access to a device associated with a user account
US9397989B1 (en) * 2013-07-03 2016-07-19 Amazon Technologies, Inc. Bootstrapping user authentication on devices
CN104580074B (zh) * 2013-10-14 2018-08-24 阿里巴巴集团控股有限公司 客户端应用的登录方法及其相应的服务器
CN105337735B (zh) * 2014-05-26 2019-06-07 阿里巴巴集团控股有限公司 数字证书处理及校验的方法和装置
US10313264B2 (en) * 2014-05-28 2019-06-04 Apple Inc. Sharing account data between different interfaces to a service
CN106302308B (zh) 2015-05-12 2019-12-24 阿里巴巴集团控股有限公司 一种信任登录方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20040066394A (ko) * 2003-01-17 2004-07-27 신현수 로그인(Login) 정보처리 시스템
CN102622270A (zh) * 2011-01-26 2012-08-01 腾讯科技（深圳）有限公司 一种应用程序的切换管理方法和终端
WO2015010558A1 (en) * 2013-07-24 2015-01-29 Tencent Technology (Shenzhen) Company Limited Methods and systems for controlling mobile terminal access to a third-party server
CN104268457A (zh) * 2014-09-22 2015-01-07 联想(北京)有限公司 信息处理方法、电子设备和服务器

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3297243A4 *

Also Published As

Publication number Publication date
KR20180008592A (ko) 2018-01-24
US20200287886A1 (en) 2020-09-10
CN106302308A (zh) 2017-01-04
CN106302308B (zh) 2019-12-24
US10917397B2 (en) 2021-02-09
EP3297243B1 (en) 2021-07-07
US10673834B2 (en) 2020-06-02
JP2018519569A (ja) 2018-07-19
JP6756738B2 (ja) 2020-09-16
EP3297243A1 (en) 2018-03-21
KR102150750B1 (ko) 2020-09-02
SG11201708989QA (en) 2017-11-29
US20180097801A1 (en) 2018-04-05
EP3297243A4 (en) 2018-11-07

Similar Documents

Publication Publication Date Title
WO2016180171A1 (zh) 一种信任登录方法和装置
CN108681965B (zh) 离线节点的区块链网络交易处理方法和装置
US20220215082A1 (en) Method and apparatus for facilitating the login of an account
US9762586B2 (en) System and method for controlling mutual access of smart devices
TWI587672B (zh) Login authentication method, client, server and system
US9923906B2 (en) System, method and computer program product for access authentication
EP3316544B1 (en) Token generation and authentication method, and authentication server
WO2015143855A1 (zh) 一种对数据资源进行访问的方法、装置和系统
US20160381001A1 (en) Method and apparatus for identity authentication between systems
US20180365395A1 (en) Multimedia data processing method, apparatus, system, and storage medium
WO2016127436A1 (zh) 数据上载的方法、装置及系统
WO2016054990A1 (zh) 安全校验方法、装置、终端及服务器
WO2015085664A1 (zh) 一种同步方法及终端、服务器
Huang et al. A token-based user authentication mechanism for data exchange in RESTful API
CN111092958B (zh) 一种节点接入方法、装置、系统及存储介质
KR101550256B1 (ko) 컴퓨터 네트워크에서 서버에 액세스하기 위한 서버， 시스템， 방법， 컴퓨터 프로그램 및 컴퓨터 프로그램 제품
US20170105119A1 (en) User equipment proximity requests authentication
TW201824887A (zh) 以認證伺服器在伺服群組中實現免登入之系統及其方法
KR101853350B1 (ko) 연합인증의 국가적 연동을 위한 단말장치 및 그 동작 방법
CN117176354A (zh) 数据处理方法、装置及设备、介质、产品
KR20210144664A (ko) 통신 네트워크 측정치의 데이터 조작 방지 및 사용자 프라이버시 보호
WO2016070652A1 (zh) 交互式网络电视iptv登录方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16792021

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11201708989Q

Country of ref document: SG

ENP Entry into the national phase

Ref document number: 2017559055

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20177035829

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2016792021

Country of ref document: EP