WO2016188224A1 - 一种业务授权方法、装置、系统及路由器 - Google Patents

一种业务授权方法、装置、系统及路由器 Download PDF

Info

Publication number
WO2016188224A1
WO2016188224A1 PCT/CN2016/077968 CN2016077968W WO2016188224A1 WO 2016188224 A1 WO2016188224 A1 WO 2016188224A1 CN 2016077968 W CN2016077968 W CN 2016077968W WO 2016188224 A1 WO2016188224 A1 WO 2016188224A1
Authority
WO
WIPO (PCT)
Prior art keywords
resource request
server
router
service authorization
request
Prior art date
Application number
PCT/CN2016/077968
Other languages
English (en)
French (fr)
Inventor
张国良
Original Assignee
乐视控股（北京）有限公司
乐视致新电子科技（天津）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 乐视控股（北京）有限公司, 乐视致新电子科技（天津）有限公司 filed Critical 乐视控股（北京）有限公司
Publication of WO2016188224A1 publication Critical patent/WO2016188224A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a service authorization method, apparatus, system, and router.
  • the user in order to obtain the service authorization of the server, the user often needs to send an authentication request including user authentication information (generally a user name and a password) to the server.
  • user authentication information generally a user name and a password
  • the subsequent server grants the corresponding service authority to the user according to the authentication request.
  • the user is granted specific video rights, information browsing rights, rights to download information to the user, information modification rights, permissions to save information on the server, and the like.
  • the playback of network video has the following viewing channels: on the PC side, the network video is placed on the video website for viewing, such as LeTV, Sohu video, Youku, etc.; on the mobile terminal such as mobile phone and pad, it is on the mobile app.
  • Watching such as LeTV video app, Sohu video app, etc.; on the TV side, it is placed on the TV app to watch, such as LeTV TV version; in the future car, it is placed on the car's mobile video app for viewing. And, sometimes online video distinguishes between free and paid video, and for paid video, only paid members can watch it.
  • LeTV's paid members it can watch paid videos through the PC-side LeTV, the mobile LeTV video app, and the TV-TV TV version, and realize the same paying account multi-terminal access, that is, an account of a user.
  • the embodiments of the present invention provide a service authorization method, device, system, and router, which are used to solve the problem that different user terminals in the signal coverage of the same wireless router request service rights. Low problem.
  • a service authorization method on the router side, the router has an authentication credential based on the service authorization, including: obtaining a first resource request sent by the user terminal; determining whether the first resource request needs to obtain a service Authorizing; if yes, generating and sending to the server a second resource request including the authentication credential to trigger server execution: performing service authorization after verifying the authentication credential in the second resource request, so that the user terminal
  • the service authorization is provided when the router accesses the server as a network connection intermediary; if not, the first resource request is forwarded to the server.
  • a computer readable recording medium having recorded thereon a program for executing the above method.
  • a third aspect includes: receiving a resource request sent by a router; the resource request includes an authentication credential of the router based on a service authorization; and verifying the authentication credential; After the authentication credential is verified, the service authorization is performed, so that the user terminal has the service authorization when the router accesses the server as the network connection intermediary.
  • a computer readable recording medium having recorded thereon a program for executing the above method.
  • a service authorization method includes: a router obtains a first resource request sent by a user terminal; the router has an authentication credential based on the service authorization; and the router determines whether the first resource request needs to obtain a service authorization; When the router determines that the first resource request needs to obtain a service authorization, the router generates and sends a second resource request that includes the authentication credential to the server according to the first resource request; and determines that the first resource request does not need to be obtained.
  • the service is authorized, the first resource request is forwarded to the server; after the server verifies the authentication credential included in the second resource request, the server performs service authorization, so that the user terminal accesses the server by using the router as a network connection intermediary.
  • the business authorization is available at the time.
  • a computer readable recording medium having recorded thereon a program for executing the above method.
  • a router has authentication credentials based on the service authorization, and the router includes:
  • a resource request obtaining unit configured to obtain a first resource request sent by the user terminal
  • a determining unit configured to determine whether the first resource request needs to obtain a service authorization
  • a resource request sending unit where the determining result obtained by the determining unit is When yes, generating and sending to the server a second resource request that includes the authentication credential, to trigger the server to perform: performing service authorization after verifying the authentication credential in the second resource request, so that the user terminal is in the router
  • the service authorization is provided when the network connection agent accesses the server; when the judgment result obtained by the judgment unit is negative, the first resource request is forwarded to the server.
  • a service authorization apparatus includes: a request receiving unit, configured to receive a resource request sent by a router; the resource request includes an authentication credential of the router; and an authorization unit, configured to verify the authentication credential; After the authentication credential is verified, the service authorization is performed, so that the user terminal has the service authorization when the router accesses the server as a network connection intermediary.
  • a service authorization system comprising: a router and a server, wherein the router has an authentication credential based on the service authorization; a router, configured to obtain a first resource request sent by the user terminal; and determining whether the first resource request is Requiring a service authorization; when determining that the first resource request needs to obtain a service authorization, generating, according to the first resource request, a second resource request that includes the authentication credential; and determining the first resource
  • the server is configured to perform service authorization after verifying that the authentication credential included in the second resource request is passed, so that the user terminal is in the The router has the service authorization when accessing the server for the network connection intermediary.
  • FIG. 1 is a schematic flowchart of implementing a service authorization method according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic flowchart of implementing a service authorization method according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic flowchart of implementing a service authorization method according to Embodiment 3 of the present invention.
  • FIG. 4 is a schematic flowchart of an implementation method of an authentication method according to Embodiment 4 of the present invention.
  • FIG. 5 is a schematic flowchart of an implementation method of an authentication method according to Embodiment 5 of the present invention.
  • FIG. 6 is a schematic diagram of an application process of a method according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a router according to Embodiment 7 of the present invention.
  • FIG. 8 is a schematic structural diagram of a service authorization apparatus according to Embodiment 8 of the present invention.
  • FIG. 9 is a schematic structural diagram of a service authorization system according to Embodiment 9 of the present invention.
  • FIG. 10 is a schematic structural diagram of a router according to Embodiment 10 of the present invention.
  • the schematic diagram of the implementation process of the method is as shown in FIG. 1 and includes the following steps:
  • step 11 the router obtains the resource request sent by the user terminal.
  • the resource request sent by the user terminal may be referred to as a first resource request.
  • the first resource request may or may not include an identifier of the user terminal.
  • the identifier of the user terminal generally refers to an identifier that can uniquely represent the user terminal. For example, it may be an IP address, a MAC address, or a communication number (such as a mobile phone number) used by the user terminal.
  • the first resource request may include user authentication information.
  • the user authentication information is not a necessary condition for implementing the solution. That is, in this solution, the user is not required to input the user authentication information into the user terminal; in addition, whether or not the user authentication information is included in the first resource request does not affect the implementation of the solution.
  • the router may be a router that establishes a connection with the user terminal by using a wireless or a wired manner.
  • authentication credentials based on service authorization are stored.
  • the authentication credential based on the service authorization refers to: information indicating that the device (or user) that sends the authentication credential has the relevant authority of a certain service.
  • the term "having relevant rights for a certain service" as used herein may include, but is not limited to, having the viewing rights of a specific video, the right to browse information, the right to download information to the user, the right to modify the information, and the right to save the information on the server. and many more.
  • the authentication credentials are generally recognized by at least one server. That is, the at least one server may determine, according to the authentication credential, that the device (or user) that sends the authentication credential is eligible to have the relevant authority of the corresponding service, thereby granting the device (or user) the corresponding authority.
  • the authentication credential can be a factory setting information of the router, or it can be sent by the server to the router.
  • the server may send to the router after determining that the router has a payment identifier (ie, the user using the router has purchased a certain service right).
  • a server for receiving a resource request (including a first resource request and a second resource request) and a server for performing service authorization according to the request may be referred to as a resource server.
  • the existence form and format of the authentication credential are not limited.
  • step 12 the router determines whether the first resource request needs to obtain the service authorization. If the judgment result is yes, step 13 is performed.
  • one of the following manners may be used to determine whether the first resource request needs to obtain a service authorization.
  • the first mode the router determines, according to the server identifier included in the first resource request, whether the first resource request needs to be sent to a specific server; when the determination result is yes, determining that the first resource request needs to obtain the service authorization; otherwise, determining The first resource request does not require a business authorization.
  • the server identifier mentioned here can be, but is not limited to, the domain name information of the server or the IP address of the server, and the like, which uniquely represents a server.
  • the identifier of a specific server may be stored in a server identifier library local to the router.
  • the server identification library can be a database dedicated to saving the identity of a specific server. Then, if the router receives the first resource request, the router may obtain the server identifier from the first resource request, and determine whether the obtained server identifier is the same as a server identifier in the server identifier library. If they are the same, it can be determined that the first resource request needs to obtain a service authorization, otherwise, it is determined that the first resource request does not need to obtain a service authorization.
  • the first resource request may be directly sent to the server corresponding to the identifier according to the server identifier in the first resource request.
  • the second mode the router determines, according to the server identifier included in the first resource request, whether the first resource request needs to be sent to a specific server (that is, a server used for authorization for the router in the following text); when the judgment result is yes, Determine whether the first resource request is used to request payment a resource; determining that the first resource request needs to obtain a service authorization when determining that the first resource request is used to obtain the paid resource; determining that the first resource request does not need to obtain when determining that the first resource request is used to request to obtain the free resource Business authorization.
  • a specific server that is, a server used for authorization for the router in the following text
  • the first resource request may be directly sent to the server corresponding to the identifier according to the server identifier in the first resource request.
  • the “paid resource” may refer to any resource that can be obtained after the service authorization is required.
  • Free resources can refer to any resource that can be obtained without authorization for business. For example, public data resources that are available to any user for free, etc.
  • Step 13 The router generates and sends a resource request (referred to as a second resource request) including the authentication credential of the router to the server, to trigger the server to perform: performing service authorization after verifying the authentication credential in the second resource request, so that The user terminal has the service authorization when the router accesses the server as a network connection intermediary.
  • a resource request referred to as a second resource request
  • the server mentioned here is a specific server. Specifically, it can be a video website server, and the like.
  • the authentication credential of the router can be obtained in three ways: the first type is the unique identifier of the router itself, which is used as the authentication credential; for example, the MAC address of the router, the IP address of the router, and the product sequence uniquely indicating the router.
  • the second type is the credential information provided by the server, such as the authentication private key and token provided by the server;
  • the third type can be the user provided by the user.
  • the personal information itself is used as the authentication credential.
  • the account and password used by a user to log in to the server can be preset to the router as the authentication credential of the router.
  • the manner of obtaining the first type and the three types of authentication credentials cannot be juxtaposed with the manner of obtaining the second type of authentication credentials.
  • the router needs to send an authentication request including the authentication information to the server; and the receiving and saving server can obtain the authentication credential after the authentication information is verified.
  • the authentication information herein may include, but is not limited to, a unique identifier (as enumerated above) possessed by the router itself, or user personal information provided by the user (as listed above). and many more.
  • the router itself has The unique identifier of the backup, or the user's personal information provided by the user, can be used as the authentication credential in the first and third authentication credential obtaining manners respectively; and in the second authentication credential obtaining manner, the two are only It is the authentication request information, not the authentication credential. It needs to be verified by the server according to the received authentication request information. After the authentication is passed, the authentication credential is sent.
  • timing at which the router sends the authentication information to the server may be any time before the second resource request is generated and sent to the server.
  • a server for receiving an authentication request and sending credential information to the router according to the authentication request may be referred to as an authentication server.
  • the resource server and the authentication server respectively implement the service authorization and the credential information grant, so that the two servers can share the load, thereby avoiding a single The server is overloaded.
  • the credential information generally has an expiration date. If the server receives the credential information within the validity period of the credential information, the server may perform the service authorization after the credential information is verified, and if the server determines that the credential information has expired, the service authority is not granted to the user terminal. .
  • the server can start by providing the credential information from the server to the router, and initiate timing monitoring for the validity period.
  • the method for generating the second resource request may include: generating a second resource request according to the set data encryption rule.
  • the data encryption rule referred to herein may refer to a data encryption rule required by a data transmission tunnel established between a router and a server, or may be a data encryption rule agreed by the router and the server in other manners.
  • the authentication request including the authentication information described above may be encrypted according to the rule, thereby ensuring the authentication information. safety.
  • Embodiment 1 of the present invention since the router can assist the user terminal to obtain the service authority granted by the server according to the authentication credential, the signal of the same wireless router is overwritten.
  • the user can obtain the service authorization without inputting the user authentication information to the user terminal, thereby improving the efficiency of the service authorization process and saving the processing of the user terminal. Resources.
  • the above method can also produce the following beneficial effects:
  • the second embodiment of the present invention provides a service authorization method, which is used to solve the problem that different user terminals in the signal coverage of the same wireless router request service rights.
  • user authentication information needs to be input to the user terminal, thereby causing services.
  • the authorization process is less efficient.
  • the implementation flow chart of the method is as shown in FIG. 2, and includes the following steps:
  • Step 21 Receive a resource request sent by a router.
  • the service authorization request is equivalent to the second resource request mentioned in Embodiment 1, and includes the authentication certificate of the router based on the service authorization.
  • Step 22 Verify the authentication credential, and perform service authorization after the authentication credential is verified, so that the user terminal has the service authorization when the router accesses the server as a network connection intermediary.
  • the user terminal referred to herein may be a user terminal that triggers a router to send a service authorization request, or may be a user terminal that accesses the server by using a router as a network connection intermediary after the service authorization is completed.
  • the method may further include the following steps:
  • the authentication credential is sent to the router.
  • execution bodies of the steps of the method provided in Embodiment 2 may all be the same device, or the method may also be performed by different devices.
  • the router can assist the user terminal to obtain the service authority granted by the server according to the authentication credential, so that different user terminals in the signal coverage range of the same wireless router request the service authority, Based on the assistance of the router, the user can obtain the service authorization by inputting the user authentication information to the user terminal, thereby improving the efficiency of the service authorization process, saving the processing resources of the user terminal, and thereby improving the user experience.
  • the third embodiment of the present invention provides a service authorization method for solving the request for service rights of different user terminals in the signal coverage area of the same wireless router.
  • it is required to input user authentication information to the user terminal, thereby causing a problem that the service authorization process is inefficient.
  • FIG. 3 A schematic flowchart of the implementation of the method is shown in FIG. 3, and includes the following steps:
  • Step 31 The router obtains the first resource request sent by the user terminal.
  • the router has authentication credentials based on the service authorization
  • Step 32 When determining that the first resource request needs to obtain the service authorization, the router generates and sends a second resource request including the authentication credential of the router to the server according to the first resource request.
  • Step 33 The server performs the service authorization after the authentication credential included in the second resource request is verified, so that the user terminal has the service authorization when the router accesses the server as the network connection intermediary.
  • the router may forward the first resource request to the corresponding server.
  • the router determines whether the first resource request needs to obtain the service authorization, and may be, but is not limited to, adopting one of the two determination modes provided in Embodiment 1 of the present application, and details are not described herein again.
  • the method provided in Embodiment 3 may further include the following steps:
  • the router sends a service authorization authentication request to the server
  • the router obtains the service authorization-based authentication credentials sent back by the server and stores the authentication credentials on the router.
  • Embodiment 2 of the present invention is adopted, because the authentication credential can be determined by the router. Assisting the user terminal to obtain the service authority granted by the server, so that in the scenario that different user terminals in the signal coverage of the same wireless router request service rights, the user can obtain the service without inputting the user authentication information to the user terminal based on the assistance of the router. Authorization, thus improving the efficiency of the business authorization process, saving the processing resources of the user terminal, thereby improving the user experience.
  • Embodiment 4 provides an authentication method for implementing a router to locally store authentication credentials on a router so that the router subsequently authenticates the credentials.
  • the implementation process of the method is as shown in FIG. 4, and includes the following steps:
  • Step 41 The router sends an authentication request for the service authorization including the authentication information to the server.
  • the authentication information mentioned herein may be, but not limited to, including a unique identifier possessed by the router itself, or user personal information provided by the user, and the like.
  • step 42 the router obtains the service authorization-based authentication credentials sent back by the server and saves them.
  • the user terminal can use the router as a network connection intermediary to access resources that require the server to perform service authorization.
  • Embodiment 4 of the present invention creatively proposes that the authentication credential is saved by the router, so that the second resource request is subsequently generated according to the authentication credential, so that the function of the router is greatly changed, and the user terminal is shared.
  • the purpose of the processor burden
  • Embodiment 5 provides an authentication method for implementing a router to store authentication credentials locally on a router.
  • the implementation process of the method is as shown in FIG. 5, and includes the following steps:
  • Step 51 The router sends an authentication request for the service authorization to the server.
  • Step 52 After the server verifies the authentication information included in the authentication request of the service authorization, the server sends the authentication credential to the router.
  • step 53 the router obtains and saves the authentication credentials.
  • Embodiment 5 of the present invention creatively proposes that the authentication credential is saved by the router, so that the second resource request is subsequently generated according to the authentication credential, so that the function of the router is greatly changed, and the user terminal can be shared.
  • the purpose of the processor burden
  • Embodiment 6 mainly describes the application process of the foregoing method in the scenario.
  • the scenario includes a user terminal, a router, and a video website service system.
  • the router includes a route authentication module
  • the video website service system includes a user authentication center server and a video. Improve the server.
  • the application process of the foregoing method in the scenario may include the following steps as shown in FIG. 6:
  • Step 61 The user inputs the member account and password of the video website to the router, so as to trigger the route authentication module in the router to send an authentication request to the user authentication center server.
  • the request includes the member account and password, as well as the MAC address of the router.
  • the member account and password mentioned here are equivalent to the authentication information described in the first embodiment.
  • Step 62 After the user authentication center server passes the authentication of the received member account and password, the user performs operations: 1. Establishing a secure communication tunnel with the router; 2. Generating an encryption key, and establishing the encryption key. The mapping relationship with the MAC address of the router; 3. Sending the encryption key to the router for storage.
  • the encryption key key referred to herein may be a password sequence which is equivalent to the voucher information mentioned above.
  • step 62 in Fig. 6 shows only the third of the above three operations.
  • Step 63 When the user desires to obtain the service authorization of the video website by using the user terminal, the user is triggered to send a video connection request to the router.
  • the video connection request contains the IP address of the user terminal.
  • the video connection request mentioned here is equivalent to the first resource request mentioned above.
  • Step 64 After receiving the video connection request, the router forwards the request to the authentication background process of the router.
  • the process identifies the identifier of the recipient server of the request included in the request; when the identifier of the server is identified as a specific server identifier (ie, the identifier of the video sound server described later), the router is The MAC address and the saved encryption key are added to the request to generate a video connection request to be encrypted; and then the video connection request to be encrypted is encrypted according to the data encryption rule required by the secure communication tunnel to generate a new Video connection request.
  • a specific server identifier ie, the identifier of the video sound server described later
  • the new video connection request mentioned here is equivalent to the second resource request mentioned above.
  • step 64 in Fig. 6 shows only some of the operations described above.
  • step 65 the router sends a new video connection request to the video sound server.
  • Step 66 The video sound server obtains the MAC address and the encryption key of the router from the new video connection request sent by the router, and sends the two to the user authentication center server.
  • Step 67 The user authentication center server determines whether there is a mapping relationship between the MAC address sent by the video sound server and the encryption key key in the mapping relationship between the locally established MAC address and the encryption key. If yes, the step is performed. 69, otherwise go to step 68.
  • Step 68 The user authentication center server sends a verification failure notification message to the video sound server to trigger the video sound server to send a verification failure notification message to the router, and the process ends.
  • Step 69 The user authentication center server sends a verification success notification message to the video sound server, and then step 610 is performed.
  • Step 610 The video sound server grants a video file acquisition permission to the user terminal having the IP address according to the IP address of the user terminal in the new video connection request sent by the router. Further, if the request further includes the video file identifier that is requested to be obtained, the access address of the video file may be sent to the router according to the identifier, so that step 611 may be further performed.
  • step 611 the router sends the access address of the video file to the user terminal, and the process ends.
  • Embodiment 6 of the present invention since the router can assist the user terminal to obtain the service authority granted by the server according to the credential information, the user can obtain the service authorization without inputting the user authentication information to the user terminal based on the assistance of the router.
  • the efficiency of the service authorization process is improved, the processing resources of the user terminal are saved, and the user experience is improved.
  • the method provided in Embodiment 6 of the present invention is particularly applicable to a scenario in which different user terminals access a server via a router.
  • the embodiment 7 provides a router for solving the problem that the service authorization process is inefficient in the scenario that different user terminals in the signal coverage of the same wireless router request service rights.
  • the structure of the router is shown in Figure 7, including the resource request obtaining list.
  • the resource request obtaining unit 71 is configured to receive a first resource request sent by the user terminal, and the determining unit 72 is configured to determine whether the first resource request needs to obtain a service authorization, and the resource request sending unit 73 obtains the judgment obtained by the determining unit 72.
  • the second resource request including the authentication credential is generated and sent to the server to trigger the server to perform: performing the service authorization after the authentication credential verification in the second resource request is passed, so that the user terminal is in the This service is authorized when the router accesses the server as a network connection intermediary.
  • the determining unit 72 determines whether the first resource request needs to obtain the service authorization manner, and may, but is not limited to, adopt one of the two determination manners provided in Embodiment 1 of the present application, and details are not described herein again.
  • the above apparatus may further include:
  • An authentication requesting unit configured to send an authentication request for service authorization to the server before the resource request sending unit 72 generates and sends a second resource request including the authentication credential to the server;
  • the execution unit is saved for obtaining the business authorization-based authentication credential sent back by the server, and storing the authentication credential on the router.
  • the foregoing related functional modules may be implemented by a hardware processor.
  • the router can assist the user terminal to obtain the service authority granted by the server according to the authentication credential, so that in the scenario that different user terminals in the signal coverage of the same wireless router request service rights, based on the assistance of the router, The user can also obtain the service authorization by inputting the user authentication information to the user terminal, thereby improving the efficiency of the service authorization process.
  • Embodiment 8 of the present invention provides a service authorization apparatus.
  • the schematic diagram of the apparatus is as shown in FIG. 8, and includes a request receiving unit 81 and an authorization unit 82.
  • the request receiving unit 81 is configured to receive a resource request sent by a router, where the resource request includes an authentication credential of the router.
  • the authorization unit 82 is configured to perform service authorization after the authentication credential is verified, so that the user terminal has the service authorization when accessing the server by using the router as a network connection intermediary.
  • the request receiving unit 81 is further configured to: before receiving the resource request sent by the router, receive an authentication request for the service authorization sent by the router; And a unit, configured to send the authentication credential to the router after the authentication information in the authentication request is verified.
  • the foregoing related functional modules may be implemented by a hardware processor.
  • the service authorization apparatus provided in the embodiment 8 of the present invention creatively proposes that the authentication credential is saved by the router, so that the authentication credential is generated according to the credential information, so that the function of the router is greatly changed, and the user terminal is shared.
  • the purpose of the processor burden
  • Embodiment 9 of the present invention provides a service authorization system, including a router 91 and a server 92.
  • the router 91 has authentication credentials based on service authorization.
  • the router 91 obtains a first resource request sent by the user terminal, determines whether the first resource request needs to obtain a service authorization, and determines that the first resource request needs to obtain a service authorization, and generates according to the first resource request. And sending a second resource request including the authentication credential to the server 92; and when determining that the first resource request does not need to obtain the service authorization, forwarding the first resource request to the server (may be the server 92, or other server);
  • the server 92 is configured to perform service authorization after the authentication credential included in the second resource request is verified, so that the user terminal has the service authorization when the router 91 accesses the server 92 as the network connection intermediary.
  • the router 91 determines whether the first resource request needs to obtain the service authorization, and may be, but is not limited to, adopt one of the two determination modes provided in Embodiment 1 of the present application, and details are not described herein again.
  • the router 91 is further configured to generate and send an authentication request for the service authorization to the server before sending the second resource request including the authentication credential to the server 92; and obtain the service authorization-based return sent by the server.
  • the credentials are authenticated and the authentication credentials are stored on the router 91.
  • the foregoing related functional modules may be implemented by a hardware processor.
  • the service authorization system provided by the embodiment 9 of the present invention can assist the user terminal to obtain the service authority granted by the server according to the authentication credential, so that different user terminals in the signal coverage range of the same wireless router request the service authority. Based on the protocol of the router Help, without the user to input user authentication information to the user terminal can also obtain business authorization, thus improving the efficiency of the business authorization process.
  • Embodiment 10 of the present invention provides a router including a request sending unit 101 and a save executing unit 102.
  • the request sending unit 101 is used for the server to issue an authentication request for the service authorization;
  • the save execution unit 102 is configured to obtain the service authorization-based authentication credential sent back by the server and save the certificate.
  • the foregoing related functional modules may be implemented by a hardware processor.
  • the router provided in Embodiment 10 of the present invention creatively proposes that the router saves the authentication credential, so as to generate the authentication credential according to the credential information, so that the function of the router is greatly changed, and the processor that shares the user terminal is reached.
  • the purpose of the burden is to propose the router saves the authentication credential, so as to generate the authentication credential according to the credential information, so that the function of the router is greatly changed, and the processor that shares the user terminal is reached.
  • Embodiment 11 of the present invention provides an authentication system, including a router and a server, where:
  • a router configured to send an authentication request for the service authorization to the server; obtain and save the authentication credential sent by the server;
  • the server is configured to send the authentication credential to the router after verifying the authentication information included in the authentication request.
  • the foregoing related functional modules may be implemented by a hardware processor.
  • the authentication system provided in Embodiment 11 of the present invention creatively proposes that the authentication credential is saved by the router, so that the second resource request is subsequently generated according to the authentication credential, so that the function of the router is greatly changed, and the user terminal is shared.
  • the purpose of the processor burden
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those skilled in the art can do without creative labor. Understand and implement.
  • the service authorization method, device, system and router provided by the application can assist the user terminal to obtain the service authority granted by the server according to the service authorization authentication certificate that the router has, so as to be within the signal coverage of the same wireless router.
  • the user can obtain the service authorization without inputting the user authentication information to the user terminal, thereby improving the efficiency of the service authorization process.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请公开了一种业务授权方法、装置、系统及路由器。方法包括：在具有基于业务授权的认证凭据的路由器一侧，获得用户终端发送的第一资源请求；判断所述第一资源请求是否需要获得业务授权；如果是，则生成并向服务器发送包含所述认证凭据的第二资源请求，以触发服务器执行：在对第二资源请求中的所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权；如果否，则将所述第一资源请求转发服务器。本发明解决了同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，采用现有技术会导致业务授权过程效率较低的问题。

Description

一种业务授权方法、装置、系统及路由器
交叉引用
本申请引用于2015年5月25日递交的名称为“一种业务授权方法、装置、系统及路由器”的第201510268690.3号中国专利申请，其通过引用被全部并入本申请。
技术领域
本发明涉及互联网技术领域，尤其涉及一种业务授权方法、装置、系统及路由器。
背景技术
目前，用户为了获得服务器的业务授权，往往需要向服务器发送包含用户认证信息(一般为用户名和密码)的认证请求。后续服务器在对用户认证信息验证通过后，会根据该认证请求，为用户授予相应的业务权限。比如，为用户授予只有会员才能够观看的特定视频权限、信息浏览权限、信息下载到用户本地的权限、信息修改权限、将信息保存在服务器的权限，等等。目前网络视频的播放，有如下观看渠道：在PC端，网络视频是放在视频网站上进行观看，比如乐视网、搜狐视频、优酷网等；在手机和pad等移动端，是在移动app上进行观看，比如乐视视频app，搜狐视频app等；在电视端，是放在电视端的app上进行观看，比如乐视网TV版；在未来汽车端，是放在汽车端的移动视频app上进行观看。并且，有时网络视频会区分免费视频和付费视频，对于付费视频来说，只有付费会员才能够观看。
对于乐视的付费会员来说，其可以通过PC端的乐视网、移动端的乐视视频app、电视端乐视网TV版进行观看付费视频，并且实现了同一付费账号多端打通，亦即一个用户的一个账号，既可以登录PC端的乐视网观看付费视频，也可以登录移动端(比如手机端和pad端)的乐视视频app观看付费视频，还可以登录电视端的乐视网TV版观看付费视频。
在目前的现有技术中，存在如下问题：如一用户购买了乐视会员，在同 一路由器的信号覆盖范围内的场景(比如家庭场景)下，该用户如果想观看乐视的付费视频，其如果想在PC端观看，则需要在pc端的乐视网上输入账号进行登录；其如果想在移动端观看，则其需要再移动端app上输入账号进行登录，其如果想在电视端进行观看，则其需要在电视端的app上输入账号并进行登录，非常不方便，导致登录效率低。
显然，也不限于乐视，在其他视频网站，存在可以用多端(本文所述的多端包括并不限于PC端、移动端、电视端等)观看付费视频的场景下，也存在相同的问题。进而扩展之，在其他网络场景下，在多端在需要进行登录才能获得业务授权的场景下，比如如前文所述的信息浏览权限、信息下载到用户本地的权限、信息修改权限、将信息保存在服务器的权限也存在相同的问题。亦即需要该用户向自己使用的不同用户终端分别输入用户认证信息，并触发各用户终端分别向服务器发送包含用户认证信息的认证请求；后续服务器会对各认证请求中的用户认证信息分别进行验证，进而在验证通过后，为不同用户终端进行业务授权。
发明内容
本发明实施例提供一种业务授权方法、装置、系统及路由器，用以解决同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，采用现有技术会导致业务授权过程效率较低的问题。
为达到上述目的，本申请实施例采用如下技术方案：
第一方面，一种业务授权方法，在路由器一侧，该路由器具有基于所述业务授权的认证凭据，包括：获得用户终端发送的第一资源请求；判断所述第一资源请求是否需要获得业务授权；如果是，则生成并向服务器发送包含所述认证凭据的第二资源请求，以触发服务器执行：在对第二资源请求中的所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权；如果否，则将所述第一资源请求转发服务器。
第二方面，一种在其上记录有用于执行上述方法的程序的计算机可读记录介质。
第三方面，一种业务授权方法，在服务器一侧，包括：接收路由器发送的资源请求；所述资源请求中包括所述路由器基于业务授权的认证凭据；对该认证凭据进行验证；在所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
第四方面，一种在其上记录有用于执行上述方法的程序的计算机可读记录介质。
第五方面，一种业务授权方法，包括：路由器获得用户终端发送的第一资源请求；所述路由器具有基于所述业务授权的认证凭据；路由器判断所述第一资源请求是否需要获得业务授权；路由器在判断出所述第一资源请求需要获得业务授权时，根据所述第一资源请求，生成并向服务器发送包含认证凭据的第二资源请求；在判断出所述第一资源请求不需要获得业务授权时，将所述第一资源请求转发服务器；服务器在对所述第二资源请求中包含的所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
第六方面，一种在其上记录有用于执行上述方法的程序的计算机可读记录介质。
第七方面，一种路由器，该路由器具有基于所述业务授权的认证凭据，该路由器包括：
资源请求获得单元，用于获得用户终端发送的第一资源请求；判断单元，用于判断所述第一资源请求是否需要获得业务授权；资源请求发送单元，用于在判断单元得到的判断结果为是时，生成并向服务器发送包含所述认证凭据的第二资源请求，以触发服务器执行：在对第二资源请求中的所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权；在判断单元得到的判断结果为否时，将所述第一资源请求转发服务器。
第八方面，一种业务授权装置，包括：请求接收单元，用于接收路由器发送的资源请求；所述资源请求中包含所述路由器的认证凭据；授权单元，用于对该认证凭据进行验证；在所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
第九方面，一种业务授权系统，包括路由器和服务器，其中，路由器具有基于所述业务授权的认证凭据；路由器，用于获得用户终端发送的第一资源请求；判断所述第一资源请求是否需要获得业务授权；在判断出所述第一资源请求需要获得业务授权时，根据所述第一资源请求，生成并向服务器发送包含认证凭据的第二资源请求；在判断出所述第一资源请求不需要获得业务授权时，将所述第一资源请求转发服务器；服务器，用于在对所述第二资源请求中包含的所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
附图概述
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例1提供的一种业务授权方法的实现流程示意图；
图2为本发明实施例2提供的一种业务授权方法的实现流程示意图；
图3为本发明实施例3提供的一种业务授权方法的实现流程示意图；
图4为本发明实施例4提供的一种认证方法的实现流程示意图；
图5为本发明实施例5提供的一种认证方法的实现流程示意图；
图6为本发明实施例提供的方法在实际场景中的应用过程示意图；
图7为本发明实施例7提供的一种路由器的结构示意图；
图8为本发明实施例8提供的一种业务授权装置的结构示意图；
图9为本发明实施例9提供的一种业务授权系统的结构示意图；
图10为本发明实施例10提供的一种路由器的结构示意图。
本申请的较佳实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于 本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
以下结合附图，详细说明本发明各实施例提供的技术方案。
实施例1
为了解决同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，采用现有技术需要向用户终端输入用户认证信息，从而导致业务授权过程效率较低的问题，本发明实施例1提供一种业务授权方法。该方法的实现流程示意图如图1所示，包括如下步骤：
步骤11，路由器获得用户终端发送的资源请求。
为与后文所述的其他资源请求相区分，本发明实施例中，可以将用户终端发送的该资源请求称为第一资源请求。
该第一资源请求中可以包含也可以不包含用户终端的标识。该用户终端的标识，一般是指可以唯一表示该用户终端的标识。比如可以是该用户终端的IP地址、MAC地址或该用户终端使用的通信号码(如手机号码)等。
需要说明的是，该第一资源请求中可以包含用户认证信息。但该用户认证信息并不是实现本方案的必要条件。即，本方案中不要求用户一定要向用户终端中输入用户认证信息；此外，无论第一资源请求中，是否包含用户认证信息，都不影响本方案的实现。
本发明实施例中，所述路由器可以是采用无线或有线方式与用户终端建立连接的路由器。
在该路由器中，保存有基于业务授权的认证凭据。其中，基于业务授权的认证凭据，是指：用于表示发送该认证凭据的设备(或者用户)具备某业务的相关权限的信息。这里所说的“具备某业务的相关权限”，可以但不限于包括：具备特定视频的观看权限、信息浏览权限、信息下载到用户本地的权限、信息修改权限、将信息保存在服务器的权限，等等。
值得说明的是，该认证凭据，只要其是合法的，一般是能够得到至少一个服务器认可的。即，所述至少一个服务器根据该认证凭据，可以认定发送该认证凭据的设备(或者用户)有资格具备相应业务的相关权限，从而为该设备(或者用户)授予相应权限。
该认证凭据可以是路由器的一种出厂设置信息，也可以是服务器发送给路由器的。特别地，服务器可以是在确定路由器具备缴费标识(即，使用该路由器的用户购买了某业务权限)后发送给路由器的。
本发明实施例中，用于接收资源请求(包括第一资源请求和后文的第二资源请求)的服务器，以及根据该请求进行业务授权的服务器，可以称为资源服务器。
本发明实施例中，对认证凭据的存在形式和格式不作限定。比如，其可以以字符串形式存在的认证密钥，等等。
步骤12，路由器判断第一资源请求是否需要获得业务授权，在判断结果为是时，执行步骤13。
本发明实施例中，可以但不限于采用下述方式之一，判断第一资源请求是否需要获得业务授权。
第一种方式：路由器根据所述第一资源请求包含的服务器标识，判断第一资源请求是否需要发送给某特定服务器；在判断结果为是时，判定第一资源请求需要获得业务授权；否则判定第一资源请求不需要获得业务授权。
这里所说的服务器标识，可以但不限于是服务器的域名信息或服务器的IP地址等唯一表示一个服务器的信息。
本发明实施例中，可以将特定服务器(比如某一个或多个视频网站服务器)的标识保存在路由器本地的服务器标识库中。其中，该服务器标识库可以为专用于保存特定服务器的标识的数据库。那么，若路由器接收到第一资源请求，则可以从该第一资源请求中获取服务器标识，并判断获取到的服务器标识是否与服务器标识库中的某个服务器标识相同。若相同，则可以判定该第一资源请求需要获得业务授权，否则，判定该第一资源请求不需要获得业务授权。
按照第一种方式，若判定该第一资源请求不需要获得业务授权，则可以直接根据第一资源请求中的服务器标识，将该第一资源请求发送给该标识所对应的服务器。
第二种方式：路由器根据第一资源请求包含的服务器标识，判断第一资源请求是否需要发送给某特定服务器(即后文中用于为路由器进行业务授权的服务器)；在判断结果为是时，判断第一资源请求是否用于请求获得付费 资源；在判断出第一资源请求用于请求获得付费资源时，判定第一资源请求需要获得业务授权；在判断出第一资源请求用于请求获得免费资源时，判定第一资源请求不需要获得业务授权。
按照第二种方式，若判定该第一资源请求不需要获得业务授权，则可以直接根据第一资源请求中的服务器标识，将该第一资源请求发送给该标识所对应的服务器。
本申请实施例中，“付费资源”可以泛指任何需要进行业务授权后方能获取的资源。比如，需要用户付费后才能获取的资源，或者需要用户开通特殊业务(如开通资源试用业务)后才能获取的资源。
而“免费资源”则可以是指任何不需要进行业务授权即可获取的资源。比如，免费提供给任何用户进行获取的公共数据资源，等。
步骤13，路由器生成并向服务器发送包含路由器的认证凭据的资源请求(称第二资源请求)，以触发服务器执行：在对第二资源请求中的该认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
其中，这里所说的服务器，即是一种特定服务器。具体而言，其可以是某视频网站服务器，等。
本发明实施例中，路由器的认证凭据获得方式可以有三种：第一种是路由器本身具备的唯一标识自身单独作为认证凭据；比如路由器的MAC地址、路由器的IP地址、唯一表示该路由器的产品序列码、用户将该路由器注册到服务器上时使用的账号与密码，等等；第二类是服务器提供的凭据信息，比如服务器提供的认证私钥、token等；第三类可以是用户提供的用户个人信息自身作为认证凭据，比如，可以将某用户登录服务器所使用的账号和密码预先设置到路由器中，作为路由器的认证凭据。
需要说明的是，上述第一种、三种认证凭据的获得方式，与上述第二种认证凭据获得方式，是不能并列存在的。在第二种认证凭据的获得方式中，路由器需要向服务器发送包含认证信息的认证请求；接收并保存服务器对该认证信息验证通过后，才可以获得认证凭据。其中，这里认证信息，可以但不限于包含路由器本身具备的唯一标识(如上文所列举)，或用户提供的用户个人信息(如上文所列举)。等等。在此，需要说明的是，路由器本身具 备的唯一标识，或用户提供的用户个人信息，分别在第一种和第三种认证凭据获得方式中，自身就可以作为认证凭据；而在上述第二种认证凭据获得方式中，二者仅仅是认证请求信息，不是认证凭据，需要服务器根据收到的认证请求信息进行验证，验证通过后，才发送认证凭据。
此外，路由器向服务器发送认证信息的时机，可以是生成并向服务器发送第二资源请求前的任意时刻。
本发明实施例中，用于接收认证请求，以及根据该认证请求向路由器发送凭据信息的服务器，可以称为认证服务器。
相比于利用同一服务器既实现业务授权又实现凭据信息授予的方式而言，利用资源服务器和认证服务器分别实现业务授权和凭据信息授予，可以达到又两个服务器分担负载的目的，从而避免出现单个服务器负载过大的情况。
需要说明的是，凭据信息一般有有效期。服务器若在凭据信息的有效期内接收到该凭据信息，则在该凭据信息验证通过后，可以进行业务授权；而若服务器判断出该凭据信息已过期，则本次不为该用户终端授予业务权限。服务器可以从服务器向路由器提供该凭证信息开始，启动针对有效期的计时监控。
本发明实施例中，为了保证信息安全，生成第二资源请求的方式具体可以包括：按照设定的数据加密规则，生成第二资源请求。其中，这里所说的数据加密规则，可以是指路由器和服务器之间建立的数据传输隧道所要求的数据加密规则，也可以是路由器和服务器之间采用其他方式约定的数据加密规则。
本发明实施例中，除了可以按照设定的数据加密规则对第二资源请求进行加密外，还可以按照该规则，对前文所述的、包含认证信息的认证请求进行加密，从而保证认证信息的安全性。
后文的其他实施例将主要以“认证凭据为服务器提供的凭据信息”为例，对方案进行介绍。即，其他实施例中提到的认证凭据，即服务器提供的认证凭据。
采用本发明实施例1提供的上述方法，由于可以由路由器根据认证凭据，协助用户终端获得服务器授予的业务权限，从而在同一无线路由器的信号覆 盖范围内的不同用户终端请求业务权限的场景下，基于该路由器的协助，无需用户向用户终端输入用户认证信息也能获得业务授权，因此提高了业务授权过程的效率，节省了用户终端的处理资源。此外，上述方法还可以产生下述有益效果：
1、避免用户需要在每台用户终端上分别输入用户名与密码而产生的烦恼，提升了用户的体验；
2、尤其适用于以家庭为单位的业务授权场景，即可以使同一家庭中的多台设备同时使用一个路由器中的会员号和密码登录服务器。
实施例2
本发明实施例2提供一种业务授权方法，用以解决同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，采用现有技术需要向用户终端输入用户认证信息，从而导致业务授权过程效率较低的问题。该方法的实现流程图如图2所示，包括如下步骤：
步骤21，接收路由器发送的资源请求。
该业务授权请求即相当于实施例1中所说的第二资源请求，其中包含路由器基于业务授权的认证凭据。
步骤22，对该认证凭据进行验证，并在认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
其中，这里所说的用户终端可以是指触发路由器发送业务授权请求的用户终端，也可以是指在业务授权完成后，再以路由器为网络连接中介访问服务器的用户终端。
在一种实施方式中，在步骤21前，还可以进一步包括步骤：
接收路由器发出的业务授权的认证请求；
在对认证请求中的认证信息验证通过后，向路由器发送认证凭据。
实施例2中相关名词的解释请参见对于实施例1的描述内容，此处不再赘述。
需要说明的是，实施例2所提供方法的各步骤的执行主体均可以是同一设备，或者，该方法也由不同设备作为执行主体。
采用本发明实施例2提供的上述方法，由于可以由路由器根据认证凭据，协助用户终端获得服务器授予的业务权限，从而在同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，基于该路由器的协助，无需用户向用户终端输入用户认证信息也能获得业务授权，因此提高了业务授权过程的效率，节省了用户终端的处理资源，进而也就提升了用户的体验。
实施例3
出于与本发明实施例1和实施例2相同的发明构思，本发明实施例3提供一种业务授权方法，用以解决同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，采用现有技术需要向用户终端输入用户认证信息，从而导致业务授权过程效率较低的问题。该方法的实现流程图示意图如图3所示，包括下述步骤：
步骤31，路由器获得用户终端发送的第一资源请求；
其中，路由器具有基于业务授权的认证凭据；
步骤32，路由器在判断出第一资源请求需要获得业务授权时，根据第一资源请求，生成并向服务器发送包含路由器的认证凭据的第二资源请求；
步骤33，服务器在对第二资源请求中包含的认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
需要说明的是，当路由器在判断出第一资源请求不需要获得业务授权时，可以将所述第一资源请求转发给相应的服务器。
本申请实施例3中，路由器判断第一资源请求是否需要获得业务授权的方式，可以但不限于采用本申请实施例1中提供的两种判断方式之一，此处不再赘述。
在一种实施方式中，在步骤32前，实施例3提供的该方法还可以包括下述步骤：
路由器向服务器发出业务授权的认证请求；
路由器获得由服务器发回的基于业务授权的认证凭据，并将该认证凭据存储在路由器上。
采用本发明实施例2提供的上述方法，由于可以由路由器根据认证凭据， 协助用户终端获得服务器授予的业务权限，从而在同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，基于该路由器的协助，无需用户向用户终端输入用户认证信息也能获得业务授权，因此提高了业务授权过程的效率，节省了用户终端的处理资源，进而也就提升了用户的体验。
实施例4
实施例4提供一种认证方法，用以实现路由器在路由器本地保存认证凭据，以便路由器后续将该认证凭据。该方法的实现流程如图4所示，包括下述步骤：
步骤41，路由器向服务器发送包含认证信息的业务授权的认证请求；
其中，这里所说的认证信息，可以但不限于包含路由器本身具备的唯一标识，或用户提供的用户个人信息，等等。
步骤42，路由器获得由服务器发回的基于业务授权的认证凭据并保存。
基于该认证凭据，用户终端可以以该路由器作为网络连接中介访问需要服务器进行业务授权的资源。
本发明实施例4提供的方法，开创性地提出了由路由器来保存认证凭据，以便后续根据该认证凭据生成第二资源请求，从而使得路由器的功能发生了极大的改变，达到分担用户终端的处理器负担的目的。
实施例5
实施例5提供一种认证方法，用以实现路由器在路由器本地保存认证凭据。该方法的实现流程如图5所示，包括下述步骤：
步骤51，路由器向服务器发送业务授权的认证请求；
步骤52，服务器对业务授权的认证请求中包含的认证信息验证通过后，向路由器发送认证凭据；
步骤53，路由器获得并保存认证凭据。
本发明实施例5提供的方法，开创性地提出了由路由器来保存认证凭据，以便后续根据该认证凭据生成第二资源请求，从而使得路由器的功能发生了极大的改变，可以达到分担用户终端的处理器负担的目的。
实施例6
结合如图6所示的实际应用场景，实施例6主要说明前文所述的方法在该场景中的应用过程。
首先对图6所示的该场景进行说明：该场景中含用户终端、路由器和视频网站服务系统这几部分，其中，路由器中包含路由认证模块，视频网站服务系统中包含用户认证中心服务器和视频健全服务器。基于该场景，前文所述的方法在该场景中的应用过程可以包括如图6所示的下述步骤：
步骤61，用户向路由器输入视频网站的会员账号及密码，以触发路由器中的路由认证模块向用户认证中心服务器发送认证请求。
该请求中包含会员账号及密码，还包括路由器的MAC地址。
这里所说的会员账号及密码，相当于实施例1中所述的认证信息。
步骤62，用户认证中心服务器在对接收到的会员账号及密码认证通过后，执行操作：1、与路由器之间建立起安全通信隧道；2、生成加密密钥key，并建立该加密密钥key与路由器的MAC地址的映射关系；3、将该加密密钥key发送给路由器进行保存。
这里所说的加密密钥key，可以是一个密码序列，其相当于前文所说的凭证信息。
为不影响说明书附图的简洁性，图6中的步骤62仅示出了上述三个操作中的第3个。
步骤63，用户在期望利用用户终端获得视频网站的业务授权时，触发用户终端向路由器发送视频连接请求。
该视频连接请求中包含用户终端的IP地址。
这里所说的视频连接请求即相当于前文所说的第一资源请求。
步骤64，路由器在接收到视频连接请求后，将该请求转交给路由器的认证后台进程。该进程会对该请求中包含的、该请求的接收方服务器的标识进行识别；当识别出该服务器的标识为某特定服务器标识(即后文所述的视频健全服务器的标识)时，将路由器的MAC地址和保存的加密密钥key加入到该请求中生成待加密的视频连接请求；进而按照安全通信隧道所要求的数据加密规则，对该待加密的视频连接请求进行加密，以生成新的视频连接请求。
这里所说的新的视频连接请求，即相当于前文所说的第二资源请求。
为不影响说明书附图的简洁性，图6中的步骤64仅示出了上述操作中的部分操作。
步骤65，路由器将新的视频连接请求发送给视频健全服务器。
步骤66，视频健全服务器从路由器发送来的新的视频连接请求中，获取路由器的MAC地址和加密密钥key，并将这两者发送给用户认证中心服务器。
步骤67，用户认证中心服务器判断本地建立的MAC地址和加密密钥key的映射关系中，是否存在视频健全服务器发送来的MAC地址和加密密钥key之间的映射关系，若存在，则执行步骤69，否则执行步骤68。
步骤68，用户认证中心服务器向视频健全服务器发送验证失败通知消息，以触发视频健全服务器向路由器发送验证失败通知消息，流程结束。
步骤69，用户认证中心服务器向视频健全服务器发送验证成功通知消息，而后执行步骤610。
步骤610，视频健全服务器根据路由器发送来的新的视频连接请求中的用户终端的IP地址，为具备该IP地址的用户终端授予视频文件获取权限。进一步地，若该请求中还包括请求获取的视频文件标识，则可以根据该标识，将该视频文件的访问地址发送给路由器，从而可以进一步执行步骤611。
步骤611，路由器将视频文件的访问地址发送给用户终端，流程结束。
采用本发明实施例6提供的上述方法，由于可以由路由器根据凭证信息，协助用户终端获得服务器授予的业务权限，从而基于该路由器的协助，无需用户向用户终端输入用户认证信息也能获得业务授权，提高了业务授权过程的效率，节省了用户终端的处理资源，提升了用户的体验。本发明实施例6提供的该方法，尤其适用于不同用户终端经由一个路由器访问服务器的场景。
实施例7
实施例7提供一种路由器，用以解决同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，采用现有技术会导致业务授权过程效率较低的问题。该路由器的结构示意图如图7所示，包括资源请求获得单 元71、判断单元72和资源请求发送单元73。其中，资源请求获得单元71，用于接收用户终端发送的第一资源请求；判断单元72，用于判断第一资源请求是否需要获得业务授权；资源请求发送单元73，在判断单元72得到的判断结果为是时，生成并向服务器发送包含所述认证凭据的第二资源请求，以触发服务器执行：在对第二资源请求中的所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
在一种实施方式中，判断单元72判断第一资源请求是否需要获得业务授权的方式，可以但不限于采用本申请实施例1中提供的两种判断方式之一，此处不再赘述。
在一种实施方式中，上述装置还可以包括：
认证请求单元，用于在资源请求发送单元72生成并向服务器发送包含所述认证凭据的第二资源请求前，向服务器发出业务授权的认证请求；
保存执行单元，用于获得由服务器发回的基于业务授权的认证凭据，并将该认证凭据存储在路由器上。
本发明实施例中可以通过硬件处理器(hardware processor)来实现上述相关功能模块。
采用上述方案，由于可以由路由器根据认证凭据，协助用户终端获得服务器授予的业务权限，从而在同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，基于该路由器的协助，无需用户向用户终端输入用户认证信息也能获得业务授权，因此提高了业务授权过程的效率。
实施例8
本发明实施例8提供一种业务授权装置，该装置的结构示意图如图8所示，包括请求接收单元81和授权单元82。其中，请求接收单元81用于接收路由器发送的资源请求；所述资源请求中包含所述路由器的认证凭据。授权单元82用于在所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
在一种实施方式中，请求接收单元81还用于在接收路由器发送的资源请求前，接收路由器发出的业务授权的认证请求；则上述装置还包括：发送 单元，用于在对认证请求中的认证信息验证通过后，向路由器发送所述认证凭据。
本发明实施例中可以通过硬件处理器(hardware processor)来实现上述相关功能模块。
本发明实施例8提供的业务授权装置，开创性地提出了由路由器来保存认证凭据，以便后续根据该凭证信息生成认证凭据，从而使得路由器的功能发生了极大的改变，达到分担用户终端的处理器负担的目的。
实施例9
本发明实施例9提供一种业务授权系统，包括路由器91和服务器92。其中，路由器91，其具有基于业务授权的认证凭据。该路由器91获得用户终端发送的第一资源请求；判断所述第一资源请求是否需要获得业务授权；在判断出所述第一资源请求需要获得业务授权时，根据所述第一资源请求，生成并向服务器92发送包含认证凭据的第二资源请求；在判断出所述第一资源请求不需要获得业务授权时，将所述第一资源请求转发给服务器(可能是服务器92，也可能是其他服务器)；
服务器92，用于在对第二资源请求中包含的认证凭据验证通过后进行业务授权，以使得用户终端在以路由器91为网络连接中介访问服务器92时具备该业务授权。
在一种实施方式中，路由器91判断第一资源请求是否需要获得业务授权的方式，可以但不限于采用本申请实施例1中提供的两种判断方式之一，此处不再赘述。
在一种实施方式中，路由器91，还用于生成并向服务器92发送包含所述认证凭据的第二资源请求前，向服务器发出业务授权的认证请求；获得由服务器发回的基于业务授权的认证凭据，并将该认证凭据存储在路由器91。
本发明实施例中可以通过硬件处理器(hardware processor)来实现上述相关功能模块。
采用本发明实施例9提供的业务授权系统，由于可以由路由器根据认证凭据，协助用户终端获得服务器授予的业务权限，从而在同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，基于该路由器的协 助，无需用户向用户终端输入用户认证信息也能获得业务授权，因此提高了业务授权过程的效率。
实施例10
本发明实施例10提供一种路由器，其包括请求发送单元101和保存执行单元102。其中，请求发送单元101用于服务器发出业务授权的认证请求；保存执行单元102，用于获得由服务器发回的基于业务授权的认证凭据并保存。
本发明实施例中可以通过硬件处理器(hardware processor)来实现上述相关功能模块。
本发明实施例10提供的路由器，开创性地提出了由路由器来保存认证凭据，以便后续根据该凭证信息生成认证凭据，从而使得路由器的功能发生了极大的改变，达到分担用户终端的处理器负担的目的。
实施例11
本发明实施例11提供一种认证系统，包括路由器和服务器，其中：
路由器，用于向服务器发送业务授权的认证请求；获得并保存服务器发送的认证凭据；
服务器，用于对所述认证请求中包含的认证信息验证通过后，向路由器发送认证凭据。
本发明实施例中可以通过硬件处理器(hardware processor)来实现上述相关功能模块。
本发明实施例11提供的认证系统，开创性地提出了由路由器来保存认证凭据，以便后续根据该认证凭据生成第二资源请求，从而使得路由器的功能发生了极大的改变，达到分担用户终端的处理器负担的目的。
以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以 理解并实施。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
最后应说明的是：以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。
工业实用性
本申请提供的业务授权方法、装置、系统及路由器，由于可以由路由器根据自身具有的基于业务授权的认证凭据，协助用户终端获得服务器授予的业务权限，从而在同一无线路由器的信号覆盖范围内的不同用户终端请求业务权限的场景下，基于该路由器的协助，无需用户向用户终端输入用户认证信息也能获得业务授权，因此提高了业务授权过程的效率。

Claims (22)

  1. 一种业务授权方法，其特征在于，在路由器一侧，该路由器具有基于所述业务授权的认证凭据，包括：
    获得用户终端发送的第一资源请求；
    判断所述第一资源请求是否需要获得业务授权；
    如果是，则生成并向服务器发送包含所述认证凭据的第二资源请求，以触发服务器执行：在对第二资源请求中的所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
  2. 根据权利要求1所述的方法，其特征在于，判断所述第一资源请求是否需要获得业务授权，包括：
    根据所述第一资源请求包含的服务器标识，判断第一资源请求是否需要发送给特定服务器；
    在判断结果为是时，判定所述第一资源请求需要获得业务授权；
    否则判定所述第一资源请求不需要获得业务授权。
  3. 根据权利要求1所述的方法，其特征在于，判断所述第一资源请求是否需要获得业务授权，包括：
    根据所述第一资源请求包含的服务器标识，判断第一资源请求是否需要发送给特定服务器；
    在判断结果为是时，判断所述第一资源请求是否用于请求获得付费资源；
    在判断出所述第一资源请求用于请求获得付费资源时，判定所述第一资源请求需要获得业务授权；
    在判断出所述第一资源请求用于请求获得免费资源时，判定所述第一资源请求不需要获得业务授权。
  4. 根据权利要求1所述的方法，其特征在于，生成并向服务器发送包含所述认证凭据的第二资源请求前，所述方法还包括：
    向服务器发出业务授权的认证请求；
    获得由服务器发回的基于业务授权的认证凭据，并将该认证凭据存储在 所述路由器上。
  5. 根据权利要求4所述的方法，其特征在于：
    生成并向服务器发送包含所述认证凭据的第二资源请求，包括：生成并向资源服务器发送包含所述认证凭据的第二资源请求；
    将所述第一资源请求转发服务器，包括：将所述第一资源请求转发资源服务器；
    向服务器发出业务授权的认证请求，包括：向认证服务器发出业务授权的认证请求；
    获得由服务器发回的基于业务授权的认证凭据，包括：获得由认证服务器发回的基于业务授权的认证凭据。
  6. 一种在其上记录有用于执行权利要求1-5中任一项所述方法的程序的计算机可读记录介质。
  7. 一种业务授权方法，其特征在于，在服务器一侧，包括：
    接收路由器发送的资源请求；所述资源请求中包括所述路由器基于业务授权的认证凭据；
    对该认证凭据进行验证；在所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
  8. 根据权利要求7所述的方法，其特征在于，接收路由器发送的资源请求前，所述方法还包括：
    接收路由器发出的业务授权的认证请求；
    在对认证请求中的认证信息验证通过后，向路由器发送所述认证凭据。
  9. 一种在其上记录有用于执行权利要求7-8中任一项所述方法的程序的计算机可读记录介质。
  10. 一种业务授权方法，其特征在于，包括：
    路由器获得用户终端发送的第一资源请求；所述路由器具有基于所述业务授权的认证凭据；
    路由器判断所述第一资源请求是否需要获得业务授权；
    路由器在判断出所述第一资源请求需要获得业务授权时，根据所述第一资源请求，生成并向服务器发送包含认证凭据的第二资源请求；
    服务器在对所述第二资源请求中包含的所述认证凭据验证通过后进行 业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
  11. 根据权利要求10所述的方法，其特征在于，路由器判断所述第一资源请求是否需要获得业务授权，包括：
    路由器根据所述第一资源请求包含的服务器标识，判断第一资源请求是否需要发送给特定服务器；
    在判断结果为是时，判定所述第一资源请求需要获得业务授权；
    否则判定所述第一资源请求不需要获得业务授权。
  12. 根据权利要求10所述的方法，其特征在于，路由器判断所述第一资源请求是否需要获得业务授权，包括：
    根据所述第一资源请求包含的服务器标识，判断第一资源请求是否需要发送给特定服务器；
    在判断结果为是时，判断所述第一资源请求是否用于请求获得付费资源；
    在判断出所述第一资源请求用于请求获得付费资源时，判定所述第一资源请求需要获得业务授权；
    在判断出所述第一资源请求用于请求获得免费资源时，判定所述第一资源请求不需要获得业务授权。
  13. 一种在其上记录有用于执行权利要求10-12中任一项所述方法的程序的计算机可读记录介质。
  14. 一种路由器，其特征在于，该路由器具有基于所述业务授权的认证凭据，该包括：
    资源请求获得单元，用于获得用户终端发送的第一资源请求；
    判断单元，用于判断所述第一资源请求是否需要获得业务授权；
    资源请求发送单元，用于在判断单元得到的判断结果为是时，生成并向服务器发送包含所述认证凭据的第二资源请求，以触发服务器执行：在对第二资源请求中的所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
  15. 根据权利要求14所述的路由器，其特征在于，判断单元，用于：
    根据所述第一资源请求包含的服务器标识，判断第一资源请求是否需要 发送给特定服务器；
    在判断结果为是时，判定所述第一资源请求需要获得业务授权；
    否则判定所述第一资源请求不需要获得业务授权。
  16. 根据权利要求14所述的路由器，其特征在于，判断单元，用于：
    根据所述第一资源请求包含的服务器标识，判断第一资源请求是否需要发送给特定服务器；
    在判断结果为是时，判断所述第一资源请求是否用于请求获得付费资源；
    在判断出所述第一资源请求用于请求获得付费资源时，判定所述第一资源请求需要获得业务授权；
    在判断出所述第一资源请求用于请求获得免费资源时，判定所述第一资源请求不需要获得业务授权。
  17. 根据权利要求14所述的路由器，其特征在于，所述装置还包括：
    认证请求单元，用于在资源请求发送单元生成并向服务器发送包含所述认证凭据的第二资源请求前，向服务器发出业务授权的认证请求；
    保存执行单元，用于获得由服务器发回的基于业务授权的认证凭据，并将该认证凭据存储在所述路由器上。
  18. 一种业务授权装置，其特征在于，包括：
    请求接收单元，用于接收路由器发送的资源请求；所述资源请求中包含所述路由器的认证凭据；
    授权单元，用于对该认证凭据进行验证；在所述认证凭据验证通过后进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
  19. 一种业务授权系统，其特征在于，包括路由器和服务器，其中，路由器具有基于所述业务授权的认证凭据；
    路由器，用于获得用户终端发送的第一资源请求；判断所述第一资源请求是否需要获得业务授权；在判断出所述第一资源请求需要获得业务授权时，根据所述第一资源请求，生成并向服务器发送包含认证凭据的第二资源请求；
    服务器，用于在对所述第二资源请求中包含的所述认证凭据验证通过后 进行业务授权，以使得用户终端在以路由器为网络连接中介访问服务器时具备该业务授权。
  20. 根据权利要求19所述的系统，其特征在于，所述路由器用于：
    根据所述第一资源请求包含的服务器标识，判断第一资源请求是否需要发送给特定服务器；
    在判断结果为是时，判定所述第一资源请求需要获得业务授权；
    否则判定所述第一资源请求不需要获得业务授权。
  21. 根据权利要求19所述的系统，其特征在于，所述路由器用于：
    根据所述第一资源请求包含的服务器标识，判断第一资源请求是否需要发送给特定服务器；
    在判断结果为是时，判断所述第一资源请求是否用于请求获得付费资源；
    在判断出所述第一资源请求用于请求获得付费资源时，判定所述第一资源请求需要获得业务授权；
    在判断出所述第一资源请求用于请求获得免费资源时，判定所述第一资源请求不需要获得业务授权。
  22. 根据权利要求19所述的系统，其特征在于，所述路由器还用于：
    生成并向服务器发送包含所述认证凭据的第二资源请求前，向服务器发出业务授权的认证请求；
    获得由服务器发回的基于业务授权的认证凭据，并将该认证凭据存储在所述路由器上。
PCT/CN2016/077968 2015-05-25 2016-03-31 一种业务授权方法、装置、系统及路由器 WO2016188224A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510268690.3A CN105722072A (zh) 2015-05-25 2015-05-25 一种业务授权方法、装置、系统及路由器
CN201510268690.3 2015-05-25

Publications (1)

Publication Number Publication Date
WO2016188224A1 true WO2016188224A1 (zh) 2016-12-01

Family

ID=56144762

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/077968 WO2016188224A1 (zh) 2015-05-25 2016-03-31 一种业务授权方法、装置、系统及路由器

Country Status (2)

Country Link
CN (1) CN105722072A (zh)
WO (1) WO2016188224A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110765446A (zh) * 2019-10-21 2020-02-07 深圳市神飞电子科技有限公司 一种电子设备授权许可分发方法
CN116015854A (zh) * 2022-12-26 2023-04-25 支付宝(杭州)信息技术有限公司 凭据泄露的应急处理方法和装置

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106027314A (zh) * 2016-06-30 2016-10-12 乐视控股（北京）有限公司 一种管理路由器的方法及控制设备
CN108974837A (zh) * 2018-06-14 2018-12-11 深圳市艾励美特科技有限公司 一种智能滚筒流水线和控制方法
CN109547444B (zh) * 2018-11-28 2021-01-05 腾讯科技（深圳）有限公司 虚拟对象获取方法、装置及电子设备
CN114513364B (zh) * 2022-02-25 2024-03-15 杭州涂鸦信息技术有限公司 一种服务授权方法及相关组件
CN117792859A (zh) * 2022-09-27 2024-03-29 中兴通讯股份有限公司 一种业务访问方法、终端设备、服务器、路由节点

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103118032A (zh) * 2013-03-01 2013-05-22 北京奇艺世纪科技有限公司 一种终端登录账号同步的方法、终端与服务器
CN103188076A (zh) * 2011-12-27 2013-07-03 中国移动通信集团江苏有限公司 一种实现多终端统一认证的方法及系统
CN103475476A (zh) * 2013-09-02 2013-12-25 小米科技有限责任公司 多终端登录服务器的方法及装置
US20140089430A1 (en) * 2012-09-21 2014-03-27 Tencent Technology (Shenzhen) Company Limited Data-sharing method, terminal, server, and system
CN105049410A (zh) * 2015-05-28 2015-11-11 北京奇艺世纪科技有限公司 一种账号登录方法、装置及系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101521577A (zh) * 2009-04-01 2009-09-02 中国电信股份有限公司 基于家庭网关的认证凭证统一管理方法、系统和家庭网关
CN102843584A (zh) * 2011-06-20 2012-12-26 海尔集团公司 网络终端的认证方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103188076A (zh) * 2011-12-27 2013-07-03 中国移动通信集团江苏有限公司 一种实现多终端统一认证的方法及系统
US20140089430A1 (en) * 2012-09-21 2014-03-27 Tencent Technology (Shenzhen) Company Limited Data-sharing method, terminal, server, and system
CN103118032A (zh) * 2013-03-01 2013-05-22 北京奇艺世纪科技有限公司 一种终端登录账号同步的方法、终端与服务器
CN103475476A (zh) * 2013-09-02 2013-12-25 小米科技有限责任公司 多终端登录服务器的方法及装置
CN105049410A (zh) * 2015-05-28 2015-11-11 北京奇艺世纪科技有限公司 一种账号登录方法、装置及系统

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110765446A (zh) * 2019-10-21 2020-02-07 深圳市神飞电子科技有限公司 一种电子设备授权许可分发方法
CN110765446B (zh) * 2019-10-21 2023-09-12 深圳市神飞电子科技有限公司 一种电子设备授权许可分发方法
CN116015854A (zh) * 2022-12-26 2023-04-25 支付宝(杭州)信息技术有限公司 凭据泄露的应急处理方法和装置
CN116015854B (zh) * 2022-12-26 2024-05-17 支付宝(杭州)信息技术有限公司 凭据泄露的应急处理方法和装置

Also Published As

Publication number Publication date
CN105722072A (zh) 2016-06-29

Similar Documents

Publication Publication Date Title
WO2016188224A1 (zh) 一种业务授权方法、装置、系统及路由器
US10742631B2 (en) Using an IP multimedia subsystem for HTTP session authentication
US9608814B2 (en) System and method for centralized key distribution
US9130935B2 (en) System and method for providing access credentials
US9038138B2 (en) Device token protocol for authorization and persistent authentication shared across applications
CN102457507B (zh) 云计算资源安全共享方法、装置及系统
US9003189B2 (en) Trusted third party client authentication
EP2374087B1 (en) Ticket-based implementation of content leasing
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
US9356918B2 (en) Identification delegation for devices
US20100100950A1 (en) Context-based adaptive authentication for data and services access in a network
US9584615B2 (en) Redirecting access requests to an authorized server system for a cloud service
US20210234939A1 (en) Provision of a lease for streaming content
US20140189827A1 (en) System and method for scoping a user identity assertion to collaborative devices
WO2014131279A1 (zh) 一种双向授权系统、客户端及方法
JP2018517367A (ja) サービスプロバイダ証明書管理
US11277404B2 (en) System and data processing method
WO2009074082A1 (fr) Procédé, système et dispositif de contrôle d'accès
CN112468481A (zh) 一种基于CAS的单页和多页web应用身份集成认证方法
KR20150036371A (ko) 클라우드 서버를 위한 바우처 인가
WO2009129753A1 (zh) 提高网络身份认证安全性的方法和装置
WO2019056971A1 (zh) 一种鉴权方法及设备
WO2020062667A1 (zh) 数据资产管理方法、数据资产管理装置及计算机可读介质
US11405398B2 (en) Information processing apparatus, information processing system, and information processing method
US20160285843A1 (en) System and method for scoping a user identity assertion to collaborative devices

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16799113

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16799113

Country of ref document: EP

Kind code of ref document: A1