WO2017028804A1 - 一种Web实时通信平台鉴权接入方法及装置 - Google Patents

一种Web实时通信平台鉴权接入方法及装置 Download PDF

Info

Publication number
WO2017028804A1
WO2017028804A1 PCT/CN2016/095951 CN2016095951W WO2017028804A1 WO 2017028804 A1 WO2017028804 A1 WO 2017028804A1 CN 2016095951 W CN2016095951 W CN 2016095951W WO 2017028804 A1 WO2017028804 A1 WO 2017028804A1
Authority
WO
WIPO (PCT)
Prior art keywords
time communication
web real
verification
valid
login
Prior art date
Application number
PCT/CN2016/095951
Other languages
English (en)
French (fr)
Inventor
董振江
李从兵
双锴
郭逊
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017028804A1 publication Critical patent/WO2017028804A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a web real-time communication platform authentication access method and apparatus.
  • WebRTC Web Real-Time Communication
  • WebRTC Web Real-Time Communication
  • the communicating party uses the WebRTC service using an IP-independent account.
  • the industry WebRTC service platform will have the network element entity responsible for login authentication, but the function provided is relatively simple, including only the basic login verification function. The adverse result of this method is that the security of user account management is poor, and thus exists. Risk of triggering platform services security.
  • the business is only oriented to its own users and cannot expand the scope of use of the business.
  • Oauth Open Authorization Standard A more common practice in the industry to expand the scope of business use is to use the Oauth Open Authorization Standard. Some of the more representative ones include Sina Weibo open platform and Facebook open platform. It is worth noting that in the process of authentication and authorization based on Oauth, the common problem of these open platforms is that legitimate users of open platforms can access and use the services provided by the platform. Users of other third-party access platforms are not open to use. The ability of platform services. In this model, the scope of application of third-party platforms based on open platform open service capability development is also limited to a fixed range of users, that is, these users are both users of third-party access platforms and users of open platforms. . In short, this approach expands the scope of use of the service, not the scope of the user.
  • the purpose of the embodiments of the present invention is to provide a web real-time communication platform authentication access method and device, which can enhance the security of the user account of the WebRTC service platform, and effectively expand the user category of the WebRTC service platform.
  • An embodiment of the present invention provides a web real-time communication platform authentication access method, which is applied to a web real-time communication login authentication network element entity WAS, and the method includes:
  • the identity directs the user to the web real-time communication application home page and establishes a connection with the web real-time communication server WS based on the valid access token.
  • Login verification success message when the login authentication is successful including:
  • the authentication information after the login verification succeeds is authenticated.
  • the valid real-time access token and the unique identifier are sent to the web real-time communication application, including:
  • the web real-time communication application is the current platform web real-time communication application WA
  • the authentication verification of the verification information generating a valid client code Codeclient and returning to the web real-time communication application, specifically:
  • the verification information includes the first user name Username1 and the first Password Password1.
  • the method further includes: before receiving the login request that carries the verification information sent by the WA, the method further includes:
  • the method includes: when sending a message that the first access token is valid to the WA, the method includes:
  • a unique identity is sent to the WA such that the WA invokes various services provided by the WS.
  • the method when the Code value in the self session does not expire, the method includes:
  • a valid Codeclient corresponding to the WA is directly returned to the WA.
  • the method further includes: before the web real-time communication application is a web real-time communication application TPWA of the third-party service platform, before receiving the login request that carries the verification information sent by the TPWA, the method further includes:
  • the method further includes:
  • a valid Codeclient is generated, and the valid Codeclient is verified.
  • a temporary access token is generated and returned to the TPWA; after the temporary access token is verified, a temporary is generated.
  • a username is sent to the TPWA to redirect the TPWA to the home page.
  • the embodiment of the invention further provides a web real-time communication platform authentication access method, which is applied to a web real-time communication application, and the method includes:
  • the WAS After the authentication verification of the verification information after the login verification is successful, the WAS receives the valid access token and the unique identifier sent by the WAS, and directs the user to the web real-time communication application homepage according to the received unique identifier. And establish a connection with the Web real-time communication server WS according to the valid access token.
  • Encrypting the verification information to generate a first encryption result Hashone sending the Hashone, the username name, and the RandomNumber to the WAS, so that the WAS is based on the received Hashone, the Username, and the RandomNumber verifies the login request sent by the web real-time communication application.
  • the step of receiving the valid access token and the unique identifier sent by the WAS includes:
  • the method further includes: before the web real-time communication application is the current platform web real-time communication application, the method further includes: before the web real-time communication login authentication network element entity WAS sends the login request that carries the verification information, the method further includes:
  • the method includes: when receiving a message that the first access token sent by the WAS is valid, the method includes:
  • the method further includes: when the code value in the WAS self-session is not expired, the method further includes:
  • Receiving the WAS returns a valid Codeclient corresponding to the WA.
  • the method further includes: before the web real-time communication application is a web real-time communication application TPWA of the third-party service platform, before the web real-time communication login authentication network element entity WAS sends the login request carrying the verification information, the method further includes:
  • the method further includes:
  • the embodiment of the present invention further provides a web real-time communication platform authentication access method, which is applied to a web real-time communication server WS, and the method includes:
  • Extracting a valid access token and sending a verification processing HTTP request carrying a valid access token to the Web real-time communication login authentication element entity WAS, and verifying the valid access token by the WAS, and returning the verification pass information;
  • the embodiment of the present invention further provides a web real-time communication platform authentication access device, which is applied to a web real-time communication login authentication network element entity WAS, and the device includes:
  • Receiving a verification module configured to receive a login request carrying the verification information sent by the web real-time communication application, verifying the login request sent by the web real-time communication application, and returning the verification information when the login verification is successful Message
  • the verification sending module is configured to perform authentication verification on the verification information after the login verification succeeds, and after the authentication verification succeeds, send a valid access token and a unique identity to the web real-time communication application, so that the web real-time communication application The user is directed to the web real-time communication application home page based on the received unique identity and establishes a connection with the web real-time communication server WS based on the valid access token.
  • the embodiment of the present invention further provides a web real-time communication platform authentication access device, which is applied to a web real-time communication application, and the device includes:
  • the second sending module is configured to send a login request carrying the verification information to the Web real-time communication login authentication element entity WAS, so that the WAS verifies the login request sent by the Web real-time communication application;
  • a second receiving module configured to receive a login verification success message returned by the WAS
  • the fourth processing module is configured to receive the valid access token and the unique identifier sent by the WAS after the authentication verification of the verification information after the login verification is successful, and the user is received according to the received unique identifier. Directed to the web real-time communication application home page and establish a connection with the web real-time communication server WS based on the valid access token.
  • the embodiment of the present invention further provides a web real-time communication platform authentication access device, which is applied to a web real-time communication server WS, and the device includes:
  • a fifth receiving module configured to receive a WebSocket connection request sent by the browser and carrying a valid access token
  • the sending and sending module is configured to extract a valid access token, and send a verification processing HTTP request carrying a valid access token to the Web real-time communication login authentication network element WAS, and the WAS validates the valid access token, and returns the verification to pass Information
  • the receiving return module is configured to receive the verification pass information returned by the WAS, return a connection success message to the browser, and complete a connection with each web real-time communication application under the browser.
  • a computer storage medium is further provided, and the computer storage medium may store an execution instruction, where the execution instruction is used to implement the implementation of the Web real-time communication platform authentication access method in the foregoing embodiment.
  • the WebRTC application After the login authentication and authentication of the verification information is successful, the WebRTC application obtains a valid access token and a unique identifier issued by the WAS, thereby using various instant communication services provided by the WebRTC platform, thereby serving the users of the WebRTC service and the WebRTC service.
  • the platform provides security guarantees; and provides single sign-on capability between different WebRTC applications of the WebRTC service platform, so that the same user can switch between different WebRTC applications more conveniently; further, WebRTC applications for third-party service platforms
  • the access capability of Oauth2.0 is provided, so that the WebRTC application on the third-party service platform acquires various instant messaging service capabilities provided by the WebRTC platform, thereby greatly expanding the user category of the WebRTC platform service.
  • FIG. 1 is a schematic flowchart 1 of a flow of an authentication access method of a Web real-time communication platform according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a WebRTC service platform according to an embodiment of the present invention.
  • FIG. 3 is a second schematic flowchart of steps of an authentication access method of a Web real-time communication platform according to an embodiment of the present invention
  • FIG. 4 is a schematic flowchart 3 of a flow of an authentication access method of a Web real-time communication platform according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart of a step of a method for authenticating an access method of a Web real-time communication platform according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram of accessing different WebRTC applications and supporting single sign-on according to an embodiment of the present invention
  • FIG. 7 is a schematic flowchart of a step of a method for authenticating an access method of a Web real-time communication platform according to an embodiment of the present invention
  • FIG. 8 is a schematic flowchart of a flow chart of an authentication access method of a Web real-time communication platform according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of performing WebRTC communication after a WebRTC application of a third-party platform accesses a WAS according to an embodiment of the present invention.
  • FIG. 10 is a schematic flowchart of a step of a method for authenticating an access method of a Web real-time communication platform according to an embodiment of the present invention
  • FIG. 11 is a first schematic diagram of an authentication access device of a Web real-time communication platform according to an embodiment of the present invention.
  • FIG. 12 is a second schematic diagram of an authentication access device of a Web real-time communication platform according to an embodiment of the present invention.
  • FIG. 13 is a third schematic diagram of an authentication access device for a Web real-time communication platform according to an embodiment of the present invention.
  • An embodiment of the present invention provides a web real-time communication platform authentication access method, which is applied to a Web real-time communication authentication network element (WebRTC Authentication Server, WAS). As shown in FIG. 1 , the method includes:
  • Step S101 Receive a login request carrying the verification information sent by the web real-time communication application, verify the login request sent by the web real-time communication application, and return a login verification success message when the verification information login verification succeeds;
  • Step S102 Perform authentication verification on the verification information after successful login verification, and send a valid access token and a unique identity to the web real-time communication application after the authentication verification is successful, so that the web real-time communication application receives the The unique identity directs the user to the web real-time communication application home page and establishes a connection to the web real-time communication server WS based on the valid access token.
  • the login request After receiving the login request that carries the verification information sent by the WebRTC application, the login request is verified, and after the verification succeeds, the login verification success message is returned to the WebRTC application, and after the login verification is successful, the login verification is successful.
  • the authentication information is authenticated, and after the authentication succeeds, the effective access token and the unique identifier are sent to the WebRTC application, and the WebRTC application can use various instant messaging provided by the WebRTC platform after receiving the unique identifier and the valid access token.
  • Service where the access token can be abbreviated as an AccessToken.
  • the embodiment of the present invention provides the Oauth2.0 login authentication capability for the WebRTC service platform, so that the WebRTC application can use various instant messaging services provided by the WebRTC platform only after obtaining the valid access token and the unique identifier issued by the WAS. Provide security for users of WebRTC services and WebRTC service platforms.
  • FIG. 2 it is a typical architecture diagram of the WebRTC service platform after using the WAS of the present invention.
  • WSRTC Server WebRTC Server
  • WebRTC applications When using the WebRTC application, the user needs to use the login authentication of the WAS to use the real-time communication service based on the WebRTC service platform provided by the WebRTC application.
  • step S101 includes:
  • Step S1011 receiving a login request carrying the verification information sent by the web real-time communication application, generating a random number RandomNumer according to the login request, storing the session, and returning to the web real-time communication application together with the login page;
  • Step S1012 receiving a first encryption result Hashone, a user name username, and a RandomNumber generated by encrypting the verification information sent by the web real-time communication application;
  • Step S1013 verifying the username in the database, and performing encryption operation on the Hashone and the RandomNumber to obtain a second encryption result Hashtwo;
  • Step S1014 searching for the corresponding password Password_Hash in the database according to the username, encrypting the Password_Hash and the RandomNumber in the deposit session to obtain a third encryption result Hashthree;
  • Step S1015 Determine whether the Hashthree and the Hashtwo are consistent. When the two are consistent, the login verification is successful, and the login verification success message is returned to the Web real-time communication application.
  • a random number RandomNumer is generated according to the login request, the RandomNumer is stored in the current session, and the user login page is returned to the WebRTC application together with the RandomNumer.
  • the verification information includes: username username and password password.
  • Hashone MD5(MD5(Password), Username) to get the Hashone.
  • the RandomNumber sent by the WebRTC application and the RandomNumber sent by the WebRTC application are used for the second time.
  • Hashtwo MD5(HASH(RandomNumber), Hashone), get Hashtwo.
  • Hashthree and Hashtwo are consistent. If they are consistent, the login verification is successful. Regardless of whether the verification is successful or not, the RandomNumber will be discarded. At the next login, WAS will generate a new random number to participate in the encryption process.
  • step S102 includes:
  • Step S1021 Perform authentication verification on the verification information, generate a valid client code Codeclient, and return to the Web real-time communication application, where the Web real-time communication application writes the received valid Codeclient into its own session;
  • Step S1022 Receive the information carrying the valid Codeclient sent by the Web real-time communication application to authorize the HTTP request, verify the valid Codeclient, and send a valid access token to the Web real-time communication application after the verification, by the Web real-time communication application. Write the received valid access token to its own session;
  • step S1023 the information carrying the valid access token sent by the web real-time communication application is authorized to authorize the HTTP request, and the valid access token is verified. After the verification is passed, the unique identifier is sent to the web real-time communication application WA.
  • the WAS authenticates the authentication information, generates a valid Codeclient, and sends it to the WebRTC application.
  • the WebRTC application writes to the session after receiving the valid Codeclient.
  • the WAS validates the valid Codeclient sent by the WebRTC application.
  • the WebRTC application Upon verification, by sending a valid access token to the WebRTC application, the WebRTC application writes the valid access token into its own session.
  • the WAS authenticates the valid access token sent by the WebRTC application, and sends the unique identity after the verification, so that the WebRTC application can receive the valid access token and the unique identifier. Use the various instant messaging services provided by the WebRTC platform.
  • the web real-time communication application is the current platform web real-time communication application WA
  • the authentication verification is performed on the verification information, and a valid client code Codeclient is generated and returned to the web real-time.
  • Communication application specifically:
  • the verification information includes the first user name Username1 and the first Password Password1.
  • Code is the main credential for the user to log in. It is only stored in the WAS, and the Code cannot be returned to the WA. However, the WA needs a similar Code to carry the Code to obtain a valid access token.
  • each validating code is used as a substitute for the Code, and the relationship between the Code and the Codeclient is stored in the database, wherein the valid Codeclient valid access token is used.
  • One-to-one correspondence One-to-one correspondence.
  • the WA can carry a valid access token to obtain the username and other user information.
  • the connected WS server also carries a valid access token. The only way to obtain a valid access token for the first time is to provide a valid Codeclient.
  • the method before receiving the login request that carries the verification information sent by the WA, the method further includes:
  • the WA extracts the first access token in the self session, and the WAS verifies the first access token in the self-sentence sent by the WA, and returns the non-passing information to the WA when the verification fails.
  • the WA extracts the first Codeclient in the own session and the redirect address redirectURL specified in advance to send an authentication HTTP request to the WAS, and the WAS verifies the first Codeclient.
  • the WA WA returns no pass information.
  • WAS checks that the Code value in its own session is invalid and jumps to the WAS login interface.
  • the user enters Username1 and Password1. After successful login authentication for Username1 and Password1, Username1 and Password1 need to be authenticated.
  • WAS generates Code and valid Codeclient. The Code is stored in the WAS session and redirected to the WA. Directed address, returning a valid Codeclient for WA by redirecting the address.
  • the WA writes the received valid Codeclient into its own session, and sends a message carrying the valid Codeclient to the WAS to authorize the HTTP request.
  • the WAS verifies the valid Codeclient and returns a valid access token after the verification is passed.
  • the WA writes the received valid access token into its own session and sends a valid visit to the WAS.
  • the information of the token is authorized to request the HTTP request, and the WAS verifies the valid access token, and after the verification is passed, returns the unique identifier, that is, the first username, and the WA redirects to the application home page. Then the WA carries a valid access token to initiate a WebSocket connection request to the WS, the WS extracts the valid access token, sends a verification processing HTTP request to the WAS, the WAS verification passes, returns the pass information, and the WS returns a connection success message to the WA, and thus, the WA successfully connects.
  • WS can send or receive the relevant signaling of WebRTC, and then use the related services provided by WebRTC server WS.
  • the user refreshes the uniform resource locator URL of the WA, and the WA extracts the valid access token in the self session, sends an authentication processing HTTP request to the WAS, and returns the passing information after the WAS verification succeeds.
  • the WAS sends a message carrying a valid access token to authorize the HTTP request.
  • the WAS verifies the valid access token, and after the verification is passed, returns the unique identity, and the WA redirects to the application home page.
  • the WA carries a valid access token to initiate a WebSocket connection request to the WS
  • the WS extracts the valid access token, sends a verification processing HTTP request to the WAS, the WAS verification passes, returns the pass information, and the WS returns a connection success message to the WA, and thus, the WA successfully connects.
  • WS can send or receive the relevant signaling of WebRTC, and then use the related services provided by WebRTC server WS.
  • WA2 extracts the second access token in its own session, and WAS verifies the second access token, and returns the fail-through information to WA2 when the verification fails.
  • the WA2 extracts the second Codeclient in the own session and the redirect address redirectURL specified in advance, and sends an authentication request HTTP request to the WAS, and the WAS verifies the second Codeclient.
  • the verification fails Returns no pass information to WA2.
  • WA2 writes the received valid Codeclient into its own session, sends a message carrying the valid Codeclient to the WAS to authorize the HTTP request, and the WAS verifies the valid Codeclient and returns a valid access token after the verification is passed.
  • WA2 writes the received valid access token into its own session, and sends a message carrying the valid access token to the WAS to authorize the HTTP request.
  • the WAS verifies the valid access token and returns a unique identity after the verification is passed.
  • WA2 redirects to the app home page.
  • WA2 carries a valid access token to initiate a WebSocket connection request to the WS
  • the WS extracts the valid access token, sends a verification processing HTTP request to the WAS, the WAS authentication passes, returns the pass information, and the WS returns a connection success message to the WA2, and thus, the WA2 is successfully connected.
  • WS can send or receive the relevant signaling of WebRTC, and then use the related services provided by WebRTC server WS.
  • FIG. 6 is a schematic diagram of providing single sign-on capability after accessing different WAs simultaneously using the WAS of the present invention. If a user has completed the login authentication process with WAS when using WA1, WA2 is accessed when accessing WA2 in WA1. The single sign-on process between the WAS and the WAS is initiated, so that the user does not need to input the username and password again, and directly logs in to the WA2 using the account information in the process of logging in to WA1.
  • the method further includes: before receiving the login request that carries the verification information sent by the TPWA, the method further includes:
  • the third-party application identity here has the same meaning as the above-mentioned user name, and the user name is a general summary of the first user name and the third-party application identity, and the password is a general summary of the first password and the second password.
  • the TPWA After returning the third-party application identity and the second password to the TPWA, the TPWA carries the third-party application identity and the second password to send a login request to the WAS, where the WAS applies the identity to the third-party application and the second The password is verified.
  • the third-party application identity and the second password are successfully verified, the third-party application identity and the second password are authenticated, a valid Codeclient is generated, and the valid Codeclient is verified. After the verification succeeds, a temporary access token is generated. To the TPWA; after the temporary access token is verified, a temporary user name is generated and sent to the TPWA, so that the TPWA is redirected to the home page.
  • the embodiment of the present invention further provides a web real-time communication platform authentication access method, which is applied to a web real-time communication application. As shown in FIG. 7, the method includes:
  • Step S201 Send a login request carrying the verification information to the Web real-time communication login authentication network element WAS, so that the WAS verifies the login request sent by the Web real-time communication application.
  • Step S202 Receive a login verification success message returned by the WAS.
  • Step S203 After the authentication verification of the verification information after the login verification is successful, the WAS receives the valid access token and the unique identifier sent by the WAS, and directs the user to the Web according to the received unique identifier.
  • the communication application home page establishes a connection with the Web real-time communication server WS based on the valid access token.
  • the WebRTC application sends a login request carrying the authentication information to the WAS, and the WAS verifies the login request, and returns a login verification success message to the WebRTC application after the verification succeeds, and the WAS needs to verify the verification information after the login verification succeeds.
  • the WebRTC application receives the valid access token and the unique identity sent by the WAS after the authentication succeeds.
  • the WebRTC application can use various instant messaging services provided by the WebRTC platform after receiving the valid access token and the unique identity.
  • WebRTC applications can use the various instant messaging services provided by the WebRTC platform only after obtaining valid access tokens and unique identifiers issued by WAS, thus providing security for users of WebRTC services and WebRTC service platforms.
  • step S201 includes:
  • Step S2011 Send a login request carrying the verification information to the WAS, and receive the carried back by the WAS. a login page of a random number RandomNumber;
  • step S2012 the verification information is encrypted to generate a first encryption result Hashone, and the Hashone, the user name Username, and the RandomNumber are sent to the WAS, so that the WAS is based on the received Hashone, the Username. And verifying the login request sent by the web real-time communication application with the RandomNumber.
  • the WAS After the login request carrying the authentication information is sent to the WAS, the WAS generates a random number RandomNumer according to the login request, and receives the user login page sent by the WAS and the RandomNumer. Then the user inputs the verification information, and the verification information includes the user name Username and the password Password.
  • step S203 includes:
  • Step S2031 Receive the WAS according to the valid client code Codeclient generated in the authentication information authentication verification, and write the received valid Codeclient into the self session;
  • Step S2022 Send an information requesting an HTTP request carrying the valid Codeclient to the WAS, so that the WAS authenticates the valid Codeclient, and receives the valid access token sent by the WAS after valid Codeclient authentication, and the received valid token is received.
  • the access token is written into its own session;
  • Step S2033 Send the information carrying the valid access token to the WAS to authorize the HTTP request, so that the WAS verifies the valid access token, and after receiving the verification, receives the unique identity identifier sent by the WAS.
  • the valid Codeclient generated by the WAS for authenticating the verification information is received, and the WebRTC application is written into the self session after receiving the valid Codeclient. Then, the WAS is sent with a valid CodeClient to authorize the HTTP request, so that the WAS authenticates the valid Codeclient. After the WebRTC application receives the authentication, the WAS sends a valid access token, and the WebRTC application writes the valid access token into its own session. Sending a message carrying a valid access token to the WAS to authorize the HTTP request, so that the WAS authenticates the valid access token, receives the unique identity sent by the WAS after the authentication is passed, and the WebRTC application receives the valid access token and the unique identity.
  • Various instant messaging services provided by the WebRTC platform can be used.
  • the method when the web real-time communication application is the current platform web real-time communication application WA, the method further includes: before the web real-time communication login authentication network element entity WAS sends the login request carrying the verification information, the method further includes :
  • the WA extracts the first access token in the self session, and sends an authentication processing HTTP request to the WAS, so that the WAS authenticates the first access token in the self-sentence sent by the WA, and when the verification fails, the WA receives the WAS.
  • the returned non-passing information extracts the first Codeclient in the self-session, and sends an authentication processing HTTP request to the WAS, so that the WAS authenticates the first Codeclient in the self-sentence sent by the WA, and when the verification fails, the WA receives the WAS.
  • the returned non-passing information at this time WAS checks that the Code value in its own session is invalid, and jumps to the WAS self-login login interface.
  • the method when receiving the message that the first access token sent by the WAS is valid, the method includes:
  • the WA carries the first access token in its own session, and when the WAS is asked whether it is valid, if the WAS checks that the first access token is still valid, it indicates that the user has logged in before, and directly passes the first access token.
  • WAS obtains a unique identifier and invokes various services provided by WS. Specific application scenarios include operations such as the user temporarily disconnecting or refreshing the browser.
  • the method when the code value in the WAS self-session is not expired, the method further includes:
  • Receiving the WAS returns a valid Codeclient corresponding to the WA.
  • the WAS checks the Code value in the session corresponding to the WA in the WAS, and finds that the Code value is valid and has not expired, indicating that the user has logged in to an application WA. At this time, the WAS directly returns the valid Codeclient corresponding to the WA, and does not need to be redirected to log in page.
  • the specific application scenario is when the user switches between using multiple WAs.
  • the web real-time communication application is a web real-time communication application TPWA of a third-party service platform
  • the web real-time communication login authentication network element entity WAS sends a login request carrying the verification information
  • the The method also includes:
  • the TPWA applies for access to WAS by mail or other means, after the WAS administrator approves it.
  • the TPWA user enters the URL of the TPWA, and the TPWA completes the login authentication step of the third-party service platform itself.
  • the TPWA sends a third-party application HTTP request carrying the third-party application id, the second password, and the redirect address to the WAS, and the WAS verifies that the third-party application id and the second password are valid, generates a valid TPWA codeclient, and redirects the address to TPWA returns a valid Codeclient.
  • the TPWA sends an HTTP request to the WAS to authorize the HTTP request with the valid Codeclient.
  • the WAS authenticates the valid Codeclient. After the verification is passed, the TPWA receives the temporary access token generated by the WAS for the third-party application.
  • the TPWA sends a message carrying the temporary access token to the WAS to authorize the HTTP request, and the WAS authenticates the temporary access token. After the verification is passed, the TPWA receives the temporary user name generated by the WAS for the third-party application, and the TPWA redirects to the home page.
  • the browser carries a temporary access token to initiate a WebSocket connection request to the WS, and the WS extracts the temporary access token to send a verification processing HTTP request to the WAS, and the WAS verifies the temporary access token, and after the verification succeeds, returns the passing information, and the WS returns the connection. Success message to the browser.
  • the TPWA successfully connects to the WS, and can use the temporary user name as the user name to perform WebRTC communication with each WA managed by the WAS.
  • the WebRTC application of the third-party platform accesses the WAS, so that the WebRTC application managed by the WAS can be interconnected with the WebRTC application of the third-party platform, and a typical architecture diagram of the WebRTC service communication is performed.
  • the WebRTC application of the third-party platform performs the login authentication process of the WebRTC application of the third-party platform to the WAS after performing the login authentication of the third-party platform itself. After the authentication is passed, the WebRTC application of the third-party platform can connect to the WS and use the required service capabilities.
  • the TPWA sends the third party application id, the second password, and the redirect address to the WAS.
  • the third-party application identity, the second password, and the redirect address are encrypted in consideration of the security of the transmission.
  • the value obtained after the encryption is passed to the WAS.
  • the WAS After receiving the Value value, the WAS performs the inverse operation to obtain the third-party application id and the redirect address, and the two are divided by $.
  • the Encrypt encryption algorithm is 3DES, the encrypted key is password2, and $ is a token.
  • An embodiment of the present invention provides a web real-time communication platform authentication access method, which is applied to a web real-time communication server WS. As shown in FIG. 10, the method includes:
  • Step S301 Receive a WebSocket connection request that is sent by the browser and carries a valid access token.
  • Step S302 Extracting a valid access token, and sending a verification processing HTTP request carrying a valid access token to the Web real-time communication login authentication network element WAS, and verifying the valid access token by the WAS, and returning the verification pass information;
  • Step S303 receiving the verification pass information returned by the WAS, returning a connection success message to the browser, and completing the connection with each web real-time communication application under the browser.
  • the WS receiving browser carries a temporary access token to initiate a WebSocket connection request, and the WS extracts the temporary access token to send a verification processing HTTP request to the WAS, and the WAS verifies the temporary access token, and after the verification succeeds, returns the passing information.
  • the WS After receiving the pass information, the WS returns a connection success message to the browser to complete the connection with each web real-time communication application under the browser.
  • the embodiment of the present invention provides a web real-time communication platform authentication access device, which is applied to a web real-time communication login authentication network element entity WAS.
  • the device method includes:
  • the receiving verification module 40 is configured to receive a login request carrying the verification information sent by the web real-time communication application, verify the login request sent by the web real-time communication application, and return the login verification when the verification information login verification is successful. Success message
  • the verification sending module 41 is configured to perform authentication verification on the verification information after the login verification succeeds, and after the authentication verification succeeds, send a valid access token and a unique identity to the web real-time communication application, so that the web real-time communication is performed.
  • the application directs the user to the web real-time communication application home page based on the received unique identity and establishes a connection with the web real-time communication server WS based on the valid access token.
  • the receiving verification module 40 includes:
  • the receiving and generating submodule 401 is configured to receive a login request carrying the verification information sent by the web real-time communication application, generate a random number RandomNumer according to the login request, deposit the session, and return the same to the web real-time communication together with the login page. application;
  • the receiving submodule 402 is configured to receive a first encryption result Hashone, a user name Username, and a RandomNumber generated by the web real-time communication application after encrypting the verification information;
  • the first encryption sub-module 403 is configured to verify the Username in the database, and perform encryption operation on the Hashone and the RandomNumber to obtain a second encryption result Hashtwo;
  • the second encryption sub-module 404 is configured to find a corresponding password Password_Hash in the database according to the Username, and perform encryption calculation on the Password_Hash and the RandomNumber stored in the session to obtain a third encryption result Hashthree;
  • the determining sub-module 405 is configured to determine whether the Hashthree and the Hashtwo are consistent. When the two are consistent, the login verification is successful, and the login verification success message is returned to the Web real-time communication application.
  • the verification sending module 41 includes:
  • the generating submodule 411 is configured to perform authentication verification on the verification information, generate a valid client code Codeclient and return to the web real-time communication application, and the web real-time communication application writes the received valid codeclient into the self-session Medium
  • the first processing sub-module 412 is configured to receive the information authorization HTTP request sent by the Web real-time communication application and carry the valid Codeclient, verify the valid Codeclient, and send a valid access token to the Web real-time communication application after the verification is passed.
  • the web real-time communication application writes the received valid access token into its own session;
  • the second processing sub-module 413 is configured to receive an information authorization HTTP request that is sent by the web real-time communication application and carry a valid access token, and verify the valid access token, and send the unique to the web real-time communication application WA after the verification is passed. Identity.
  • the generating sub-module 411 is further configured to:
  • the verification information includes the first user name Username1 and the first password. Password1.
  • the device further includes:
  • the first receiving module 42 is configured to receive, before the receiving and verifying module 40 receives the login request that carries the verification information sent by the WA, the WA to send an authentication processing HTTP request that carries the first access token in the self session, Verify the first access token;
  • the first processing module 43 is configured to send a message that the first access token is invalid to the WA, and receive an authentication processing HTTP request that is sent by the WA to carry the first Codeclient in the self session, and verify the first Codeclient. Check whether the Code value in its own session expires after the verification fails.
  • the jump module 44 is configured to jump to the WAS login interface when the Code value in the self session expires.
  • the device when the message that the first access token is valid is sent to the WA, the device further includes:
  • the first sending module 45 is configured to send a unique identity to the WA, such that the WA invokes various services provided by the WS.
  • the device when the code value in the self session does not expire, the device further includes:
  • the return module 46 is arranged to return a valid Codeclient corresponding to the WA directly to the WA.
  • the device when the web real-time communication application is a web real-time communication application TPWA of a third-party service platform, the device further includes:
  • the second processing module 47 is configured to receive the application access request sent by the TPWA before the receiving and verifying module 40 receives the login request that carries the verification information sent by the TPWA, and approve the application access request. And returning, to the TPWA, a third-party application identity and a second password, where the verification information includes a third-party application identity and a second password.
  • the device further includes:
  • the third processing module 48 is configured to: after validating the third-party application identity and the second password, generate a valid Codeclient, and validate the valid Codeclient. After the verification succeeds, generate a temporary access token to return to the TPWA; After the token verification is passed, a temporary user name is generated and sent to the TPWA, so that the TPWA is redirected to the home page.
  • the embodiment of the invention provides a web real-time communication platform authentication access device, which is applied to a web real-time communication application. As shown in FIG. 12, the device includes:
  • the second sending module 50 is configured to send a login request carrying the verification information to the Web real-time communication login authentication network element WAS, so that the WAS verifies the login request sent by the Web real-time communication application;
  • the second receiving module 51 is configured to receive a login verification success message returned by the WAS;
  • the fourth processing module 52 is configured to receive the valid access token and the unique identifier sent by the WAS after the WAS successfully authenticates the verification information after the login verification succeeds, according to the received unique identifier.
  • the user is directed to the web real-time communication application home page and establishes a connection with the web real-time communication server WS based on the valid access token.
  • the second sending module 50 includes:
  • the sending and receiving sub-module 501 is configured to send a login request carrying the verification information to the WAS, and receive a login page that carries a random number RandomNumber returned by the WAS;
  • the encryption sending submodule 502 is configured to encrypt the verification information to generate a first encryption result Hashone, and send the Hashone, the username Username, and the RandomNumber to the WAS, so that the WAS is according to the received
  • the Hashone, the Username, and the RandomNumber verify the login request sent by the Web real-time communication application.
  • the fourth processing module 52 includes:
  • the receiving and writing sub-module 521 is configured to receive the valid client code Codeclient generated by the WAS according to the authentication information authentication verification, and write the received valid Codeclient into the self-session;
  • the first sending submodule 522 is configured to send an information requesting an HTTP request to the WAS to carry a valid Codeclient, so that the WAS authenticates the valid Codeclient, and receives a valid access token sent by the WAS after valid Codeclient authentication is passed. , the received valid access token is written into its own session;
  • the second sending sub-module 523 is configured to send an information requesting an HTTP request carrying the valid access token to the WAS, so that the WAS verifies the valid access token, and after receiving the verification, receives the unique identifier sent by the WAS.
  • the device when the web real-time communication application is the current platform web real-time communication application, the device further includes:
  • the third sending module 53 is configured to send, to the WAS, a verification processing HTTP request that carries the first access token in the self session before the second sending module 50 sends the login request carrying the authentication information to the WAS, The WAS verifies the first access token;
  • the receiving and sending module 54 is configured to receive a message that the first access token sent by the WAS is invalid, and send an HTTP processing request to the WAS to carry the first Codeclient in the self session, and the WAS performs the first Codeclient on the first Codeclient. Verifies, and checks whether the Code value in the session is expired after the verification fails. When the Code value in the WAS session expires, it jumps to the WAS login interface.
  • the apparatus when receiving the message that the first access token sent by the WAS is valid, the apparatus includes:
  • the receiving invocation module 55 is configured to receive the WAS to send a unique identity, and invoke various services provided by the WS.
  • the device when the code value in the WAS self-session is not expired, the device further includes:
  • the third receiving module 56 is configured to receive the WAS and return a valid Codeclient corresponding to the WA.
  • the device when the web real-time communication application is a web real-time communication application TPWA of a third-party service platform, the device further includes:
  • the application access module 57 is configured to send a request for access to the WAS before the second sending module 50 sends a login request carrying the authentication information to the WAS, where the WAS requests the access request Approved;
  • the fourth receiving module 58 is configured to receive the third-party application identity and the second password sent by the WAS, where the verification information includes a third-party application identity and a second password;
  • the connection module 59 is configured to establish a connection with the third-party service platform to complete login authentication on the third-party service platform.
  • the device further includes:
  • the receiving and writing module 60 is configured to receive the valid Codeclient generated by the WAS, and write the received valid Codeclient into the self session;
  • the fifth processing module 61 is configured to send an information requesting an HTTP request to the WAS to carry the valid Codeclient, so that the WAS authenticates the valid Codeclient, and receives the temporary access token sent by the WAS after the valid Codeclient is verified. Write the received temporary access token to its own session;
  • the sending and receiving module 62 is configured to send an information requesting an HTTP request carrying the temporary access token to the WAS, so that the WAS authenticates the temporary access token, and after receiving the verification, the WAS is sent to send the unique identifier.
  • the embodiment of the present invention provides a web real-time communication platform authentication access device, which is applied to a web real-time communication server WS. As shown in FIG. 13, the device includes:
  • the fifth receiving module 70 is configured to receive a WebSocket connection request that is sent by the browser and carries a valid access token.
  • the extraction sending module 71 is configured to extract a valid access token, send an authentication processing HTTP request carrying a valid access token to the Web real-time communication login authentication network element WAS, and verify, by the WAS, the valid access token, and return Verify the pass information;
  • the receiving and returning module 72 is configured to receive the verification pass information returned by the WAS, return a connection success message to the browser, and complete a connection with each web real-time communication application under the browser.
  • the method for authenticating access of the Web real-time communication platform in the embodiment of the present invention enables the WebRTC application to obtain a valid access token and a unique identifier issued by the WAS, and then use the WebRTC platform to provide each of the WebRTC platforms.
  • Instant messaging service to provide security for users of WebRTC services and WebRTC service platform; and provide single sign-on capability between different WebRTC applications of WebRTC service platform, so that the same user can switch between different WebRTC applications It is more convenient; further, it provides Oauth2.0 access capability for WebRTC applications of third-party service platforms, enabling WebRTC applications on third-party service platforms to acquire various instant messaging service capabilities provided by WebRTC platform, thereby greatly expanding WebRTC.
  • the user category of platform services is more convenient; further, it provides Oauth2.0 access capability for WebRTC applications of third-party service platforms, enabling WebRTC applications on third-party service platforms to acquire various instant messaging service capabilities provided by WebRTC platform, thereby greatly expanding WebRTC.
  • the Web real-time communication platform authentication access device provided by the embodiment of the present invention is a device applying the foregoing method, and all embodiments of the foregoing methods are applicable to the device, and both can achieve the same or similar beneficial effects. .
  • the foregoing technical solution provided by the embodiment of the present invention can be applied to the authentication access process of the Web real-time communication platform. After the login authentication and verification of the verification information is successful, the WebRTC application obtains the valid access token and unique identity issued by the WAS.
  • the identification in turn, can use various instant messaging services provided by the WebRTC platform to provide security for users of the WebRTC service and the WebRTC service platform; and provide single sign-on capability between different WebRTC applications of the WebRTC service platform, so that the same It is more convenient for a user to switch between different WebRTC applications; further, the ORTh2.0 access capability is provided for the WebRTC application of the third-party service platform, so that the WebRTC application on the third-party service platform acquires various kinds of services provided by the WebRTC platform.
  • Instant messaging service capabilities which in turn greatly expand the user range of WebRTC platform services.

Abstract

本发明提供一种Web实时通信平台鉴权接入方法及装置，其中方法包括：接收Web实时通信应用发送的携带验证信息的登录请求，对Web实时通信应用发送的登录请求进行验证，并返回验证信息登录验证成功时的登录验证成功消息；对登录验证成功后的验证信息进行鉴权验证，在鉴权验证成功后，向Web实时通信应用发送有效访问令牌和唯一身份标识，使得Web实时通信应用根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。本发明实施例可以增强Web实时通信服务平台的用户帐户安全性，为Web实时通信服务的用户和Web实时通信服务平台提供安全性保障。

Description

一种Web实时通信平台鉴权接入方法及装置 技术领域
本发明涉及通信技术领域，尤其涉及一种Web实时通信平台鉴权接入方法及装置。
背景技术
WebRTC(Web Real-Time Communication，Web实时通信)是一项支持浏览器进行实时音视频通话和数据共享的技术。WebRTC应用可以在无需插件的情况下直接通过浏览器进行实时通话和文件传送。在具体的业务实施上，通信方使用独立于IP的账号来使用WebRTC服务。虽然业界WebRTC服务平台都会有负责登录鉴权的网元实体，但提供的功能比较简单，只包括基本的登录验证功能，这种做法导致的不良后果是用户帐户管理的安全性较差，进而存在引发平台服务安全性的风险。此外，业务面向的只有自身的用户，无法拓展业务的使用范畴。
业界拓展业务使用范畴的一种较为普遍的做法是使用Oauth开放授权标准。其中比较有代表性的包括新浪微博开放平台、Facebook开放平台等。值得注意的是，这些开放平台在基于Oauth进行认证授权的过程当中，普遍存在的问题是开放平台的合法用户才能接入并使用平台提供的服务，其他第三方接入平台的用户不具备使用开放平台服务的能力。在这种模式下，基于开放平台开放的服务能力开发的第三方平台的应用的使用范畴也被限制在固定的用户范围，即这些用户既是第三方接入平台的用户，又是开放平台的用户。简言之，这种做法所拓展的是服务的使用范围，而不是用户范围。
发明内容
本发明实施例的目的在于提供一种Web实时通信平台鉴权接入方法及装置，可以增强WebRTC服务平台的用户帐户安全性，并有效拓展WebRTC服务平台的用户范畴。
本发明实施例提供一种Web实时通信平台鉴权接入方法，应用于Web实时通信登录鉴权网元实体WAS，所述方法包括：
接收Web实时通信应用发送的携带验证信息的登录请求，对所述Web实时通信应用发送的所述登录请求进行验证，并返回所述验证信息登录验证成功时的登录验证成功消息；
对登录验证成功后的验证信息进行鉴权验证，在鉴权验证成功后，向所述Web实时通信应用发送有效访问令牌和唯一身份标识，使得所述Web实时通信应用根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
其中，所述对所述Web实时通信应用发送的所述登录请求进行验证，并返回所述验证信 息登录验证成功时的登录验证成功消息，包括：
接收所述Web实时通信应用发送的携带验证信息的登录请求，根据所述登录请求生成一个随机数RandomNumer，存入会话并与登录页面一起返回给所述Web实时通信应用；
接收所述Web实时通信应用发送的对所述验证信息进行加密后生成的第一加密结果Hashone、用户名username以及RandomNumber；
在数据库中对所述username进行验证，并对接收到所述Hashone和所述RandomNumber进行加密运算得到第二加密结果Hashtwo；
根据所述username在数据库中查找到对应的密码Password_Hash，对所述Password_Hash和存入会话的所述RandomNumber进行加密计算得到第三加密结果Hashthree；
判断所述Hashthree和所述Hashtwo是否一致，当两者一致则说明登录验证成功，向所述Web实时通信应用返回登录验证成功消息。
其中，所述对登录验证成功后的验证信息进行鉴权验证，在鉴权验证成功后，向所述Web实时通信应用发送有效访问令牌和唯一身份标识，包括：
对所述验证信息进行鉴权验证，生成有效客户端代码Codeclient并返回至所述Web实时通信应用，由所述Web实时通信应用将接收到的有效Codeclient写入自身会话中；
接收所述Web实时通信应用发送的携带有效Codeclient的信息授权超文本传输协议HTTP请求，对有效Codeclient进行验证，验证通过后向所述Web实时通信应用发送有效访问令牌，由所述Web实时通信应用将接收到的有效访问令牌写入自身会话中；
接收所述Web实时通信应用发送的携带有效访问令牌的信息授权HTTP请求，对有效访问令牌进行验证，验证通过后向所述Web实时通信应用WA发送唯一身份标识。
其中，当所述Web实时通信应用为当前平台Web实时通信应用WA时，所述对所述验证信息进行鉴权验证，生成有效客户端代码Codeclient并返回至所述Web实时通信应用，具体为：
对所述验证信息进行鉴权验证，生成代码Code和有效Codeclient，并将生成的Code进行存储，将生成的有效Codeclient发送至所述WA，其中所述验证信息包括第一用户名Username1和第一密码Password1。
其中，在接收所述WA发送的携带验证信息的登录请求之前，所述方法还包括：
接收所述WA发送携带自身会话中的第一访问令牌的验证处理HTTP请求，对第一访问令牌进行验证；
向所述WA发送第一访问令牌无效的消息，接收所述WA发送的携带自身会话中第一Codeclient的鉴权处理HTTP请求，对第一Codeclient进行验证，在验证失败后检查自身会话中的Code值是否过期；
当自身会话中的Code值过期时，跳转到WAS登录界面。
其中，当向所述WA发送第一访问令牌有效的消息时，所述方法包括：
向所述WA发送唯一身份标识，使得所述WA调用所述WS提供的各种服务。
其中，当自身会话中的Code值没有过期时，所述方法包括：
直接向所述WA返回与所述WA对应的有效Codeclient。
其中，当所述Web实时通信应用为第三方业务平台的Web实时通信应用TPWA时，接收所述TPWA发送的携带验证信息的登录请求之前，所述方法还包括：
接收所述TPWA发送的申请接入请求，对所述申请接入请求进行核准后，向所述TPWA返回第三方应用身份标识和第二密码，所述验证信息包括第三方应用身份标识和第二密码。
其中，所述方法还包括：
对第三方应用身份标识和第二密码验证成功后，生成有效Codeclient，对有效Codeclient进行验证，验证成功后，生成临时访问令牌返回至所述TPWA；对临时访问令牌验证通过后，生成临时用户名发送至所述TPWA，使得所述TPWA重定向到主页。
本发明实施例还提供一种Web实时通信平台鉴权接入方法，应用于Web实时通信应用，所述方法包括：
向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求，使得所述WAS对所述Web实时通信应用发送的登录请求进行验证；
接收所述WAS返回的登录验证成功消息；
在所述WAS对登录验证成功后的验证信息进行鉴权验证成功后，接收所述WAS发送的有效访问令牌和唯一身份标识，根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
其中，所述向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求，使得所述WAS对所述Web实时通信应用发送的登录请求进行验证，包括：
向所述WAS发送携带验证信息的登录请求，并接收所述WAS返回的携带一随机数RandomNumber的登录页面；
对所述验证信息进行加密生成第一加密结果Hashone，将所述Hashone、用户名username以及所述RandomNumber发送至所述WAS，使得所述WAS根据接收到的所述Hashone、所述Username和所述RandomNumber对所述Web实时通信应用发送的登录请求进行验证。
其中，所述接收所述WAS发送的有效访问令牌和唯一身份标识的步骤，包括：
接收所述WAS根据所述验证信息鉴权验证中生成的有效客户端代码Codeclient，将接收 到的有效Codeclient写入自身会话中；
向所述WAS发送携带有效Codeclient的信息授权HTTP请求，使得所述WAS对有效Codeclient进行验证，并接收所述WAS在有效Codeclient验证通过后发送的有效访问令牌，将接收到的有效访问令牌写入自身会话中；
向所述WAS发送携带有效访问令牌的信息授权HTTP请求，使得所述WAS对有效访问令牌进行验证，验证通过后接收所述WAS发送的唯一身份标识。
其中，当Web实时通信应用为当前平台Web实时通信应用WA时，所述向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求之前，所述方法还包括：
向所述WAS发送携带自身会话中的第一访问令牌的验证处理HTTP请求，由所述WAS对第一访问令牌进行验证；
接收所述WAS发送的第一访问令牌无效的消息，向所述WAS发送携带自身会话中第一Codeclient的鉴权处理HTTP请求，由所述WAS对第一Codeclient进行验证，并在验证失败后检查自身会话中的Code值是否过期，当所述WAS自身会话中的Code值过期时，跳转到WAS登录界面。
其中，当接收所述WAS发送的第一访问令牌有效的消息时，所述方法包括：
接收所述WAS发送唯一身份标识，调用所述WS提供的各种服务。
其中，当所述WAS自身会话中的Code值没有过期时，所述方法还包括：
接收所述WAS返回与所述WA对应的有效Codeclient。
其中，当所述Web实时通信应用为第三方业务平台的Web实时通信应用TPWA时，向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求之前，所述方法还包括：
向所述WAS发送申请接入请求，由所述WAS对所述申请接入请求进行核准；
接收所述WAS发送的第三方应用身份标识和第二密码，所述验证信息包括第三方应用身份标识和第二密码；
与第三方业务平台建立连接，完成在第三方业务平台的登录鉴权。
其中，所述方法还包括：
接收所述WAS生成的有效Codeclient，将接收到的有效Codeclient写入自身会话中；
向所述WAS发送携带有效Codeclient的信息授权HTTP请求，使得所述WAS对有效Codeclient进行验证，并接收所述WAS在有效Codeclient验证通过后发送的临时访问令牌，将接收到的临时访问令牌写入自身会话中；
向所述WAS发送携带临时访问令牌的信息授权HTTP请求，使得所述WAS对临时访问 令牌进行验证，验证通过后接收所述WAS发送唯一身份标识。
本发明实施例还提供一种Web实时通信平台鉴权接入方法，应用于Web实时通信服务器WS，所述方法包括：
接收浏览器发送的携带有效访问令牌的WebSocket连接请求；
提取有效访问令牌，向Web实时通信登录鉴权网元实体WAS发送携带有效访问令牌的验证处理HTTP请求，由所述WAS对有效访问令牌进行验证，返回验证通过信息；
接收所述WAS返回的验证通过信息，向浏览器返回连接成功消息，完成与浏览器下的各个Web实时通信应用的连接。
本发明实施例还提供一种Web实时通信平台鉴权接入装置，应用于Web实时通信登录鉴权网元实体WAS，所述装置包括：
接收验证模块，设置为接收Web实时通信应用发送的携带验证信息的登录请求，对所述Web实时通信应用发送的所述登录请求进行验证，并返回所述验证信息登录验证成功时的登录验证成功消息；
验证发送模块，设置为对登录验证成功后的验证信息进行鉴权验证，在鉴权验证成功后，向所述Web实时通信应用发送有效访问令牌和唯一身份标识，使得所述Web实时通信应用根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
本发明实施例还提供一种Web实时通信平台鉴权接入装置，应用于Web实时通信应用，所述装置包括：
第二发送模块，设置为向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求，使得所述WAS对所述Web实时通信应用发送的登录请求进行验证；
第二接收模块，设置为接收所述WAS返回的登录验证成功消息；
第四处理模块，设置为在所述WAS对登录验证成功后的验证信息进行鉴权验证成功后，接收所述WAS发送的有效访问令牌和唯一身份标识，根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
本发明实施例还提供一种Web实时通信平台鉴权接入装置，应用于Web实时通信服务器WS，所述装置包括：
第五接收模块，设置为接收浏览器发送的携带有效访问令牌的WebSocket连接请求；
提取发送模块，设置为提取有效访问令牌，向Web实时通信登录鉴权网元实体WAS发送携带有效访问令牌的验证处理HTTP请求，由所述WAS对有效访问令牌进行验证，返回验证通过信息；
接收返回模块，设置为接收所述WAS返回的验证通过信息，向浏览器返回连接成功消息，完成与浏览器下的各个Web实时通信应用的连接。
在本发明实施例中，还提供了一种计算机存储介质，该计算机存储介质可以存储有执行指令，该执行指令用于执行上述实施例中的Web实时通信平台鉴权接入方法的实现。
本发明实施例上述技术方案至少包括如下技术效果：
通过对验证信息进行登录鉴权验证成功后，使得WebRTC应用获得WAS颁发的有效访问令牌和唯一身份标识，进而可以使用WebRTC平台提供的各种即时通信服务，从而为WebRTC服务的用户和WebRTC服务平台提供安全性保障；且提供了WebRTC服务平台不同WebRTC应用之间的单点登录能力，以使得同一个用户在不同WebRTC应用之间切换时更加便捷；进一步地，为第三方业务平台的WebRTC应用提供Oauth2.0的接入能力，使得第三方业务平台上的WebRTC应用获取使用WebRTC平台提供的各种即时通信服务能力，进而极大地拓展WebRTC平台服务的用户范畴。
附图说明
图1为本发明实施例Web实时通信平台鉴权接入方法步骤流程示意图一；
图2为本发明实施例WebRTC服务平台典型架构图；
图3为本发明实施例Web实时通信平台鉴权接入方法步骤流程示意图二；
图4为本发明实施例Web实时通信平台鉴权接入方法步骤流程示意图三；
图5为本发明实施例Web实时通信平台鉴权接入方法步骤流程示意图四；
图6为本发明实施例接入不同WebRTC应用，支持单点登录的示意图；
图7为本发明实施例Web实时通信平台鉴权接入方法步骤流程示意图五；
图8为本发明实施例Web实时通信平台鉴权接入方法步骤流程示意图六；
图9为本发明实施例第三方平台的WebRTC应用接入WAS后进行WebRTC通信的典型架构图；
图10为本发明实施例Web实时通信平台鉴权接入方法步骤流程示意图七；
图11为本发明实施例Web实时通信平台鉴权接入装置示意图一；
图12为本发明实施例Web实时通信平台鉴权接入装置示意图二；
图13为本发明实施例Web实时通信平台鉴权接入装置示意图三。
具体实施方式
为使本发明要解决的技术问题、技术方案和优点更加清楚，下面将结合附图及具体实施例进行详细描述。
本发明实施例提供一种Web实时通信平台鉴权接入方法，应用于Web实时通信登录鉴权网元实体(WebRTC Authentication Server，WAS)，如图1所示，所述方法包括：
步骤S101、接收Web实时通信应用发送的携带验证信息的登录请求，对所述Web实时通信应用发送的所述登录请求进行验证，并返回所述验证信息登录验证成功时的登录验证成功消息；
步骤S102、对登录验证成功后的验证信息进行鉴权验证，在鉴权验证成功后，向所述Web实时通信应用发送有效访问令牌和唯一身份标识，使得所述Web实时通信应用根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
具体的，接收WebRTC应用发送的携带验证信息的登录请求后，对登录请求进行验证，并在验证成功后向WebRTC应用返回登录验证成功消息，同时在登录验证成功后，需要对登录验证成功后的验证信息进行鉴权验证，且在鉴权成功后向WebRTC应用发送有效访问令牌和唯一身份标识，WebRTC应用在接收到唯一身份标识和有效访问令牌之后可以使用WebRTC平台提供的各种即时通信服务，其中访问令牌可简写为AccessToken。
本发明实施例通过为WebRTC服务平台提供Oauth2.0登录鉴权能力，使得WebRTC应用只有在获得WAS颁发的有效访问令牌和唯一身份标识之后才可以使用WebRTC平台提供的各种即时通信服务，从而为WebRTC服务的用户和WebRTC服务平台提供安全性保障。
如图2所示，是使用本发明WAS之后的WebRTC服务平台典型架构图。包括WAS，WebRTC服务器(WebRTC Server，WS)和WebRTC应用。用户在使用WebRTC应用时，需要通过WAS的登录鉴权，才可以使用WebRTC应用提供的基于WebRTC服务平台的实时通信业务。
在本发明上述实施例中，步骤S101包括：
步骤S1011、接收所述Web实时通信应用发送的携带验证信息的登录请求，根据所述登录请求生成一个随机数RandomNumer，存入会话并与登录页面一起返回给所述Web实时通信应用；
步骤S1012、接收所述Web实时通信应用发送的对所述验证信息进行加密后生成的第一加密结果Hashone、用户名username以及RandomNumber；
步骤S1013、在数据库中对所述username进行验证，并对接收到所述Hashone和所述RandomNumber进行加密运算得到第二加密结果Hashtwo；
步骤S1014、根据所述username在数据库中查找到对应的密码Password_Hash，对所述Password_Hash和存入会话中的所述RandomNumber进行加密计算得到第三加密结果Hashthree；
步骤S1015、判断所述Hashthree和所述Hashtwo是否一致，当两者一致则说明登录验证成功，向所述Web实时通信应用返回登录验证成功消息。
具体的，在接收到WebRTC应用发送的携带验证信息的登录请求后，根据登录请求生成一个随机数RandomNumer，将RandomNumer存入自身当前会话中，并将用户登录页面与RandomNumer一起返回给WebRTC应用。其中验证信息包括：用户名username和密码Password。
用户输入验证信息，WebRTC应用对验证信息做哈希加密：Hashone＝MD5(MD5(Password)，Username)得到Hashone。接收WebRTC应用发送的Hashone、Username和RandomNumber，并验证Username在数据库中的存在，当验证得到的结果是Username在数据库中存在时，则对WebRTC应用发送的Hashone和WebRTC应用发送的RandomNumber进行第二次哈希运算Hashtwo＝MD5(HASH(RandomNumber)，Hashone)，得到Hashtwo。
根据Username，在数据库中查找与Username对应的密码Password_Hash，需要说明的是，数据库中密码Password_Hash不是明文存储，而是用户注册时输入验证信息后且进行哈希加密后存储的，即Password_Hash＝MD5(MD5(Password)，Username)运算得到。根据查找得到的Password_Hash和会话中存储的RandomNumber，采用哈希运算进行计算得到Hashthree：Hashthree＝MD5(HASH(RandomNumber)，Password_Hash)。
比较Hashthree和Hashtwo是否一致，如果一致则说明登录验证成功。不管验证成功与否，RandomNumber将被抛弃，下一次登录时，WAS将产生新的随机数参与加密过程。
在本发明上述实施例中，步骤S102包括：
步骤S1021、对所述验证信息进行鉴权验证，生成有效客户端代码Codeclient并返回至所述Web实时通信应用，由所述Web实时通信应用将接收到的有效Codeclient写入自身会话中；
步骤S1022、接收所述Web实时通信应用发送的携带有效Codeclient的信息授权HTTP请求，对有效Codeclient进行验证，验证通过后向所述Web实时通信应用发送有效访问令牌，由所述Web实时通信应用将接收到的有效访问令牌写入自身会话中；
步骤S1023、接收所述Web实时通信应用发送的携带有效访问令牌的信息授权HTTP请求，对有效访问令牌进行验证，验证通过后向所述Web实时通信应用WA发送唯一身份标识。
具体的，WAS对验证信息进行鉴权验证，生成有效Codeclient后发送至WebRTC应用，WebRTC应用在接收到有效Codeclient后写入自身会话中。然后WAS对WebRTC应用发送的有效Codeclient进行验证，在验证通过向WebRTC应用发送有效访问令牌，WebRTC应用将有效访问令牌写入自身会话中。WAS对WebRTC应用发送的有效访问令牌进行验证，验证通过后发送唯一身份标识，使得WebRTC应用在接收到有效访问令牌和唯一身份标识之后可以 使用WebRTC平台提供的各种即时通信服务。
在本发明上述实施例中，当所述Web实时通信应用为当前平台Web实时通信应用WA时，所述对所述验证信息进行鉴权验证，生成有效客户端代码Codeclient并返回至所述Web实时通信应用，具体为：
对所述验证信息进行鉴权验证，生成代码Code和有效Codeclient，并将生成的Code进行存储，将生成的有效Codeclient发送至所述WA，其中所述验证信息包括第一用户名Username1和第一密码Password1。
具体的，Code为用户是否登录的主要凭证，只存储在WAS中，不能将Code返回给WA，但是WA需要一个类似的Code，从而携带这个Code去取得有效访问令牌。在本发明实施例中，对应于每个WA在验证信息进行鉴权验证成功后，会生产一个有效Codeclient作为Code的代替，并将Code与Codeclient关系存储到数据库中，其中有效Codeclient有效访问令牌一一对应。
WA可以携带有效访问令牌来获取用户名和其他用户信息，同时WebRTC系统中，连接WS服务器也要携带有效访问令牌，首次取得有效访问令牌的唯一方式是提供有效Codeclient。
在本发明上述实施例中，在接收所述WA发送的携带验证信息的登录请求之前，所述方法还包括：
接收所述WA发送携带自身会话中的第一访问令牌的验证处理HTTP请求，对第一访问令牌进行验证；
向所述WA发送第一访问令牌无效的消息，接收所述WA发送的携带自身会话中第一Codeclient的鉴权处理HTTP请求，对第一Codeclient进行验证，在验证失败后检查自身会话中的Code值是否过期；
当自身会话中的Code值过期时，跳转到WAS登录界面。
具体的，如图3所示，WA提取自身会话中第一访问令牌，WAS对WA发送的携带自身会话中的第一访问令牌进行验证，当验证不通过时，向WA返回不通过信息。WA在接收到验证不通过信息后，提取自身会话中的第一Codeclient和事先指定的重定向地址redirectURL向WAS发送鉴权处理HTTP请求，WAS对第一Codeclient进行验证，当验证不通过时，向WA返回不通过信息。此时WAS检查自身会话中Code值无效，跳转到WAS自身登录界面。
用户输入Username1和Password1，在对Username1和Password1进行登录验证成功后，需要对Username1和Password1进行鉴权验证，WAS生成Code和有效Codeclient，在WAS的会话中存储Code，重定向到WA传送来的重定向地址，通过重定向地址回传对于WA的有效Codeclient。WA将接收到的有效Codeclient写入自身的会话中，向WAS发送携带有效Codeclient的信息授权HTTP请求，WAS对有效Codeclient进行验证，并在验证通过后，返回有效访问令牌。WA将接收到的有效访问令牌写入自身的会话中，向WAS发送携带有效访 问令牌的信息授权HTTP请求，WAS对有效访问令牌进行验证，并在验证通过后，返回唯一身份标识，也就是第一用户名，WA重定向到应用主页。然后WA携带有效访问令牌向WS发起WebSocket连接请求，WS提取有效访问令牌，向WAS发送验证处理HTTP请求，WAS验证通过，返回通过信息，WS返回连接成功消息给WA，至此，WA成功连接WS，可以发送或接收WebRTC的相关信令，进而使用WebRTC服务器WS提供的相关服务。
在本发明上述实施例中，再次登录同一个WA时，WA中的访问令牌为有效访问令牌，其详细过程如下：
如图4所示，用户刷新WA的统一资源定位符URL，WA提取自身会话中的有效访问令牌，向WAS发送验证处理HTTP请求，经WAS验证成功后返回通过信息。向WAS发送携带有效访问令牌的信息授权HTTP请求，WAS对有效访问令牌进行验证，并在验证通过后，返回唯一身份标识，WA重定向到应用主页。然后WA携带有效访问令牌向WS发起WebSocket连接请求，WS提取有效访问令牌，向WAS发送验证处理HTTP请求，WAS验证通过，返回通过信息，WS返回连接成功消息给WA，至此，WA成功连接WS，可以发送或接收WebRTC的相关信令，进而使用WebRTC服务器WS提供的相关服务。
在本发明上述实施例中，当用户已经登录了WAS的某一个WebRTC应用，用户在这个应用中点击其他应用的链接，不需要用户再次输入用户名密码，可以直接登录到其他应用中。具体流程如图5所示：
用户输入WebRTC应用1(WebRTC Application 1，WA1)的URL，WA1完成登录鉴权的流程，返回WA1主页。用户在WA1主页点击其他(WebRTC Application 2，WA2)链接URL。WA2提取自身会话中的第二访问令牌，WAS对第二访问令牌进行验证，当验证不通过时，向WA2返回不通过信息。WA2在接收到验证不通过信息后，提取自身会话中的第二Codeclient以及事先指定的重定向地址redirectURL，向WAS发送鉴权处理HTTP请求，WAS对第二Codeclient进行验证，当验证不通过时，向WA2返回不通过信息。此时WAS检查自身会话中Code值有效，生成有效Codeclient，通过重定向地址回传对于WA2的有效Codeclient。
WA2将接收到的有效Codeclient写入自身的会话中，向WAS发送携带有效Codeclient的信息授权HTTP请求，WAS对有效Codeclient进行验证，并在验证通过后，返回有效访问令牌。WA2将接收到的有效访问令牌写入自身的会话中，向WAS发送携带有效访问令牌的信息授权HTTP请求，WAS对有效访问令牌进行验证，并在验证通过后，返回唯一身份标识，WA2重定向到应用主页。
然后WA2携带有效访问令牌向WS发起WebSocket连接请求，WS提取有效访问令牌，向WAS发送验证处理HTTP请求，WAS验证通过，返回通过信息，WS返回连接成功消息给WA2，至此，WA2成功连接WS，可以发送或接收WebRTC的相关信令，进而使用WebRTC服务器WS提供的相关服务。
图6是使用本发明WAS之后，同时接入不同WA，提供单点登录能力的示意图。如果某一用户在使用WA1时已经完成与WAS之间的登录鉴权过程，则在WA1中访问WA2时，WA2 会发起与WAS之间的单点登录过程，使得用户不用再次输入用户名密码，直接使用登录WA1过程中的账号信息直接登录WA2。
在本发明上述实施例中，当所述Web实时通信应用为第三方业务平台的Web实时通信应用TPWA时，接收所述TPWA发送的携带验证信息的登录请求之前，所述方法还包括：
接收所述TPWA发送的申请接入请求，对所述申请接入请求进行核准后，向所述TPWA返回第三方应用身份标识和第二密码，所述验证信息包括第三方应用身份标识和第二密码。这里的第三方应用身份标识与上述的用户名所代表的含义相同，用户名是对第一用户名和第三方应用身份标识的一个总体概括，密码是对第一密码和第二密码的总体概括。
向所述TPWA返回第三方应用身份标识和第二密码后，由所述TPWA携带第三方应用身份标识和第二密码向所述WAS发送登录请求，所述WAS对第三方应用身份标识和第二密码进行验证。
在对第三方应用身份标识和第二密码验证成功后，对第三方应用身份标识和第二密码进行鉴权验证，生成有效Codeclient，对有效Codeclient进行验证，验证成功后，生成临时访问令牌返回至所述TPWA；对临时访问令牌验证通过后，生成临时用户名发送至所述TPWA，使得所述TPWA重定向到主页。
本发明实施例还提供一种Web实时通信平台鉴权接入方法，应用于Web实时通信应用，如图7所示，所述方法包括：
步骤S201、向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求，使得所述WAS对所述Web实时通信应用发送的登录请求进行验证；
步骤S202、接收所述WAS返回的登录验证成功消息；
步骤S203、在所述WAS对登录验证成功后的验证信息进行鉴权验证成功后，接收所述WAS发送的有效访问令牌和唯一身份标识，根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
具体的，WebRTC应用发送携带验证信息的登录请求至WAS，由WAS对登录请求进行验证，并在验证成功后向WebRTC应用返回登录验证成功消息，同时WAS需要对登录验证成功后的验证信息进行鉴权验证，WebRTC应用接收在鉴权成功后WAS发送的有效访问令牌和唯一身份标识，WebRTC应用在接收到有效访问令牌和唯一身份标识之后可以使用WebRTC平台提供的各种即时通信服务。
WebRTC应用只有在获得WAS颁发的有效访问令牌和唯一身份标识之后才可以使用WebRTC平台提供的各种即时通信服务，从而为WebRTC服务的用户和WebRTC服务平台提供安全性保障。
在本发明上述实施例中，步骤S201包括：
步骤S2011、向所述WAS发送携带验证信息的登录请求，并接收所述WAS返回的携带 一随机数RandomNumber的登录页面；
步骤S2012、对所述验证信息进行加密生成第一加密结果Hashone，将所述Hashone、用户名Username以及所述RandomNumber发送至所述WAS，使得所述WAS根据接收到的所述Hashone、所述Username和所述RandomNumber对所述Web实时通信应用发送的登录请求进行验证。
具体的，向WAS发送携带验证信息的登录请求后，WAS会根据登录请求生成一个随机数RandomNumer，接收WAS发送的用户登录页面与RandomNumer。然后用户输入验证信息，验证信息包括用户名Username和密码Password，WebRTC应用对接收到验证信息进行哈希加密计算：Hashone＝MD5(MD5(Password)，Username)得到Hashone。向WAS发送Hashone、Username和RandomNumber，当数据库中查找到Username后由WAS对接收到的Hashone和RandomNumber进行第二次哈希加密运算，以得到Hashtwo：Hashtwo＝MD5(HASH(RandomNumber)，Hashone)，并根据与Username对应的密码Password_Hash和会话中存储的RandomNumber，采用哈希运算进行计算得到Hashthree：Hashthree＝MD5(HASH(RandomNumber)，Password_Hash)。比较Hashthree和Hashtwo是否一致，如果一致则说明登录验证成功。
在本发明上述实施例中，步骤S203包括：
步骤S2031、接收所述WAS根据所述验证信息鉴权验证中生成的有效客户端代码Codeclient，将接收到的有效Codeclient写入自身会话中；
步骤S2032、向所述WAS发送携带有效Codeclient的信息授权HTTP请求，使得所述WAS对有效Codeclient进行验证，并接收所述WAS在有效Codeclient验证通过后发送的有效访问令牌，将接收到的有效访问令牌写入自身会话中；
步骤S2033、向所述WAS发送携带有效访问令牌的信息授权HTTP请求，使得所述WAS对有效访问令牌进行验证，验证通过后接收所述WAS发送的唯一身份标识。
具体的，接收WAS对验证信息进行鉴权验证生成的有效Codeclient，WebRTC应用在接收到有效Codeclient后写入自身会话中。然后向WAS发送携带有效Codeclient的信息授权HTTP请求，使得WAS对有效Codeclient进行验证，WebRTC应用接收验证通过后WAS发送有效访问令牌，WebRTC应用将有效访问令牌写入自身会话中。向WAS发送携带有效访问令牌的信息授权HTTP请求，使得WAS对有效访问令牌进行验证，接收在验证通过后WAS发送的唯一身份标识，WebRTC应用在接收到有效访问令牌和唯一身份标识之后可以使用WebRTC平台提供的各种即时通信服务。
在本发明上述实施例中，当Web实时通信应用为当前平台Web实时通信应用WA时，所述向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求之前，所述方法还包括：
向所述WAS发送携带自身会话中的第一访问令牌的验证处理HTTP请求，由所述WAS 对第一访问令牌进行验证；
接收所述WAS发送的第一访问令牌无效的消息，向所述WAS发送携带自身会话中第一Codeclient的鉴权处理HTTP请求，由所述WAS对第一Codeclient进行验证，并在验证失败后检查自身会话中的Code值是否过期，当所述WAS自身会话中的Code值过期时，跳转到WAS登录界面。
具体的，WA提取自身会话中第一访问令牌，向WAS发送验证处理HTTP请求，使得WAS对WA发送的携带自身会话中的第一访问令牌进行验证，当验证不通过时，WA接收WAS返回的不通过信息，提取自身会话中的第一Codeclient，向WAS发送鉴权处理HTTP请求，使得WAS对WA发送的携带自身会话中的第一Codeclient进行验证，当验证不通过时，WA接收WAS返回的不通过信息，此时WAS检查自身会话中Code值无效，跳转到WAS自身登录界面。
在本发明上述实施例中，当接收所述WAS发送的第一访问令牌有效的消息时，所述方法包括：
接收所述WAS发送唯一身份标识，调用所述WS提供的各种服务。
WA携带自身会话中的第一访问令牌，向WAS询问是否有效时，如果WAS检查到第一访问令牌尚在有效期内，则说明用户前面已经登录过，则直接通过第一访问令牌从WAS获得唯一性标识并调用WS提供的各种服务。具体的应用场景包括用户临时断开或进行刷新浏览器这样的操作。
在本发明上述实施例中，当所述WAS自身会话中的Code值没有过期时，所述方法还包括：
接收所述WAS返回与所述WA对应的有效Codeclient。
WAS检查WAS当中与WA相对应的会话中的Code值，发现Code值有效并且没有过期，说明用户已经登录了某一个应用WA，此时WAS直接返回这个WA对应的有效Codeclient，不需要重定向到登录页面。具体的应用场景为用户在使用多个WA之间进行切换时。
在本发明上述实施例中，当所述Web实时通信应用为第三方业务平台的Web实时通信应用TPWA时，向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求之前，所述方法还包括：
向所述WAS发送申请接入请求，由所述WAS对所述申请接入请求进行核准；
接收所述WAS发送的第三方应用身份标识和第二密码，所述验证信息包括第三方应用身份标识和第二密码；
与第三方业务平台建立连接，完成在第三方业务平台的登录鉴权。
具体的，如图8所示，TPWA通过邮件或其他方式申请接入WAS，WAS的管理者核准后， 邮件或其他方式返回第三方应用身份标识id和第二密码password2。TPWA的用户输入TPWA的URL，TPWA完成在第三方业务平台自身的登录鉴权步骤。
然后，TPWA向WAS发送携带第三方应用id、第二密码和重定向地址的第三方处理HTTP请求，WAS验证第三方应用id、第二密码合法，生成TPWA的有效Codeclient，并通过重定向地址向TPWA回传有效Codeclient。
TPWA向WAS发送携带有效Codeclient的信息授权HTTP请求，由WAS对有效Codeclient进行验证，在验证通过后，TPWA接收WAS为第三方应用生成的临时访问令牌。
TPWA向WAS发送携带临时访问令牌的信息授权HTTP请求，由WAS对临时访问令牌进行验证，在验证通过后，TPWA接收WAS为第三方应用生成的临时用户名，TPWA重定向到主页。
浏览器携带临时访问令牌向WS发起WebSocket连接请求，WS提取临时访问令牌向WAS发送验证处理HTTP请求，WAS对临时访问令牌进行验证，并在验证成功后，返回通过信息，WS返回连接成功消息给浏览器。至此，TPWA成功连接WS，可以使用临时用户名作为用户名与WAS管理的各WA进行WebRTC通信。
如图9所示，第三方平台的WebRTC应用接入WAS，使得WAS管理的WebRTC应用与第三方平台的WebRTC应用能够互联，进行WebRTC业务通信的典型架构图。第三方平台的WebRTC应用在进行完第三方平台本身的登录鉴权后，向WAS进行第三方平台的WebRTC应用登录鉴权流程。在鉴权通过后，则第三方平台的WebRTC应用可以连接WS，使用所需要的服务能力。
在本发明上述实施例中，TPWA向WAS发送第三方应用id、第二密码和重定向地址时。考虑到传输的安全性，会对第三方应用身份标识、第二密码以及重定向地址进行加密。经过加密后得到的Value值传递至WAS，WAS在收到Value值之后进行反向运算得到第三方应用id和重定向地址，两者之间以$符合分割。
具体算法如下：
Value＝URLEncoding(Base64(ID+$+Encrypt(ID+$+redirectURL)+$+Digest),
Digest＝Base64(Hash(ID+$+redirectURL))
Encrypt加密算法为3DES，加密的密钥为password2，$为标记符号。
本发明实施例提供一种Web实时通信平台鉴权接入方法，应用于Web实时通信服务器WS，如图10所示，所述方法包括：
步骤S301、接收浏览器发送的携带有效访问令牌的WebSocket连接请求；
步骤S302、提取有效访问令牌，向Web实时通信登录鉴权网元实体WAS发送携带有效访问令牌的验证处理HTTP请求，由所述WAS对有效访问令牌进行验证，返回验证通过信息；
步骤S303、接收所述WAS返回的验证通过信息，向浏览器返回连接成功消息，完成与浏览器下的各个Web实时通信应用的连接。
具体的，WS接收浏览器携带临时访问令牌发起WebSocket连接请求，WS提取临时访问令牌向WAS发送验证处理HTTP请求，由WAS对临时访问令牌进行验证，并在验证成功后，返回通过信息，WS接收到通过信息后，返回连接成功消息给浏览器，完成与浏览器下的各个Web实时通信应用的连接。
本发明实施例提供一种Web实时通信平台鉴权接入装置，应用于Web实时通信登录鉴权网元实体WAS，如图11所示，装置方法包括：
接收验证模块40，设置为接收Web实时通信应用发送的携带验证信息的登录请求，对所述Web实时通信应用发送的所述登录请求进行验证，并返回所述验证信息登录验证成功时的登录验证成功消息；
验证发送模块41，设置为对登录验证成功后的验证信息进行鉴权验证，在鉴权验证成功后，向所述Web实时通信应用发送有效访问令牌和唯一身份标识，使得所述Web实时通信应用根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
在本发明上述实施例中，所述接收验证模块40包括：
接收生成子模块401，设置为接收所述Web实时通信应用发送的携带验证信息的登录请求，根据所述登录请求生成一个随机数RandomNumer，存入会话并与登录页面一起返回给所述Web实时通信应用；
接收子模块402，设置为接收所述Web实时通信应用发送的对所述验证信息进行加密后生成的第一加密结果Hashone、用户名Username以及RandomNumber；
第一加密子模块403，设置为在数据库中对所述Username进行验证，并对接收到所述Hashone和所述RandomNumber进行加密运算得到第二加密结果Hashtwo；
第二加密子模块404，设置为根据所述Username在数据库中查找到对应的密码Password_Hash，对所述Password_Hash和存入会话的所述RandomNumber进行加密计算得到第三加密结果Hashthree；
判断子模块405，设置为判断所述Hashthree和所述Hashtwo是否一致，当两者一致则说明登录验证成功，向所述Web实时通信应用返回登录验证成功消息。
在本发明上述实施例中，所述验证发送模块41包括：
生成子模块411，设置为对所述验证信息进行鉴权验证，生成有效客户端代码Codeclient并返回至所述Web实时通信应用，由所述Web实时通信应用将接收到的有效Codeclient写入自身会话中；
第一处理子模块412，设置为接收所述Web实时通信应用发送的携带有效Codeclient的信息授权HTTP请求，对有效Codeclient进行验证，验证通过后向所述Web实时通信应用发送有效访问令牌，由所述Web实时通信应用将接收到的有效访问令牌写入自身会话中；
第二处理子模块413，设置为接收所述Web实时通信应用发送的携带有效访问令牌的信息授权HTTP请求，对有效访问令牌进行验证，验证通过后向所述Web实时通信应用WA发送唯一身份标识。
在本发明上述实施例中，当所述Web实时通信应用为当前平台Web实时通信应用WA时，所述生成子模块411进一步设置为：
对所述验证信息进行鉴权验证，生成Code和有效Codeclient，并将生成的Code进行存储，将生成的有效Codeclient发送至所述WA，其中所述验证信息包括第一用户名Username1和第一密码Password1。
在本发明上述实施例中，所述装置还包括：
第一接收模块42，设置为在所述接收验证模块40接收所述WA发送的携带验证信息的登录请求之前，接收所述WA发送携带自身会话中的第一访问令牌的验证处理HTTP请求，对第一访问令牌进行验证；
第一处理模块43，设置为向所述WA发送第一访问令牌无效的消息，接收所述WA发送的携带自身会话中第一Codeclient的鉴权处理HTTP请求，对第一Codeclient进行验证，在验证失败后检查自身会话中的Code值是否过期；
跳转模块44，设置为当自身会话中的Code值过期时，跳转到WAS登录界面。
在本发明上述实施例中，当向所述WA发送第一访问令牌有效的消息时，所述装置还包括：
第一发送模块45，设置为向所述WA发送唯一身份标识，使得所述WA调用所述WS提供的各种服务。
在本发明上述实施例中，当自身会话中的Code值没有过期时，所述装置还包括：
返回模块46，设置为直接向所述WA返回与所述WA对应的有效Codeclient。
在本发明上述实施例中，当所述Web实时通信应用为第三方业务平台的Web实时通信应用TPWA时，所述装置还包括：
第二处理模块47，设置为在所述接收验证模块40接收所述TPWA发送的携带验证信息的登录请求之前，接收所述TPWA发送的申请接入请求，对所述申请接入请求进行核准后，向所述TPWA返回第三方应用身份标识和第二密码，所述验证信息包括第三方应用身份标识和第二密码。
在本发明上述实施例中，所述装置还包括：
第三处理模块48，设置为对第三方应用身份标识和第二密码验证成功后，生成有效Codeclient，对有效Codeclient进行验证，验证成功后，生成临时访问令牌返回至所述TPWA；对临时访问令牌验证通过后，生成临时用户名发送至所述TPWA，使得所述TPWA重定向到主页。
本发明实施例提供一种Web实时通信平台鉴权接入装置，应用于Web实时通信应用，如图12所示，所述装置包括：
第二发送模块50，设置为向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求，使得所述WAS对所述Web实时通信应用发送的登录请求进行验证；
第二接收模块51，设置为接收所述WAS返回的登录验证成功消息；
第四处理模块52，设置为在所述WAS对登录验证成功后的验证信息进行鉴权验证成功后，接收所述WAS发送的有效访问令牌和唯一身份标识，根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
在本发明上述实施例中，所述第二发送模块50包括：
发送接收子模块501，设置为向所述WAS发送携带验证信息的登录请求，并接收所述WAS返回的携带一随机数RandomNumber的登录页面；
加密发送子模块502，设置为对所述验证信息进行加密生成第一加密结果Hashone，将所述Hashone、用户名Username以及所述RandomNumber发送至所述WAS，使得所述WAS根据接收到的所述Hashone、所述Username和所述RandomNumber对所述Web实时通信应用发送的登录请求进行验证。
在本发明上述实施例中，所述第四处理模块52包括：
接收写入子模块521，设置为接收所述WAS根据所述验证信息鉴权验证中生成的有效客户端代码Codeclient，将接收到的有效Codeclient写入自身会话中；
第一发送子模块522，设置为向所述WAS发送携带有效Codeclient的信息授权HTTP请求，使得所述WAS对有效Codeclient进行验证，并接收所述WAS在有效Codeclient验证通过后发送的有效访问令牌，将接收到的有效访问令牌写入自身会话中；
第二发送子模块523，设置为向所述WAS发送携带有效访问令牌的信息授权HTTP请求，使得所述WAS对有效访问令牌进行验证，验证通过后接收所述WAS发送的唯一身份标识。
在本发明上述实施例中，当Web实时通信应用为当前平台Web实时通信应用WA时，所述装置还包括:
第三发送模块53，设置为所述第二发送模块50向所述WAS发送携带验证信息的登录请求之前，向所述WAS发送携带自身会话中的第一访问令牌的验证处理HTTP请求，由所述WAS对第一访问令牌进行验证；
接收发送模块54，设置为接收所述WAS发送的第一访问令牌无效的消息，向所述WAS发送携带自身会话中第一Codeclient的鉴权处理HTTP请求，由所述WAS对第一Codeclient进行验证，并在验证失败后检查自身会话中的Code值是否过期，当所述WAS自身会话中的Code值过期时，跳转到WAS登录界面。
在本发明上述实施例中，当接收所述WAS发送的第一访问令牌有效的消息时，所述装置包括：
接收调用模块55，设置为接收所述WAS发送唯一身份标识，调用所述WS提供的各种服务。
在本发明上述实施例中，当所述WAS自身会话中的Code值没有过期时，所述装置还包括：
第三接收模块56，设置为接收所述WAS返回与所述WA对应的有效Codeclient。
在本发明上述实施例中，当所述Web实时通信应用为第三方业务平台的Web实时通信应用TPWA时，所述装置还包括：
申请接入模块57，设置为所述第二发送模块50向所述WAS发送携带验证信息的登录请求之前，向所述WAS发送申请接入请求，由所述WAS对所述申请接入请求进行核准；
第四接收模块58，设置为接收所述WAS发送的第三方应用身份标识和第二密码，所述验证信息包括第三方应用身份标识和第二密码；
连接模块59，设置为与第三方业务平台建立连接，完成在第三方业务平台的登录鉴权。
在本发明上述实施例中，所述装置还包括：
接收写入模块60，设置为接收所述WAS生成的有效Codeclient，将接收到的有效Codeclient写入自身会话中；
第五处理模块61，设置为向所述WAS发送携带有效Codeclient的信息授权HTTP请求，使得所述WAS对有效Codeclient进行验证，并接收所述WAS在有效Codeclient验证通过后发送的临时访问令牌，将接收到的临时访问令牌写入自身会话中；
发送接收模块62设置为向所述WAS发送携带临时访问令牌的信息授权HTTP请求，使得所述WAS对临时访问令牌进行验证，验证通过后接收所述WAS发送唯一身份标识。
本发明实施例提供一种Web实时通信平台鉴权接入装置，应用于Web实时通信服务器WS，如图13所示，所述装置包括：
第五接收模块70，设置为接收浏览器发送的携带有效访问令牌的WebSocket连接请求；
提取发送模块71，设置为提取有效访问令牌，向Web实时通信登录鉴权网元实体WAS发送携带有效访问令牌的验证处理HTTP请求，由所述WAS对有效访问令牌进行验证，返回 验证通过信息；
接收返回模块72，设置为接收所述WAS返回的验证通过信息，向浏览器返回连接成功消息，完成与浏览器下的各个Web实时通信应用的连接。
本发明实施例Web实时通信平台鉴权接入方法，通过对验证信息进行登录鉴权验证成功后，使得WebRTC应用获得WAS颁发的有效访问令牌和唯一身份标识，进而可以使用WebRTC平台提供的各种即时通信服务，从而为WebRTC服务的用户和WebRTC服务平台提供安全性保障；且提供了WebRTC服务平台不同WebRTC应用之间的单点登录能力，以使得同一个用户在不同WebRTC应用之间切换时更加便捷；进一步地，为第三方业务平台的WebRTC应用提供Oauth2.0的接入能力，使得第三方业务平台上的WebRTC应用获取使用WebRTC平台提供的各种即时通信服务能力，进而极大地拓展WebRTC平台服务的用户范畴。
需要说明的是，本发明实施例提供的Web实时通信平台鉴权接入装置是应用上述方法的装置，则上述方法的所有实施例均适用于该装置，且均能达到相同或相似的有益效果。
以上所述是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明所述原理的前提下，还可以作出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。
工业实用性
本发明实施例提供的上述技术方案，可以应用于Web实时通信平台鉴权接入过程中，通过对验证信息进行登录鉴权验证成功后，使得WebRTC应用获得WAS颁发的有效访问令牌和唯一身份标识，进而可以使用WebRTC平台提供的各种即时通信服务，从而为WebRTC服务的用户和WebRTC服务平台提供安全性保障；且提供了WebRTC服务平台不同WebRTC应用之间的单点登录能力，以使得同一个用户在不同WebRTC应用之间切换时更加便捷；进一步地，为第三方业务平台的WebRTC应用提供Oauth2.0的接入能力，使得第三方业务平台上的WebRTC应用获取使用WebRTC平台提供的各种即时通信服务能力，进而极大地拓展WebRTC平台服务的用户范畴。

Claims (21)

  1. 一种Web实时通信平台鉴权接入方法，应用于Web实时通信登录鉴权网元实体WAS，所述方法包括：
    接收Web实时通信应用发送的携带验证信息的登录请求，对所述Web实时通信应用发送的所述登录请求进行验证，并返回所述验证信息登录验证成功时的登录验证成功消息；
    对登录验证成功后的验证信息进行鉴权验证，在鉴权验证成功后，向所述Web实时通信应用发送有效访问令牌和唯一身份标识，使得所述Web实时通信应用根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
  2. 如权利要求1所述的方法，其中，所述对所述Web实时通信应用发送的所述登录请求进行验证，并返回所述验证信息登录验证成功时的登录验证成功消息，包括：
    接收所述Web实时通信应用发送的携带验证信息的登录请求，根据所述登录请求生成一个随机数RandomNumer，存入会话并与登录页面一起返回给所述Web实时通信应用；
    接收所述Web实时通信应用发送的对所述验证信息进行加密后生成的第一加密结果Hashone、用户名Username以及RandomNumber；
    在数据库中对所述Username进行验证，并对接收到所述Hashone和所述RandomNumber进行加密运算得到第二加密结果Hashtwo；
    根据所述Username在数据库中查找到对应的密码Password_Hash，对所述Password_Hash和存入会话的所述RandomNumber进行加密计算得到第三加密结果Hashthree；
    判断所述Hashthree和所述Hashtwo是否一致，当两者一致则说明登录验证成功，向所述Web实时通信应用返回登录验证成功消息。
  3. 如权利要求1所述的方法，其中，所述对登录验证成功后的验证信息进行鉴权验证，在鉴权验证成功后，向所述Web实时通信应用发送有效访问令牌和唯一身份标识，包括：
    对所述验证信息进行鉴权验证，生成有效客户端代码Codeclient并返回至所述Web实时通信应用，由所述Web实时通信应用将接收到的有效Codeclient写入自身会话中；
    接收所述Web实时通信应用发送的携带有效Codeclient的信息授权超文本传输协议HTTP请求，对有效Codeclient进行验证，验证通过后向所述Web实时通信应用发送有效访问令牌，由所述Web实时通信应用将接收到的有效访问令牌写入自身会话中；
    接收所述Web实时通信应用发送的携带有效访问令牌的信息授权HTTP请求，对有效访问令牌进行验证，验证通过后向所述Web实时通信应用WA发送唯一身份标识。
  4. 如权利要求3所述的方法，其中，当所述Web实时通信应用为当前平台Web实时通信应 用WA时，所述对所述验证信息进行鉴权验证，生成有效客户端代码Codeclient并返回至所述Web实时通信应用，具体为：
    对所述验证信息进行鉴权验证，生成代码Code和有效Codeclient，并将生成的Code进行存储，将生成的有效Codeclient发送至所述WA，其中所述验证信息包括第一用户名Username1和第一密码Password1。
  5. 如权利要求4所述的方法，其中，在接收所述WA发送的携带验证信息的登录请求之前，所述方法还包括：
    接收所述WA发送携带自身会话中的第一访问令牌的验证处理HTTP请求，对第一访问令牌进行验证；
    向所述WA发送第一访问令牌无效的消息，接收所述WA发送的携带自身会话中第一Codeclient的鉴权处理HTTP请求，对第一Codeclient进行验证，在验证失败后检查自身会话中的Code值是否过期；
    当自身会话中的Code值过期时，跳转到WAS登录界面。
  6. 如权利要求5所述的方法，其中，当向所述WA发送第一访问令牌有效的消息时，所述方法包括：
    向所述WA发送唯一身份标识，使得所述WA调用所述WS提供的各种服务。
  7. 如权利要求5所述的方法，其中，当自身会话中的Code值没有过期时，所述方法包括：
    直接向所述WA返回与所述WA对应的有效Codeclient。
  8. 如权利要求3所述的方法，其中，当所述Web实时通信应用为第三方业务平台的Web实时通信应用TPWA时，接收所述TPWA发送的携带验证信息的登录请求之前，所述方法还包括：
    接收所述TPWA发送的申请接入请求，对所述申请接入请求进行核准后，向所述TPWA返回第三方应用身份标识和第二密码，所述验证信息包括第三方应用身份标识和第二密码。
  9. 如权利要求8所述的方法，其中，所述方法还包括：
    对第三方应用身份标识和第二密码验证成功后，生成有效Codeclient，对有效Codeclient进行验证，验证成功后，生成临时访问令牌返回至所述TPWA；对临时访问令牌验证通过后，生成临时用户名发送至所述TPWA，使得所述TPWA重定向到主页。
  10. 一种Web实时通信平台鉴权接入方法，应用于Web实时通信应用，所述方法包括：
    向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求，使得所述WAS对所述Web实时通信应用发送的登录请求进行验证；
    接收所述WAS返回的登录验证成功消息；
    在所述WAS对登录验证成功后的验证信息进行鉴权验证成功后，接收所述WAS发送的有效访问令牌和唯一身份标识，根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
  11. 如权利要求10所述的方法，其中，所述向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求，使得所述WAS对所述Web实时通信应用发送的登录请求进行验证，包括：
    向所述WAS发送携带验证信息的登录请求，并接收所述WAS返回的携带一随机数RandomNumber的登录页面；
    对所述验证信息进行加密生成第一加密结果Hashone，将所述Hashone、用户名Username以及所述RandomNumber发送至所述WAS，使得所述WAS根据接收到的所述Hashone、所述Username和所述RandomNumber对所述Web实时通信应用发送的登录请求进行验证。
  12. 如权利要求10所述的方法，其中，所述接收所述WAS发送的有效访问令牌和唯一身份标识的步骤，包括：
    接收所述WAS根据所述验证信息鉴权验证中生成的有效客户端代码Codeclient，将接收到的有效Codeclient写入自身会话中；
    向所述WAS发送携带有效Codeclient的信息授权HTTP请求，使得所述WAS对有效Codeclient进行验证，并接收所述WAS在有效Codeclient验证通过后发送的有效访问令牌，将接收到的有效访问令牌写入自身会话中；
    向所述WAS发送携带有效访问令牌的信息授权HTTP请求，使得所述WAS对有效访问令牌进行验证，验证通过后接收所述WAS发送的唯一身份标识。
  13. 如权利要求12所述的方法，其中，当Web实时通信应用为当前平台Web实时通信应用WA时，所述向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求之前，所述方法还包括：
    向所述WAS发送携带自身会话中的第一访问令牌的验证处理HTTP请求，由所述WAS对第一访问令牌进行验证；
    接收所述WAS发送的第一访问令牌无效的消息，向所述WAS发送携带自身会话中第一Codeclient的鉴权处理HTTP请求，由所述WAS对第一Codeclient进行验证，并在验证失败后检查自身会话中的Code值是否过期，当所述WAS自身会话中的Code值过期时，跳转到WAS登录界面。
  14. 如权利要求13所述的方法，其中，当接收所述WAS发送的第一访问令牌有效的消息时，所述方法包括：
    接收所述WAS发送唯一身份标识，调用所述WS提供的各种服务。
  15. 如权利要求13所述的方法，其中，当所述WAS自身会话中的Code值没有过期时，所述方法还包括：
    接收所述WAS返回与所述WA对应的有效Codeclient。
  16. 如权利要求12所述的方法，其中，当所述Web实时通信应用为第三方业务平台的Web实时通信应用TPWA时，向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求之前，所述方法还包括：
    向所述WAS发送申请接入请求，由所述WAS对所述申请接入请求进行核准；
    接收所述WAS发送的第三方应用身份标识和第二密码，所述验证信息包括第三方应用身份标识和第二密码；
    与第三方业务平台建立连接，完成在第三方业务平台的登录鉴权。
  17. 如权利要求16所述的方法，其中，所述方法还包括：
    接收所述WAS生成的有效Codeclient，将接收到的有效Codeclient写入自身会话中；
    向所述WAS发送携带有效Codeclient的信息授权HTTP请求，使得所述WAS对有效Codeclient进行验证，并接收所述WAS在有效Codeclient验证通过后发送的临时访问令牌，将接收到的临时访问令牌写入自身会话中；
    向所述WAS发送携带临时访问令牌的信息授权HTTP请求，使得所述WAS对临时访问令牌进行验证，验证通过后接收所述WAS发送唯一身份标识。
  18. 一种Web实时通信平台鉴权接入方法，应用于Web实时通信服务器WS，所述方法包括：
    接收浏览器发送的携带有效访问令牌的WebSocket连接请求；
    提取有效访问令牌，向Web实时通信登录鉴权网元实体WAS发送携带有效访问令牌的验证处理HTTP请求，由所述WAS对有效访问令牌进行验证，返回验证通过信息；
    接收所述WAS返回的验证通过信息，向浏览器返回连接成功消息，完成与浏览器下的各个Web实时通信应用的连接。
  19. 一种Web实时通信平台鉴权接入装置，应用于Web实时通信登录鉴权网元实体WAS，所述装置包括：
    接收验证模块，设置为接收Web实时通信应用发送的携带验证信息的登录请求，对所述Web实时通信应用发送的所述登录请求进行验证，并返回所述验证信息登录验证成功时的登录验证成功消息；
    验证发送模块，设置为对登录验证成功后的验证信息进行鉴权验证，在鉴权验证成 功后，向所述Web实时通信应用发送有效访问令牌和唯一身份标识，使得所述Web实时通信应用根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
  20. 一种Web实时通信平台鉴权接入装置，应用于Web实时通信应用，所述装置包括：
    第二发送模块，设置为向Web实时通信登录鉴权网元实体WAS发送携带验证信息的登录请求，使得所述WAS对所述Web实时通信应用发送的登录请求进行验证；
    第二接收模块，设置为接收所述WAS返回的登录验证成功消息；
    第四处理模块，设置为在所述WAS对登录验证成功后的验证信息进行鉴权验证成功后，接收所述WAS发送的有效访问令牌和唯一身份标识，根据接收到的唯一身份标识将用户定向到Web实时通信应用主页，并根据有效访问令牌建立与Web实时通信服务器WS的连接。
  21. 一种Web实时通信平台鉴权接入装置，应用于Web实时通信服务器WS，所述装置包括：
    第五接收模块，设置为接收浏览器发送的携带有效访问令牌的WebSocket连接请求；
    提取发送模块，设置为提取有效访问令牌，向Web实时通信登录鉴权网元实体WAS发送携带有效访问令牌的验证处理HTTP请求，由所述WAS对有效访问令牌进行验证，返回验证通过信息；
    接收返回模块，设置为接收所述WAS返回的验证通过信息，向浏览器返回连接成功消息，完成与浏览器下的各个Web实时通信应用的连接。
PCT/CN2016/095951 2015-08-19 2016-08-19 一种Web实时通信平台鉴权接入方法及装置 WO2017028804A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510510506.1 2015-08-19
CN201510510506.1A CN106470190A (zh) 2015-08-19 2015-08-19 一种Web实时通信平台鉴权接入方法及装置

Publications (1)

Publication Number Publication Date
WO2017028804A1 true WO2017028804A1 (zh) 2017-02-23

Family

ID=58050890

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/095951 WO2017028804A1 (zh) 2015-08-19 2016-08-19 一种Web实时通信平台鉴权接入方法及装置

Country Status (2)

Country Link
CN (1) CN106470190A (zh)
WO (1) WO2017028804A1 (zh)

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108667810A (zh) * 2018-04-18 2018-10-16 珠海横琴盛达兆业科技投资有限公司 一种基于小程序的安全登录验证方法
CN110582769A (zh) * 2019-07-11 2019-12-17 深圳市鹰硕技术有限公司 一种单账号多身份登录方法、装置、服务器及存储介质
CN111355583A (zh) * 2018-12-20 2020-06-30 中移（杭州）信息技术有限公司 一种业务提供系统、方法、装置、电子设备及存储介质
CN111447184A (zh) * 2020-03-09 2020-07-24 上海数据交易中心有限公司 单点登录方法及装置、系统、计算机可读存储介质
CN111510461A (zh) * 2020-04-26 2020-08-07 成都安恒信息技术有限公司 一种web应用集中发布权限管理系统及方法
CN112612985A (zh) * 2020-12-24 2021-04-06 广州致远电子有限公司 基于WebSocket的多用户和多类型消息的推送系统及方法
CN112800139A (zh) * 2021-02-23 2021-05-14 浪潮云信息技术股份公司 一种基于消息队列的第三方应用数据同步系统
CN113364798A (zh) * 2021-06-21 2021-09-07 浪潮云信息技术股份公司 一种基于Redis的用户访问频率处理装置
CN113781194A (zh) * 2021-09-06 2021-12-10 青岛微智慧信息有限公司 适用于灵活用工的接入监管方法及系统
CN114726632A (zh) * 2022-04-14 2022-07-08 天工信创(广州)信息科技有限公司 一种登录方法、装置、存储介质及处理器
US11449636B2 (en) 2019-10-04 2022-09-20 Mastercard International Incorporated Systems and methods for secure provisioning of data using secure tokens
CN115277234A (zh) * 2022-08-01 2022-11-01 重庆标能瑞源储能技术研究院有限公司 一种基于物联网平台微服务的安全认证方法及系统
US11652813B2 (en) 2019-10-04 2023-05-16 Mastercard International Incorporated Systems and methods for real-time identity verification using a token code
CN116962092A (zh) * 2023-09-21 2023-10-27 畅捷通信息技术股份有限公司 一种生态集成登录方法、系统、电子设备及存储介质

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107153793B (zh) * 2017-05-17 2020-03-27 深圳市马博士网络科技有限公司 一种重要数据存储的防破译方法
CN107846447A (zh) * 2017-09-21 2018-03-27 烽火通信科技股份有限公司 一种基于mqtt协议的家庭终端接入消息中间件的方法
CN110061952B (zh) * 2018-01-19 2021-08-06 腾讯科技（深圳）有限公司 信息处理方法、装置、存储介质和电子装置
CN108776923A (zh) * 2018-06-05 2018-11-09 深圳壹账通智能科技有限公司 订单支付方法、系统、计算机设备和存储介质
US11310217B2 (en) * 2018-09-07 2022-04-19 Paypal, Inc. Using ephemeral URL passwords to deter high-volume attacks
CN109327437B (zh) * 2018-09-29 2020-02-21 深圳市多易得信息技术股份有限公司 并发websocket业务信息处理方法及服务端
CN111526111B (zh) * 2019-02-02 2021-10-22 腾讯科技（深圳）有限公司 登录轻应用的控制方法、装置和设备及计算机存储介质
CN110266722A (zh) * 2019-07-05 2019-09-20 深圳市浩科电子有限公司 一种多途径访问服务器的方法及系统
CN110493239B (zh) * 2019-08-26 2021-11-12 京东数字科技控股有限公司 鉴权的方法和装置
CN111107109A (zh) * 2020-01-08 2020-05-05 世纪恒通科技股份有限公司 一种基于token的免登录技术
CN114079650A (zh) * 2020-08-11 2022-02-22 华为技术有限公司 一种基于ims数据通道的通信方法及设备
CN112118236A (zh) * 2020-09-04 2020-12-22 紫光云(南京)数字技术有限公司 一种平台应用开放授权管理方法
CN112199656B (zh) * 2020-12-03 2021-02-26 湖北亿咖通科技有限公司 业务平台的访问权限获取方法和业务平台的访问控制方法
CN114070616B (zh) * 2021-11-15 2024-02-27 广东亿迅科技有限公司 一种基于redis缓存的分布式会话共享方法及系统
CN114615084B (zh) * 2022-04-11 2024-04-16 西安热工研究院有限公司 一种应用于前后端分离场景的单点登录注销方法、系统、电子设备和储存介质
CN115242474A (zh) * 2022-07-14 2022-10-25 观澜网络(杭州)有限公司 一种实时通讯系统、方法、终端设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140282978A1 (en) * 2013-03-15 2014-09-18 Sergio Demian LERNER Method and apparatus for secure interaction with a computer service provider
CN104113511A (zh) * 2013-04-17 2014-10-22 中国移动通信集团公司 一种接入ims网络的方法、系统及相关装置
CN104283681A (zh) * 2013-07-08 2015-01-14 华为技术有限公司 一种对用户的合法性进行验证的方法、装置及系统
CN104468487A (zh) * 2013-09-23 2015-03-25 华为技术有限公司 通信认证方法及装置、终端设备

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104144167B (zh) * 2014-08-15 2017-05-17 深圳市蜂联科技有限公司 一种开放式智能网关平台的用户登录认证方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140282978A1 (en) * 2013-03-15 2014-09-18 Sergio Demian LERNER Method and apparatus for secure interaction with a computer service provider
CN104113511A (zh) * 2013-04-17 2014-10-22 中国移动通信集团公司 一种接入ims网络的方法、系统及相关装置
CN104283681A (zh) * 2013-07-08 2015-01-14 华为技术有限公司 一种对用户的合法性进行验证的方法、装置及系统
CN104468487A (zh) * 2013-09-23 2015-03-25 华为技术有限公司 通信认证方法及装置、终端设备

Cited By (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108667810A (zh) * 2018-04-18 2018-10-16 珠海横琴盛达兆业科技投资有限公司 一种基于小程序的安全登录验证方法
CN111355583A (zh) * 2018-12-20 2020-06-30 中移（杭州）信息技术有限公司 一种业务提供系统、方法、装置、电子设备及存储介质
CN111355583B (zh) * 2018-12-20 2022-12-27 中移（杭州）信息技术有限公司 一种业务提供系统、方法、装置、电子设备及存储介质
CN110582769A (zh) * 2019-07-11 2019-12-17 深圳市鹰硕技术有限公司 一种单账号多身份登录方法、装置、服务器及存储介质
US11652813B2 (en) 2019-10-04 2023-05-16 Mastercard International Incorporated Systems and methods for real-time identity verification using a token code
US11914752B2 (en) 2019-10-04 2024-02-27 Mastercard International Incorporated Systems and methods for secure provisioning of data using secure tokens
US11449636B2 (en) 2019-10-04 2022-09-20 Mastercard International Incorporated Systems and methods for secure provisioning of data using secure tokens
CN111447184A (zh) * 2020-03-09 2020-07-24 上海数据交易中心有限公司 单点登录方法及装置、系统、计算机可读存储介质
CN111510461B (zh) * 2020-04-26 2022-02-22 成都安恒信息技术有限公司 一种web应用集中发布权限管理系统及方法
CN111510461A (zh) * 2020-04-26 2020-08-07 成都安恒信息技术有限公司 一种web应用集中发布权限管理系统及方法
CN112612985A (zh) * 2020-12-24 2021-04-06 广州致远电子有限公司 基于WebSocket的多用户和多类型消息的推送系统及方法
CN112800139A (zh) * 2021-02-23 2021-05-14 浪潮云信息技术股份公司 一种基于消息队列的第三方应用数据同步系统
CN113364798A (zh) * 2021-06-21 2021-09-07 浪潮云信息技术股份公司 一种基于Redis的用户访问频率处理装置
CN113781194A (zh) * 2021-09-06 2021-12-10 青岛微智慧信息有限公司 适用于灵活用工的接入监管方法及系统
CN114726632A (zh) * 2022-04-14 2022-07-08 天工信创(广州)信息科技有限公司 一种登录方法、装置、存储介质及处理器
CN114726632B (zh) * 2022-04-14 2024-04-05 广州鑫景信息科技服务有限公司 一种登录方法、设备及存储介质
CN115277234B (zh) * 2022-08-01 2024-01-09 重庆标能瑞源储能技术研究院有限公司 一种基于物联网平台微服务的安全认证方法及系统
CN115277234A (zh) * 2022-08-01 2022-11-01 重庆标能瑞源储能技术研究院有限公司 一种基于物联网平台微服务的安全认证方法及系统
CN116962092A (zh) * 2023-09-21 2023-10-27 畅捷通信息技术股份有限公司 一种生态集成登录方法、系统、电子设备及存储介质
CN116962092B (zh) * 2023-09-21 2023-12-26 畅捷通信息技术股份有限公司 一种生态集成登录方法、系统、电子设备及存储介质

Also Published As

Publication number Publication date
CN106470190A (zh) 2017-03-01

Similar Documents

Publication Publication Date Title
WO2017028804A1 (zh) 一种Web实时通信平台鉴权接入方法及装置
US9871791B2 (en) Multi factor user authentication on multiple devices
CN106209749B (zh) 单点登录方法及装置、相关设备和应用的处理方法及装置
CN111556006B (zh) 第三方应用系统登录方法、装置、终端及sso服务平台
WO2022262078A1 (zh) 基于零信任安全的访问控制方法、设备及存储介质
TWI725958B (zh) 雲端主機服務權限控制方法、裝置和系統
US9537861B2 (en) Method of mutual verification between a client and a server
US9722984B2 (en) Proximity-based authentication
US9584615B2 (en) Redirecting access requests to an authorized server system for a cloud service
US9369286B2 (en) System and methods for facilitating authentication of an electronic device accessing plurality of mobile applications
CN107347068A (zh) 单点登录方法及系统、电子设备
US10218691B2 (en) Single sign-on framework for browser-based applications and native applications
US10530763B2 (en) Late binding authentication
US10320771B2 (en) Single sign-on framework for browser-based applications and native applications
US8832857B2 (en) Unsecured asset detection via correlated authentication anomalies
US20160381001A1 (en) Method and apparatus for identity authentication between systems
US10257171B2 (en) Server public key pinning by URL
CN105430014B (zh) 一种单点登录方法及其系统
CN111865882B (zh) 一种微服务认证方法和系统
Ye et al. Formal analysis of a single sign-on protocol implementation for android
Huang et al. A token-based user authentication mechanism for data exchange in RESTful API
Hossain et al. OAuth-SSO: A framework to secure the OAuth-based SSO service for packaged web applications
CN110944021A (zh) 校园统一认证和单点登录的方法和系统
JP6240102B2 (ja) 認証システム、認証鍵管理装置、認証鍵管理方法および認証鍵管理プログラム
CN116647345A (zh) 权限令牌的生成方法以及装置、存储介质、计算机设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16836668

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16836668

Country of ref document: EP

Kind code of ref document: A1