WO2018228199A1

WO2018228199A1 - Authorization method and related device

Info

Publication number: WO2018228199A1
Application number: PCT/CN2018/089039
Authority: WO
Inventors: 袁哲
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2017-06-14
Filing date: 2018-05-30
Publication date: 2018-12-20
Also published as: CN107222485A; CN107222485B

Abstract

Disclosed are an authorization method and a related device. The method in the embodiments of the present application comprises: a server receiving a first temporary certificate sent by a terminal device; the server determining a target authority according to the first temporary certificate; and the server sending a second temporary certificate to the terminal device, wherein the second temporary certificate is used to indicate the target authority, such that the terminal device accesses the target resource on the server by means of the second temporary certificate. It can be seen that the server can implement the refined authority management of the terminal device by means of the second temporary certificate, that is, the terminal device only has access to a target authority for the server, thereby guaranteeing the security and flexibility of the terminal device accessing the target resource on the server.

Description

Authorization method and related equipment

The present application claims the priority of the Chinese Patent Application, filed on Jun. 14, 2017, the application Serial No. .

Technical field

The present application relates to the field of communications technologies, and in particular, to an authorization method and related devices.

Background technique

When the terminal device accesses the resource, the resource owner needs to be authorized, and the terminal device can access the resource under the authorization of the resource owner.

In general, when the terminal device accesses the resource, it first sends a request message to the resource owner, and the resource owner sends the authorization code to the terminal device. The terminal device requests the access token from the authorization server through the authorization code, and authorizes the server to the terminal. The device performs verification. After the verification, the access token is returned to the terminal device, and the terminal device accesses the resource on the resource owner through the access token. The specific process is shown in FIG. 1 .

In the above solution, the resource owner's authorization process for the terminal device is real-time authorization, and the refined permission requirement cannot be defined for the terminal device. Generally, the rights are divided into coarse-grained categories, which cannot satisfy the cloud. The fine-grained rights management requirements of the service, and the use of the access token as a credential for accessing the resource after authorization, are less secure.

Summary of the invention

The embodiment of the present application provides an authorization method and related equipment.

The first aspect of the application provides an authorization method, including:

Receiving, by the server, a first temporary certificate sent by the terminal device, where the first temporary certificate is used to request access to resources on the server;

Determining, by the server, a target authority corresponding to the terminal according to the first temporary certificate, where the target authority is a right to access a target resource on the server;

Sending, by the server, the second temporary certificate to the terminal device, so that the terminal device accesses the target resource by using the second temporary certificate.

A second aspect of the present application provides an authorization method, including:

The terminal device sends the first temporary certificate to the server, where the first temporary certificate is used to request access to resources on the server, so that the server determines the target authority corresponding to the terminal device according to the first temporary certificate, The target authority is a right to access a target resource on the server; the server is a server on a cloud service provider side, and the terminal device is a server on a third party service provider side;

Receiving, by the terminal device, a second temporary certificate corresponding to the target authority sent by the server;

The terminal device accesses the target resource by using the second temporary certificate.

A third aspect of the present application provides a server, including:

a receiving unit, configured to receive a first temporary certificate sent by the terminal device, where the first temporary certificate is used to request access to resources on the server;

a determining unit, configured to determine, according to the first temporary certificate, a target right corresponding to the terminal device, where the target right is a right to access a target resource on the server;

And a sending unit, configured to send the second temporary certificate corresponding to the target authority to the terminal device, so that the terminal device accesses the target resource by using the second temporary certificate.

A fourth aspect of the present application provides a terminal device, including:

a sending unit, configured to send the first temporary certificate to the server, where the first temporary certificate is used to request access to resources on the server, so that the server determines, according to the first temporary certificate, the terminal device a target authority, the target authority being a right to access a target resource on the server;

a receiving unit, configured to receive a second temporary certificate corresponding to the target authority sent by the server;

And an access unit, configured to access the target resource by using the second temporary certificate.

A fifth aspect of the present application provides a server, including:

One or more central processing units, a memory, a bus system, and one or more programs, the central processing unit and the memory being coupled by the bus system;

Wherein the one or more programs are stored in the memory, the one or more programs comprising instructions that, when executed by the server, cause the server to perform the first aspect as provided by the present application The authorization method described.

A sixth aspect of the present application provides a terminal device, including:

One or more processor units, memory units, bus systems, and one or more programs, the processor units and the memory units being coupled by the bus system;

Wherein the one or more programs are stored in the storage unit, the one or more programs including instructions that, when executed by the terminal device, cause the terminal device to perform the second aspect of the present application The authorization method described.

A seventh aspect of the present application provides a computer storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method of the first aspect of the application.

A seventh aspect of the present application provides a computer storage medium comprising instructions which, when run on a computer, cause the computer to perform the method of the second aspect of the present application.

As can be seen from the above technical solutions, the embodiments of the present application have the following advantages:

The server may implement refinement authority management on the terminal device by using the second temporary certificate, that is, the terminal device has only access to the target right to the server, and ensures that the terminal device accesses the The security and flexibility of the server's target resources.

DRAWINGS

1 is a schematic flow chart of steps of an authorization method;

2 is a schematic structural diagram of an embodiment of a structure of a cloud service system provided by the present application;

3 is a schematic structural diagram of an embodiment of a cloud service provider side server provided by the present application;

4 is a schematic structural diagram of an embodiment of a terminal device provided by the present application;

FIG. 5 is a flow chart of steps of an embodiment of an authorization method provided by the present application;

6 is a flow chart of steps of another embodiment of the authorization method provided by the present application;

FIG. 7 is a flow chart of steps of another embodiment of the authorization method provided by the present application;

FIG. 8 is a schematic diagram of creating a pre-selected permission provided by the present application;

9 is a schematic structural diagram of another embodiment of a cloud service provider side server provided by the present application;

FIG. 10 is a schematic structural diagram of another embodiment of a terminal device provided by the present application;

FIG. 11 is a schematic diagram of an application scenario provided by the present application.

detailed description

The embodiment of the present application provides an authorization method for performing refined rights management on a terminal device. It should be understood that the server in the embodiment of the present application may be a cloud service provider side server, and may be other types of servers. The specific application is not limited. The following embodiment uses a cloud service provider side server as an example to implement the present application. The authorization method and related equipment in the example are introduced.

It should be understood that the authorization method shown in this embodiment may be based on a cloud service system. The structure of the cloud service system shown in this embodiment may be as shown in FIG. 2, where the cloud service system includes a cloud service provider side server 201. . The cloud service provider side server shown in this embodiment is a server on the service platform side of the cloud service provider.

The cloud service system shown in this embodiment further includes at least one terminal device 202. This embodiment is exemplified by taking the number of the terminal devices 202 as one.

The terminal device 202 shown in this embodiment is a device on the third party service provider side.

The third-party service provider provides a cloud computing product-based service platform established by the cloud service provider, and provides software, service, website construction, and enterprise application service to the cloud service developer to help the user to better use the service platform. Cloud computing products and services.

The cloud service provider side server shown in this embodiment may be a resource owner (RO), or the cloud service provider side server may be a resource server (Resource Server), or the cloud service is provided. The vendor side server can be an Authorization Server (AS).

In this embodiment, the terminal device 202 can request authorization from the cloud service provider side server through the OAUTH protocol.

The configuration of the cloud service provider side server 201 is optionally described below with reference to FIG. 3 . Specifically, the description of the cloud service provider side server structure in this embodiment is an optional example. It is defined that the cloud service provider side server 201 can implement authorization of the terminal device 202 to enable the terminal device 202 to access resources on the cloud service provider side server 201 according to authorization.

The cloud service provider side server may vary considerably depending on configuration or performance, and may include one or more central processing units (CPU) 301 (eg, one or more processors) and memory 302, one or more storage media 305 that store application 303 or data 304 (eg, one or one storage device in Shanghai). The memory 302 and the storage medium 305 may be short-term storage or persistent storage. The program stored on storage medium 305 can include one or more modules (not shown), each of which can include a series of instruction operations in the server. Still further, the central processing unit 301 can be configured to communicate with the storage medium 305 to perform a series of instruction operations in the storage medium 305 on the cloud service provider side server.

The cloud service provider side server may also include one or more power sources 306, one or more wired or wireless network interfaces 307, one or more input and output interfaces 308, and/or one or more operating systems 309, such as Windows. ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM and more.

The specific structure of the terminal device 202 shown in this embodiment is exemplarily described below with reference to FIG.

The terminal device includes components such as an input unit 405, a processor unit 403, an output unit 401, a communication unit 407, a storage unit 404, a radio frequency circuit 408, and the like.

These components communicate over one or more buses. It will be understood by those skilled in the art that the structure of the terminal device shown in FIG. 4 does not constitute a limitation of the present application, and it may be a bus-shaped structure or a star-shaped structure, and may include more or more than the illustration. There are few parts, or some parts are combined, or different parts are arranged.

In the embodiment of the present application, the terminal device may be any mobile or portable electronic device, including but not limited to a smart phone, a mobile computer, a tablet computer, a personal digital assistant (PDA), a media player, a smart TV. Wait.

The terminal device includes:

The output unit 401 is configured to output an image to be displayed.

Specifically, the output unit 401 includes but is not limited to the image output unit 4011 and the sound output unit 4012.

The image output unit 4011 is configured to output text, pictures, and/or video. The image output unit 4011 may include a display panel, for example, a liquid crystal display (English name: Liquid Crystal Display, English abbreviation: LCD), an organic light emitting diode (English name: Organic Light-Emitting Diode, English abbreviation: OLED), field emission A display panel configured in the form of a display (English name: field emission display, FED for short). Alternatively, the image output unit 4011 may include a reflective display, such as an electrophoretic display, or a display using an Interferometric Modulation of Light.

The image output unit 4011 may include a single display or a plurality of displays of different sizes. In a specific embodiment of the present application, the touch screen can also serve as a display panel of the output unit 401 at the same time.

For example, when the touch screen detects a touch or proximity gesture operation thereon, it is transmitted to the processor unit 403 to determine the type of the touch event, and then the processor unit 403 provides a corresponding visual output on the display panel according to the type of the touch event. . Although in FIG. 4, the input unit 405 and the output unit 401 are two independent components to implement the input and output functions of the terminal device, in some embodiments, the touch device may be integrated with the display panel to implement the terminal device. Input and output functions. For example, the image output unit 4011 can display various graphical user interfaces (English full name: Graphical User Interface, English abbreviated as GUI) as virtual control components, including but not limited to windows, scroll axes, icons, and scrapbooks. For users to operate by touch.

In the specific implementation of the present application, the image output unit 4011 includes a filter and an amplifier for filtering and amplifying the video output by the processor unit 403. The sound output unit 4012 includes a digital to analog converter for converting the audio signal output by the processor unit 403 from a digital format to an analog format.

The processor unit 403 is configured to run a corresponding code to process the received information to generate and output a corresponding interface.

Specifically, the processor unit 403 is a control center of the terminal device, and connects various parts of the entire terminal device by using various interfaces and lines, by running or executing software programs and/or modules stored in the storage unit, and calling the storage. Data within the storage unit to perform various functions of the terminal device and/or process data. The processor unit 403 may be composed of an integrated circuit (English name: Integrated Circuit, English abbreviation: IC), for example, may be composed of a single packaged IC, or may be connected to a plurality of package ICs having the same function or different functions. composition.

For example, the processor unit 403 may include only a central processing unit (English name: Central Processing Unit, English abbreviation: CPU), or may be a graphics processor (English name: Graphics Processing Unit, English abbreviation: GPU). A combination of a digital signal processor (English name: Digital Signal Processor, English abbreviation: DSP) and a control chip (for example, a baseband chip) in a communication unit. In the embodiment of the present application, the CPU may be a single operation core, and may also include a multi-operation core.

The storage unit 404 is configured to store code and data, and the code is run by the processor unit 403.

Specifically, the storage unit 404 can be used to store software programs and modules, and the processor unit 403 executes various functional applications of the terminal device and implements data processing by running software programs and modules stored in the storage unit 404. The storage unit 404 mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, such as a sound playing program, an image playing program, and the like; and the data storage area can be stored according to the terminal. Data created by the use of the device (such as audio data, phone book, etc.).

In the specific implementation of the present application, the storage unit 404 may include a volatile memory, such as non-volatile dynamic random access memory (Nonvolatile Random Access Memory, NVRAM for short), phase change random access memory (English full name) :Phase Change RAM (PRAM), magnetoresistive random access memory (English full name: Magetoresistive RAM, English abbreviation MRAM), etc., may also include non-volatile memory, such as at least one disk storage device, electronically erasable Programmable read-only memory (English full name: Electrically Erasable Programmable Read-Only Memory, EEPROM for short), flash memory devices, such as reverse or flash memory (English full name: NOR flash memory) or reverse flash memory (English full name: NAND flash memory) .

The non-volatile memory stores an operating system and applications executed by the processor unit 403. The processor unit 403 loads the running program and data from the non-volatile memory into the memory and stores the digital content in a plurality of storage devices. The operating system includes various components and/or drivers for controlling and managing conventional system tasks such as memory management, storage device control, power management, and the like, as well as facilitating communication between various hardware and software.

In the embodiment of the present application, the operating system may be an Android system of Google, an iOS system developed by Apple, a Windows operating system developed by Microsoft, or an embedded operating system such as Vxworks.

The application includes any application installed on the terminal device, including but not limited to browsers, emails, instant messaging services, word processing, keyboard virtualization, widgets, encryption, digital rights management, voice recognition, Voice copying, positioning (such as those provided by GPS), music playback, and more.

The input unit 405 is configured to implement interaction between the user and the terminal device and/or information input into the terminal device.

For example, the input unit 405 can receive numeric or character information input by a user to generate a signal input related to user settings or function control. In the specific implementation of the present application, the input unit 405 may be a touch screen, or may be other human-computer interaction interfaces, such as physical input keys, microphones, etc., and may also be other external information capture devices, such as cameras.

The touch screen shown in the embodiment of the present application can collect an operation action touched or approached by the user. For example, the user uses an action of any suitable object or accessory such as a finger, a stylus, or the like on the touch screen or near the touch screen, and drives the corresponding connecting device according to a preset program. Optionally, the touch screen may include two parts: a touch detection device and a touch controller. Wherein the touch detection device detects a touch operation of the user, converts the detected touch operation into an electrical signal, and transmits the electrical signal to the touch controller; the touch controller receives the electrical signal from the touch detection device, and It is converted into contact coordinates and sent to the processor unit 403.

The touch controller can also receive commands from the processor unit 403 and execute them. In addition, the touch screen can implement touch screens by using various types such as resistive, capacitive, infrared, and surface acoustic waves.

In other implementations of the present application, the physical input keys used by the input unit 405 may include, but are not limited to, a physical keyboard, function keys (such as a volume control button, a switch button, etc.), a trackball, a mouse, a joystick, and the like. One or more. The input unit 405 in the form of a microphone can collect the voice input by the user or the environment and convert it into a command executable by the processor unit 403 in the form of an electrical signal.

In some other implementations of the present application, the input unit 405 may also be various types of sensor components, such as Hall devices, for detecting physical quantities of the terminal device, such as force, moment, pressure, stress, position, displacement, Speed, acceleration, angle, angular velocity, number of revolutions, speed, and time when the operating state changes, etc., are converted into electricity for detection and control. Other sensor components may also include gravity sensors, three-axis accelerometers, gyroscopes, electronic compasses, ambient light sensors, proximity sensors, temperature sensors, humidity sensors, pressure sensors, heart rate sensors, fingerprint readers, and the like.

The communication unit 407 is configured to establish a communication channel, enable the terminal device to connect to the remote server through the communication channel, and download media data from the remote server. The communication unit 407 may include a wireless local area network (English name: Wireless Local Area Network, English short: wireless LAN) module, a Bluetooth module, a baseband module, and the like, and a radio frequency corresponding to the communication module (English name: Radio Frequency, English abbreviation: RF) circuit for wireless local area network communication, Bluetooth communication, infrared communication and/or cellular communication system communication, such as broadband code division multiple access (English full name: Wideband Code Division Multiple Access, English abbreviation: W -CDMA) and/or high speed downlink packet access (English full name: High Speed Downlink Packet Access, English abbreviation HSDPA). The communication module is used to control communication of components in the terminal device and can support direct memory access.

In various implementation manners of the present application, various communication modules in the communication unit 407 generally appear in the form of an integrated circuit chip (English name: Integrated Circuit Chip), and can be selectively combined without including all communication modules. And the corresponding antenna group. For example, the communication unit 407 can include only a baseband chip, a radio frequency chip, and a corresponding antenna to provide communication functionality in a cellular communication system. The wireless communication connection established via the communication unit 407, such as wireless local area network access or WCDMA access, may be connected to a cellular network (English name: Cellular Network) or the Internet. In some optional implementations of the present application, a communication module, such as a baseband module, in the communication unit 407 can be integrated into the processor unit 403, typically an APQ+MDM series platform such as that provided by Qualcomm.

The radio frequency circuit 408 is used for receiving and transmitting signals during information transmission and reception or during a call. For example, after the downlink information of the base station is received, it is processed by the processor unit 403; in addition, the data for designing the uplink is transmitted to the base station. Generally, the radio frequency circuit 408 includes well-known circuits for performing these functions, including but not limited to an antenna system, a radio frequency transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, A Codec chipset, a Subscriber Identity Module (SIM) card, a memory, and the like. In addition, radio frequency circuitry 408 can also communicate with the network and other devices via wireless communication.

The wireless communication may use any communication standard or protocol, including but not limited to a global mobile communication system (English full name: Global System of Mobile communication, English abbreviation: GSM), general packet radio service (English full name: General Packet Radio Service, English abbreviation: GPRS), code division multiple access (English full name: Code Division Multiple Access, English abbreviation: CDMA), wideband code division multiple access (English full name: Wideband Code Division Multiple Access, English abbreviation: WCDMA), high-speed uplink chain Road packet access technology (English full name: High Speed Uplink Packet Access, English abbreviation: HSUPA), long-term evolution (English full name: Long Term Evolution, English abbreviation: LTE), e-mail, short message service (English full name: Short Messaging Service , English abbreviation: SMS) and so on.

A power source 409 is provided to power different components of the terminal device to maintain its operation. As a general understanding, the power source 409 may be a built-in battery, such as a conventional lithium ion battery, a nickel hydride battery, etc., and also includes an external power source that directly supplies power to the terminal device, such as an AC adapter. In some implementations of the present application, the power supply 409 can also be more widely defined, for example, can also include a power management system, a charging system, a power failure detection circuit, a power converter or inverter, and a power status indicator. (such as light-emitting diodes), and any other components associated with the power generation, management, and distribution of the terminal equipment.

As shown in FIG. 1 to FIG. 4 , the authorization method provided by the embodiment of the present application is described in detail below with reference to FIG.

Step 501: The cloud service provider side server receives the first temporary certificate sent by the terminal device.

The first temporary certificate is used to request access to resources on the cloud service provider side server;

Specifically, in a case that the terminal device needs to request the cloud service provider side server to access resources on the cloud service provider side server, the user may log in to the target website of the terminal device, where the target The website is a website for obtaining the authorization of the cloud service provider side server, and the website is enabled to enable the terminal device to send the first temporary certificate to the cloud service provider side server.

In the case that the terminal device needs to obtain the authorization of the cloud service provider side server, the terminal device may send the first temporary certificate to the cloud service provider side server.

Step 502: The cloud service provider side server determines, according to the first temporary certificate, a target authority corresponding to the terminal device.

The target authority is a right to access a target resource on the cloud service provider side server.

Step 503: The cloud service provider side server sends a second temporary certificate corresponding to the terminal device to the terminal device.

The second temporary certificate shown in this embodiment is a short-term certificate. The effective time of the second temporary certificate can be configured from a few minutes to a few hours. Once the credentials of the second temporary certificate expire, the cloud service provider side server will no longer identify the second temporary certificate, thereby making the terminal device no longer able to access the cloud service provider through the second temporary certificate. The target resource on the side server.

The specific execution process of the authorization method performed by the cloud service provider side server shown in this embodiment is shown in the embodiment shown in FIG. 7 .

Based on FIG. 1 to FIG. 4 , the authorization method provided by the embodiment of the present application is described in detail below with reference to FIG. 6 .

Step 601: The terminal device sends the first temporary certificate to the cloud service provider side server.

For the description of the first temporary certificate, refer to the embodiment shown in FIG. 5, which is not specifically described in this embodiment.

Step 602: The terminal device receives a second temporary certificate sent by the cloud service provider side server.

For the description of the second temporary certificate, refer to the embodiment shown in FIG. 5, which is not specifically described in this embodiment.

Step 603: The terminal device accesses the target resource on the cloud service provider side server by using the second temporary certificate.

The specific execution process of the authorization method performed by the terminal device shown in this embodiment is shown in the embodiment shown in FIG.

The execution flow of the authorization method shown in FIG. 5 and FIG. 6 is specifically described in detail below with reference to FIG. 7:

As shown in FIG. 7, the authorization method includes:

Step 701: The terminal device sends the request information to the cloud service provider side server.

For the detailed description of the terminal device shown in this embodiment, please refer to the foregoing embodiment, which is not specifically described in this embodiment.

Specifically, the request information shown in this embodiment includes first token information that has been stored by the terminal device.

The first token information is used by the terminal device to perform authentication to the cloud service provider side server.

In this embodiment, the type of the first token information may be multiple. The type of the first token information is not limited in this embodiment.

The terminal device shown in this embodiment requests authentication from the cloud service provider side server by using the first token information, so that the cloud service provider side server can determine the location based on the first token information. Whether the terminal device is forged, whether it is unauthorized, whether it expires, etc.

More specifically, the terminal device shown in this embodiment may store the uniform resource locator URL address of the cloud service provider side server, and the terminal device shown in this embodiment may be located according to the unified resource location. The URL address is sent to the cloud service provider side server to send the request information.

More specifically, the terminal device shown in this embodiment may send the request information to a website for authenticating the terminal device on the cloud service provider side server according to the URL address.

Step 702: The cloud service provider side server receives the request information sent by the terminal device.

Specifically, the specific description of the cloud service provider side server is shown in the above embodiment, and is not described in detail in this embodiment.

Step 703: The cloud service provider side server generates fourth signature information.

Specifically, after receiving the request information, the cloud service provider side server shown in this embodiment may identify the first key, the first token information, and the cloud service provider side. The random reply information (echoInfo) generated by the server performs encryption calculation to generate fourth signature information.

Specifically, the cloud service provider side server shown in this embodiment generates the first key identifier, the first token information, and the cloud service provider side server according to the stored long-term key. The random reply information is subjected to an encryption calculation to generate fourth signature information.

Step 704: The cloud service provider side server sends the fourth signature information to the terminal device.

Step 705: The terminal device determines whether the fourth signature information meets the first condition, and if yes, performs step 706.

In this embodiment, after the terminal device receives the fourth signature information, the fourth signature information may be decrypted and calculated to obtain the first key identifier included in the fourth signature information, and the first a token information and random reply information generated by the cloud service provider side server.

The first condition shown in this embodiment is that the first token information included in the fourth signature information is the same as the first token information that is stored by the terminal device.

In this embodiment, if the terminal device determines that the first token information included in the fourth signature information is the same as the first token information that is stored by the terminal device, If the terminal device determines that the fourth signature information meets the first condition, step 706 may continue to be performed.

Step 706: The terminal device sends the fifth signature information to the cloud service provider side server.

Specifically, the terminal device shown in this embodiment sends the random reply information included in the fourth signature information to the cloud service provider side server.

The specific sending manner is that the terminal device performs encryption calculation on the received random reply information to generate the fifth signature information, that is, the fifth signature information generated by the terminal device includes the random reply message.

The terminal device shown in this embodiment may send the random reply information to the cloud service provider side server by using the fifth signature information.

In this embodiment, the terminal device may invoke a target interface of the cloud service provider side server to implement data interaction between the terminal device and the cloud service provider side server.

Specifically, the target interface of the cloud service provider side server may be an Application Programming Interface (API) of the Open Service Auhorization of the cloud service provider side server.

The terminal device shown in this embodiment invokes the target interface of the cloud service provider side server by using the fifth signature information.

Step 707: The cloud service provider side server acquires the random reply information included in the fifth signature information.

Specifically, the cloud service provider side server performs decryption calculation on the fifth signature information to obtain the random reply information included in the fifth signature information.

Step 708: The cloud service provider side server determines whether the fifth signature information satisfies the second condition, and if yes, performs step 709.

In this embodiment, after the cloud service provider side server obtains the random reply information included in the fifth signature information, it may determine whether the fifth signature information satisfies the second condition.

The second condition is that the random reply information included in the fifth signature information is the same as the random reply information generated by the cloud service provider side server.

Determining, by the cloud service provider side server, that the random reply information included in the fifth signature information is the same as the random reply information generated by the cloud service provider side server, that is, the fifth signature If the information satisfies the second condition, the cloud service provider side server and the terminal device complete the URL confirmation, and the cloud service provider side server and the terminal device that complete the URL confirmation are completed. Data interaction is possible between.

Specifically, after the URL confirmation is completed between the cloud service provider side server and the terminal device, the target interface of the cloud service provider side server is successfully invoked by the terminal device.

Step 709: The cloud service provider side server generates first signature information.

Specifically, the cloud service provider side server shown in this embodiment performs encryption calculation on the encrypted ticket to generate first signature information, where the encrypted ticket is used to authenticate the terminal device.

Step 710: The cloud service provider side server sends the first signature information to the terminal device.

In this embodiment, after the first signature information is generated by the cloud service provider side server, the generated first signature information may be sent to the cloud service provider side server.

Step 711: The terminal device sends the second signature information to the cloud service provider side server.

Specifically, after receiving the first signature information, the terminal device shown in this embodiment may perform decryption calculation on the first signature information to obtain the encryption included in the first signature information. bill.

More specifically, the terminal device performs an encryption calculation on the encrypted ticket to generate the second signature information, and the second signature information generated by the terminal device includes the encrypted ticket.

Step 712: The cloud service provider side server acquires the encrypted ticket included in the second signature information.

Specifically, the cloud service provider side server shown in this embodiment may receive the second signature information sent by the terminal device, and perform decryption calculation on the second signature information to obtain the second The encrypted ticket included in the signature information.

Step 713: The cloud service provider side server acquires third signature information.

Specifically, after obtaining the encrypted ticket included in the second signature information, the cloud service provider side server may perform encryption calculation on the encrypted ticket included in the second signature information to generate The third signature information.

Step 714: The cloud service provider side server sends the first temporary certificate to the terminal device if it is determined that the third condition is met.

Specifically, the cloud service provider side server shown in this embodiment determines whether the second signature information and the third signature information are the same. If the second signature information and the third signature information are the same, Then, the cloud service provider side server can determine that the third condition is met, that is, the third condition shown in this embodiment is: the third signature information is the same as the second signature information.

Optionally, the terminal device may perform encryption calculation on the encrypted ticket by using a long-term key of the terminal device, and request the first temporary to the cloud service provider side server by encrypting the calculated encrypted ticket. a certificate, after the terminal device obtains the first temporary certificate, the terminal device can complete an authentication link with the cloud service provider side server by using the first temporary certificate, and mutual authentication The terminal device and the cloud service provider side server can perform a real-time authorization process. The basis of the real-time authorization process shown in this embodiment is the oAuth2.0 protocol real-time authorization process. Shown.

Step 715: The first temporary certificate sent by the terminal device to the cloud service provider side server.

The first temporary certificate is used to request access to resources on the cloud service provider side server.

The first temporary certificate shown in this embodiment requests a pre-authorization code (precode) from the target interface that has been called by the terminal device.

The pre-authorization code shown in this embodiment can effectively prevent malicious or fake terminal devices from obtaining authorization from the cloud service provider side server, thereby effectively improving the security of the real-time authorization process.

Step 716: The cloud service provider side server sends a pre-authorization code to the terminal device.

Specifically, after obtaining the first temporary certificate, the cloud service provider side server shown in this embodiment may determine the first temporary certificate stored by the cloud service provider side server and the currently received Whether the first temporary certificate is the same, and if yes, the cloud service provider side server can send the pre-authorization code to the terminal device.

Step 717: The terminal device acquires authentication information submitted by the user.

Specifically, after receiving the pre-authorization code, the terminal device shown in this embodiment may perform a jump to the target website, so that the target website jumps to include the pre-authorization code. The login page of the cloud service provider side server.

Specifically, the login page shown in this embodiment further includes a key identifier.

The login page shown in this embodiment can receive the user name and password input by the user for login for identity authentication.

Specifically, in this embodiment, the authentication information includes the user name and password of the user as an example for example. In a specific application, the authentication information may further include other information for authentication, specifically in the implementation. There is no limit in the example.

In this embodiment, the cloud service provider side server may pre-store a plurality of user names and passwords corresponding to the user names, and the user may use the terminal device to the cloud service provider side server. Entering the authentication information, if the cloud service provider side server determines that the authentication information currently input by the user is stored on the cloud service provider side server, determining that the user passes the Certified.

Step 718: The cloud service provider side server acquires the selected permission.

In this embodiment, when the cloud service provider side server determines, according to the authentication information submitted by the user, that the user has been authenticated, the cloud service provider side server may provide a permission list to the user. .

Specifically, the permission list includes a plurality of permissions to be selected.

The user can select a required authority among the plurality of to-be-selected rights through the permission list.

Specifically, the cloud service provider side server receives the selected operation input by the user through the permission list.

The cloud service provider side server determines that the selected rights are at least one of the plurality of to-be-selected rights selected by the selected operation in the permission list.

For example, if there is a permission to be selected in the permission list to log in to the microblog through QQ, if the user selects the permission to log in to the microblog through QQ in the permission list, the cloud service provider side server is It can be determined that the permission to log in to Weibo through QQ is the selected permission.

Specifically, after the cloud service provider side server obtains the selected permission, the selected permission can be bound to the authentication information of the user, and when the subsequent user logs in through the authentication information, The selected permissions bound to the authentication information can be obtained, thereby avoiding repeated selection by the user.

Step 719: The cloud service provider side server determines the preselected authority.

The pre-selected authority is a permission that the terminal device has selected on the cloud service provider side server.

Specifically, the pre-selected authority shown in this embodiment is a user-defined policy, and the policy is a resource that the terminal device can access on the cloud service provider side server.

As shown in FIG. 8 , the policy includes a privilege and an authorization object, and the privilege includes a privilege, a resource, an authorization interface, an authorization condition, and the like, and the authorization object is a user corresponding to the privilege, that is, the cloud service provided in this embodiment. In the process of determining the pre-selected authority, the cloud service provider side server may implement the configuration of the pre-selected authority by using the authority and the authorization object.

Specifically, the cloud service provider side server may create the policy according to an industry domain or a service domain registered by the terminal device.

Specifically, after the cloud service provider side server creates the policy, the terminal device can execute the resources described in the pre-authorization policy by default.

Step 720: The cloud service provider side server determines a target right corresponding to the terminal device.

Specifically, the cloud service provider side server determines that the intersection of the selected authority and the pre-selected authority is the target authority.

In the embodiment, if the terminal device in the embodiment does not obtain the selected permission through the permission list, the target permission shown in this embodiment is the pre-selected permission.

Specifically, after the terminal device registers, the default authorization policy of the cloud service provider side server is given according to the registered industry domain or service domain. After the user enters the site of the terminal device, the terminal is allowed to use the default pre-selected permission to restrict the access of the terminal device to the resource of the cloud service provider side server by default.

In an embodiment, if the terminal device acquires the selected permission via the permission list, the target permission shown in this embodiment is an intersection of the selected permission and the pre-selected permission.

That is, the target rights are included in the selected rights and the pre-selected rights at the same time.

With the real-time authorization process shown in this embodiment, the user using the terminal device can be granted the target authority by the cloud service provider side server, so that the cloud service provider side server controls the terminal device. Accessing the cloud service provider side server such that the terminal device can only access the target resource on the cloud service provider side server, and the cloud service provider side server is further capable of controlling user access to the The access mode and the timing of the target resource are not limited in this embodiment.

The following describes the target rights in combination with the specific application scenarios as shown in FIG. 11:

As shown in FIG. 11 , the pre-selected permission shown in this embodiment is “cloud host management authority (cloud host restart, application, viewing, etc.)”, that is, the pre-selected permission shown in this embodiment is a cloud service provider side server. The authority delegated to the terminal device by default.

The selected permission shown in FIG. 11 is “developer custom third-party role”, and the cloud service provider side server performs refined rights management on the terminal device by using the selected permission.

According to the application scenario shown in FIG. 11, the terminal device can log in to the public comment network through WeChat under the operation of the user, and the cloud service provider side server can log in to the public comment network through WeChat through the target authority. For example, the time, the number of times, and the like, which are logged into the public commenting network by means of the WeChat, may be limited, which is not limited in this embodiment.

Step 721: The cloud service provider side server sends an authorization code to the terminal device.

Specifically, in this embodiment, in a case that the cloud service provider side server determines the target authority, the cloud service provider side server sends the authorization code stored by the cloud service provider side server. To the terminal device.

Step 722: The terminal device sends the sixth signature information to the cloud service provider side server.

The terminal device may perform encryption calculation on the authorization code and the first temporary certificate to generate the sixth signature information after receiving the authorization code sent by the cloud service provider side server.

Step 723: The cloud service provider side server determines whether the sixth signature information satisfies the fourth condition, and if yes, sends the target access parameter to the terminal device.

Specifically, in a case that the cloud service provider side server receives the sixth signature information, the cloud service provider side server may perform decryption calculation on the sixth signature information to obtain the sixth The authorization code included in the signature information and the first temporary certificate.

The fourth condition is that the authorization code included in the sixth signature information is the same as the authorization code already stored by the cloud service provider side server.

The fourth condition may be that the first temporary certificate included in the sixth signature information is the same as the first temporary certificate that is stored by the cloud service provider side server.

When the cloud service provider side server determines that the sixth signature information satisfies the fourth condition, the cloud service provider side server may send a target access parameter for accessing the target resource. To the terminal device.

The target access parameter includes second token information, a second key identifier, and a second temporary certificate.

Step 724: The cloud service provider side server sends the target access parameter to the terminal device.

In this embodiment, the terminal device may access the target resource on the cloud service provider side server by using the received target access parameter, and the specific access process is as follows:

Step 725: The terminal device sends the seventh signature information to the cloud service provider side server.

The terminal device may perform encryption calculation on the target access parameter to generate the seventh signature information when the terminal device receives the target access parameter.

Step 726: The cloud service provider side server generates eighth signature information.

The cloud service provider side server performs encryption calculation on the target access parameter generated by the cloud service provider side server to generate eighth signature information.

Step 727: The cloud service provider side server determines that the terminal device has the right to access the target resource.

Specifically, if the cloud service provider side server determines that the seventh signature information is the same as the eighth signature information, the cloud service provider side server determines that the terminal device has access to the target resource. Permissions, that is, the terminal device has target permissions.

After the cloud service provider side server determines that the terminal device has the target authority, the terminal device can access the target resource on the cloud service provider side server.

It can be seen that, by using the authorization method shown in this embodiment, the cloud service provider side server can perform refined rights management on the terminal device, so that the cloud service provider side server can be used to the terminal. The device has the capability of open access, and at the same time ensures the security and flexibility of the target device accessing the target resource of the cloud service provider side server, and the signature information is passed between the cloud service provider side server and the terminal device. Data interaction is performed to improve security during data interaction.

The specific structure of the cloud service provider side server provided by the embodiment of the present application is described in detail below with reference to FIG. 9 :

The cloud service provider side server shown in this embodiment is used to perform the authorization method shown in FIG. 9. The specific implementation process is shown in FIG. 9, which is not specifically described in this embodiment.

The cloud service provider side server shown in this embodiment includes:

The first processing unit 901 is configured to perform encryption calculation on the encrypted ticket to generate first signature information, send the first signature information to the terminal device, and receive second signature information sent by the terminal device, where the The second signature information includes the encrypted ticket obtained by the terminal device performing decryption calculation on the first signature information, and performing decryption calculation on the second signature information to obtain the foregoing information included in the second signature information. Encrypting the ticket, performing encryption calculation on the encrypted ticket to generate third signature information, and if it is determined that the third signature information is the same as the second signature information, sending the first temporary certificate to the terminal device .

Before the first processing unit 901 sends the first signature information to the terminal device, the first processing unit is specifically configured to receive request information sent by the terminal device, where the request information includes the terminal The first token information that has been stored by the device, the first key identifier, the first token information, and the random reply information generated by the cloud service provider side server are encrypted and calculated to generate fourth signature information, and Sending, to the terminal device, the fourth signature information, so that the first token information included in the fourth signature information and the first stored by the terminal device are determined by the terminal device If the token information is the same, the terminal device sends the fifth signature information to the cloud service provider side server, and the fifth signature information includes the random reply information, and the fifth signature information is decrypted. Calculating to obtain the random reply information included in the fifth signature information, and determining the random reply information included in the fifth signature information and the cloud service Case provider side server generated random reply the same information, the terminal device triggers execution of the step of sending the first information to the signature.

The receiving unit 902 is configured to receive a first temporary certificate sent by the terminal device, where the first temporary certificate is used to request access to a resource on the cloud service provider side server;

a determining unit 903, configured to determine, according to the first temporary certificate, a target right corresponding to the terminal device, where the target right is a right to access a target resource on the cloud service provider side server;

The determining unit 903 is configured to generate a permission list according to the first temporary certificate, where the permission list includes a plurality of to-be-selected rights, and the selected operation input by the user is received through the permission list, and the selected permission is determined. Determining, by the selected authority, at least one of the plurality of to-be-selected rights selected by the selected operation in the permission list, the pre-selected authority being the terminal device And the selected permission on the cloud service provider side server determines that the intersection of the selected authority and the preselected authority is the target authority.

The sending unit 904 is configured to send the second temporary certificate corresponding to the target authority to the terminal device, so that the terminal device accesses the target resource by using the second temporary certificate.

The sending unit 904 is configured to send the authorization code that has been stored by the cloud service provider side server to the terminal device, and receive the sixth device to send the sixth signature information, where the sixth signature information is The terminal device performs encryption calculation on the authorization code and the first temporary certificate to generate signature information, and if the authorization code included in the sixth signature information is determined, and the cloud service provider side server has stored And the target access parameter used to access the target resource is sent to the terminal device, where the target access parameter includes second token information, a second key identifier, and the second temporary certificate. .

The second processing unit 905 is configured to receive seventh signature information that is sent by the terminal device to access the target resource, where the seventh signature information is that the terminal device performs encryption calculation on the target access parameter to generate The signature information, the target access parameter generated by the cloud service provider side server is encrypted and calculated to generate eighth signature information, and if it is determined that the seventh signature information is the same as the eighth signature information, Determining that the terminal device has permission to access the target resource.

The specific structure of the terminal device provided by the embodiment of the present application is described in detail below with reference to FIG. 10:

The cloud service provider side server shown in this embodiment is used to perform the authorization method shown in FIG. 5, and the specific implementation process is shown in FIG. 5, which is not specifically described in this embodiment.

The terminal device shown in this embodiment includes:

The first processing unit 1001 is configured to receive first signature information that is sent by the cloud service provider side server, where the first signature information is signature information that is generated by the cloud service provider side server to perform encryption calculation on the encrypted ticket. Decrypting the first signature information to obtain the encrypted ticket, performing encryption calculation on the encrypted ticket to obtain second signature information, and sending the second signature information to the cloud service provider side server The cloud service provider side server sends the first temporary certificate to the terminal device, where the cloud service provider side server determines that the third signature information and the second signature information are the same. The third signature information includes the encrypted ticket, and the first temporary certificate sent by the cloud service provider side server is received.

In the process of receiving the first signature information sent by the cloud service provider side server, the first processing unit 1001 is specifically configured to send request information to the cloud service provider side server, where the request information includes the The first token information that has been stored by the terminal device, so that the cloud service provider side server sends the fourth signature information to the terminal device, where the fourth signature information includes the first key identifier, the first Receiving, by the token information and the random reply information generated by the cloud service provider side server, the fourth signature information, if the first token information included in the fourth signature information is determined, If the first token information that is stored by the terminal device is the same, the random reply information is encrypted and calculated to generate fifth signature information, and the fifth signature information is sent to the cloud service provider side. a server, configured to determine, at the cloud service provider side server, the random reply information included in the fifth signature information and the cloud service provider side server When the generated random reply information is the same, the first signature information is transmitted to the terminal device.

The sending unit 1002 is configured to send the first temporary certificate to the cloud service provider side server, where the first temporary certificate is used to request access to resources on the cloud service provider side server;

The sending unit 1002 is configured to receive an authorization code that is stored by the cloud service provider side server that is sent by the cloud service provider side server, and perform encryption calculation on the authorization code and the first temporary certificate. Sending, by the generated sixth signature information, the sixth signature information to the cloud service provider side server, so that if the cloud service provider side server determines that the sixth signature information is included And the authorization code is the same as the authorization code stored by the cloud service provider side server, and the target access parameter used to access the target resource is sent to the terminal device, where the target access parameter includes the second token. The information, the second key identifier, and the second temporary certificate receive the target access parameter.

The receiving unit 1003 is configured to receive, by the cloud service provider side server, a second temporary certificate corresponding to the target right.

The access unit 1004 is configured to access the target resource on the cloud service provider side server by using the second temporary certificate.

The second processing unit 1005 is configured to perform encryption calculation on the target access parameter to generate seventh signature information, and send the seventh signature information to the cloud service provider side server, so that if the cloud service is provided The MME determines that the seventh signature information is the same as the eighth signature information, and determines that the terminal device has the right to access the target resource, where the eighth signature information is the cloud service provider side server The target access parameter generated by the cloud service provider side server is encrypted and calculated to generate signature information.

Based on the cloud service provider side server shown in FIG. 3, the cloud service provider side server includes:

One or more of the central processing unit 301, the memory 302, the bus system, and one or more programs, the central processing unit 301 and the memory 302 being connected by the bus system.

Wherein the one or more programs are stored in the memory 302, the one or more programs including instructions that, when executed by the cloud service provider side server, cause the cloud service provider side The server performs the method shown in FIG. 5, FIG. 6, or FIG. 7. The specific execution process is not described in this embodiment.

Based on the terminal device shown in FIG. 4, the terminal device includes one or more processor units 403, a storage unit 404, a bus system, and one or more programs, the processor unit 403 and the storage unit 404. Connected by the bus system;

Wherein the one or more programs are stored in the storage unit 404, the one or more programs including instructions that, when executed by the terminal device, cause the terminal device to perform as shown in FIG. The specific implementation process is not described in this embodiment.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application, in essence or the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above embodiments are only used to explain the technical solutions of the present application, and are not limited thereto; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still The technical solutions described in the embodiments are modified, or the equivalents of the technical features are replaced by the equivalents. The modifications and substitutions of the embodiments do not depart from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

An authorization method, comprising:

Receiving, by the server, a first temporary certificate sent by the terminal device, where the first temporary certificate is used to request access to resources on the server;

Determining, by the server, a target authority corresponding to the terminal device according to the first temporary certificate, where the target authority is a right to access a target resource on the server;

Sending, by the server, the second temporary certificate corresponding to the target authority to the terminal device, so that the terminal device accesses the target resource by using the second temporary certificate.
The authorization method according to claim 1, wherein before the server receives the first temporary certificate sent by the terminal device, the method further includes:

The server performs encryption calculation on the encrypted ticket to generate first signature information;

Sending, by the server, the first signature information to the terminal device;

Receiving, by the server, second signature information that is sent by the terminal device, where the second signature information includes the encrypted ticket that is obtained by the terminal device to perform decryption calculation on the first signature information;

Decrypting the second signature information by the server to obtain the encrypted ticket included in the second signature information;

The server performs encryption calculation on the encrypted ticket to generate third signature information;

And if the server determines that the third signature information is the same as the second signature information, the server sends the first temporary certificate to the terminal device.
The authorization method according to claim 2, wherein before the server sends the first signature information to the terminal device, the method further includes:

Receiving, by the server, request information sent by the terminal device, where the request information includes first token information that is stored by the terminal device;

The server performs encryption calculation on the first key identifier, the first token information, and the random reply information generated by the server to generate fourth signature information;

Sending, by the server, the fourth signature information to the terminal device, so that the terminal device determines, in the terminal device, that the first token information included in the fourth signature information is stored by the terminal device When the first token information is the same, the terminal device sends the fifth signature information to the server, and the fifth signature information includes the random reply information;

Decrypting the fifth signature information by the server to obtain the random reply information included in the fifth signature information;

If the server determines that the random reply information included in the fifth signature information is the same as the random reply information generated by the server, triggering execution by the server to send the first signature information Steps to the terminal device.
The authorization method according to any one of claims 1 to 3, wherein the determining, by the server, the target authority according to the first temporary certificate comprises:

The server generates a permission list according to the first temporary certificate, where the permission list includes a plurality of to-be-selected rights;

Receiving, by the server, the selected operation input by the user through the permission list;

Determining, by the server, that the selected permission is at least one of the plurality of to-be-selected rights selected by the selected operation in the permission list;

The server determines that the intersection of the selected authority and the pre-selected authority is the target authority, and the pre-selected permission is a permission corresponding to the default authorization policy.
The authorization method according to claim 1, wherein the sending, by the server, the second temporary certificate to the terminal device comprises:

Sending, by the server, an authorization code stored by the server to the terminal device;

Receiving, by the server, the sixth device, the sixth signature information, where the sixth signature information is signature information that is generated by the terminal device to perform encryption calculation on the authorization code and the first temporary certificate;

And if the server determines that the authorization code included in the sixth signature information is the same as the authorization code stored by the server, the server sends a target access parameter for accessing the target resource to the The terminal device, the target access parameter includes a second token information, a second key identifier, and the second temporary certificate.
The authorization method according to claim 5, wherein the method further comprises:

The server receives the seventh signature information that is sent by the terminal device to access the target resource, where the seventh signature information is signature information that is generated by the terminal device to perform encryption calculation on the target access parameter.

The server performs encryption calculation on the target access parameter generated by the server to generate eighth signature information;

If the server determines that the seventh signature information is the same as the eighth signature information, the server determines that the terminal device has the right to access the target resource.
An authorization method, comprising:

The terminal device sends the first temporary certificate to the server, where the first temporary certificate is used to request access to resources on the server, so that the server determines the target authority corresponding to the terminal device according to the first temporary certificate, The target authority is a right to access a target resource on the server;

Receiving, by the terminal device, a second temporary certificate corresponding to the target authority sent by the server, where the second temporary certificate is used to indicate a target authority, where the target authority is used to indicate that the target resource on the server is accessed Permission

The terminal device accesses the target resource by using the second temporary certificate.
The authorization method according to claim 7, wherein the method further includes: before the terminal device sends the first temporary certificate to the server, the method further includes:

Receiving, by the terminal device, first signature information sent by the server, where the first signature information is signature information generated by the server to perform encryption calculation on the encrypted ticket;

Determining, by the terminal device, the first signature information to obtain the encrypted ticket;

The terminal device performs encryption calculation on the encrypted ticket to obtain second signature information;

Sending, by the terminal device, the second signature information to the server, so that the server sends the first temporary certificate, if the server determines that the third signature information and the second signature information are the same Giving the terminal device, the third signature information includes the encrypted ticket;

The terminal device receives the first temporary certificate sent by the server.
The authorization method according to claim 8, wherein before the receiving, by the terminal device, the first signature information sent by the server, the method further comprises:

The terminal device sends request information to the server, where the request information includes first token information that has been stored by the terminal device, so that the server sends fourth signature information to the terminal device, where the The fourth signature information includes a first key identifier, the first token information, and random reply information generated by the server;

Receiving, by the terminal device, the fourth signature information;

If the terminal device determines that the first token information included in the fourth signature information is the same as the first token information that is stored by the terminal device, the terminal device The random reply information is subjected to encryption calculation to generate fifth signature information;

Transmitting, by the terminal device, the fifth signature information to the server, to determine, at the server, the random reply information included in the fifth signature information and the random reply generated by the server When the information is the same, the first signature information is sent to the terminal device.
The authorization method according to claim 7, wherein the receiving, by the terminal device, the second temporary certificate sent by the server comprises:

Receiving, by the terminal device, an authorization code that is stored by the server and stored by the server;

And the sixth signature information generated by the terminal device to perform encryption calculation on the authorization code and the first temporary certificate;

Transmitting, by the terminal device, the sixth signature information to the server, so that if the server determines that the authorization code included in the sixth signature information is the same as the authorization code stored by the server Transmitting, to the terminal device, the target access parameter used to access the target resource, where the target access parameter includes a second token information, a second key identifier, and the second temporary certificate;

The terminal device receives the target access parameter.
The authorization method according to claim 10, wherein the method further comprises:

The terminal device performs encryption calculation on the target access parameter to generate seventh signature information;

Sending, by the terminal device, the seventh signature information to the server, so that if the server determines that the seventh signature information is the same as the eighth signature information, determining that the terminal device has access to the target resource The target authority, the eighth signature information is signature information generated by the server to perform encryption calculation on the target access parameter generated by the server.
A server, comprising:

a receiving unit, configured to receive a first temporary certificate sent by the terminal device, where the first temporary certificate is used to request access to resources on the server;

a determining unit, configured to determine, according to the first temporary certificate, a target right corresponding to the terminal device, where the target right is a right to access a target resource on the server;

And a sending unit, configured to send the second temporary certificate corresponding to the target authority to the terminal device, so that the terminal device accesses the target resource by using the second temporary certificate.
A terminal device, comprising:

a sending unit, configured to send the first temporary certificate to the server, where the first temporary certificate is used to request access to resources on the server, so that the server determines, according to the first temporary certificate, the terminal device a target authority, the target authority being a right to access a target resource on the server;

a receiving unit, configured to receive a second temporary certificate corresponding to the target authority sent by the server;

And an access unit, configured to access the target resource by using the second temporary certificate.
A server, comprising:

One or more central processors, memories, bus systems, and one or more programs, the central processor and the memory being coupled by the bus system;

Wherein the one or more programs are stored in the memory, the one or more programs comprising instructions that, when executed by the server, cause the server to perform any of claims 1 to 6 The authorization method described.
A terminal device, comprising:

One or more processor units, memory units, bus systems, and one or more programs, the processor units and the memory units being coupled by the bus system;

Wherein the one or more programs are stored in the storage unit, the one or more programs comprising instructions that, when executed by the terminal device, cause the terminal device to perform as claimed in claims 7 to 11 The authorization method described in any one of the above.
A computer storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 1 to 6.
A computer storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 7 to 11.