WO2021184755A1 - 应用访问方法、装置、电子设备以及存储介质 - Google Patents

应用访问方法、装置、电子设备以及存储介质 Download PDF

Info

Publication number
WO2021184755A1
WO2021184755A1 PCT/CN2020/123068 CN2020123068W WO2021184755A1 WO 2021184755 A1 WO2021184755 A1 WO 2021184755A1 CN 2020123068 W CN2020123068 W CN 2020123068W WO 2021184755 A1 WO2021184755 A1 WO 2021184755A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
accessed
key information
authorization
detection result
Prior art date
Application number
PCT/CN2020/123068
Other languages
English (en)
French (fr)
Inventor
刘嘉俊
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Priority to EP20925036.4A priority Critical patent/EP4024809A4/en
Publication of WO2021184755A1 publication Critical patent/WO2021184755A1/zh
Priority to US17/698,774 priority patent/US20220207164A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/33—User authentication using certificates
    • G06F21/335—User authentication using certificates for accessing specific resources, e.g. using Kerberos tickets
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/42—Anonymization, e.g. involving pseudonyms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol

Definitions

  • This application relates to the field of computer technology, in particular to an application access method, device, electronic equipment, and storage medium.
  • third-party applications can be maliciously pulled by implanting viruses when they are not authorized to access.
  • the user's data can be used to access third-party applications in the application, which reduces the security of application access.
  • an application access method, device, electronic device, and storage medium are provided.
  • An application access method executed by an electronic device, the method including:
  • the application to be accessed is accessed based on the detection result and the second key information.
  • An application access device including:
  • An obtaining module configured to obtain an application access request, where the application access request carries a user identification and an application identification;
  • the collection module is configured to collect an encryption key, and encrypt the user identification by the encryption key to obtain an encrypted user identification, and the encryption key carries first key information and second key information;
  • a generating module configured to generate an authorization credential corresponding to the application access request according to the encrypted user ID and the first key information
  • a sending module configured to send the authorization credential to the application to be accessed corresponding to the application identifier, so that the application to be accessed generates an authorization request based on the authorization credential;
  • the receiving module is used to receive the authorization request returned by the application to be accessed.
  • the access module is configured to access the application to be accessed based on the detection result and the second key information when the detection result of the authorization request meets a preset condition.
  • a non-volatile storage medium storing computer-readable instructions.
  • the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the application access method.
  • a computer device includes a memory and a processor.
  • the memory stores computer readable instructions.
  • the processor executes the steps of the application access method.
  • FIG. 1a is a schematic diagram of a scenario of an application access method provided by an embodiment of the present application
  • FIG. 1b is a schematic flowchart of an application access method provided by an embodiment of the present application.
  • Figure 1c is a schematic diagram of the Oauth protocol architecture
  • Figure 1d is the interaction flow chart of the Oauth protocol
  • FIG. 2a is another schematic flowchart of an application access method provided by an embodiment of the present application.
  • FIG. 2b is a schematic diagram of another scenario of the application access method provided by an embodiment of the present application.
  • FIG. 2c is a schematic diagram of accessing a third-party application by the application access method provided by an embodiment of the present application
  • Figure 3a is a schematic structural diagram of an application access device provided by an embodiment of the present application.
  • FIG. 3b is another schematic structural diagram of the application access device provided by an embodiment of the present application.
  • FIG. 3c is another schematic diagram of the structure of the application access device provided by the embodiment of the present application.
  • Fig. 4 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the embodiments of the present application provide an application access system, where the application access system may include a terminal and a server, and the application access device may be specifically integrated in the server.
  • the server may be an independent physical server or may be composed of multiple physical servers. Server clusters or distributed systems can also provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and labor Cloud servers for basic cloud computing services such as smart platforms.
  • the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, etc., but it is not limited to this.
  • the terminal and the server can be directly or indirectly connected through wired or wireless communication, which is not limited in this application.
  • the application access device is integrated on the server.
  • the user can open the instant messaging application A. If the user wants to access a third-party application through the application A, such as accessing the applet B, the server can obtain the user’s specific application
  • the application access request of program A the application access request carries the user identification and the application to be accessed (small program B). Then, the server may collect the encryption key, and encrypt the user identification with the encryption key to obtain the encrypted user identification.
  • the encryption key carries the first key information and the second key information.
  • the server can generate an authorization certificate corresponding to the application access request according to the encrypted user ID and the first key information, and then, the server sends the authorization certificate to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate.
  • the authorization request returned by the application to be accessed is received, and the authorization request is detected.
  • the server accesses the application to be accessed based on the detection result and the second key information.
  • the first key information is used as part of the authorization certificate and sent to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate, and then receives the authorization returned by the application to be accessed Request, and detect the authorization request.
  • the detection result meets the preset conditions
  • the application to be accessed is accessed based on the detection result and the second key information, that is, it is necessary to determine whether to perform access to the third-party application according to the detection result
  • the first key information and the second key information are required to decrypt the encrypted user ID. If the third-party application is maliciously attacked by criminals, the criminals can only steal the first secret. The key information cannot decrypt the encrypted identity to steal the user's personal information. Therefore, this solution can improve the security of application access.
  • An application access method includes: obtaining an application access request, collecting an encryption key, and encrypting a user identification with the encryption key to obtain an encrypted user identification, generating and applying access based on the encrypted user identification and first key information Request the corresponding authorization certificate, send the authorization certificate to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate, receives the authorization request returned by the application to be accessed, and when the detection result of the authorization request meets the preset conditions, The application to be accessed is accessed based on the detection result and the second key information.
  • FIG. 1b is a schematic flowchart of an application access method provided by an embodiment of the application.
  • the method is mainly applied to electronic equipment as an example.
  • the electronic device may specifically be a server.
  • the specific process of the application access method can be as follows:
  • the application access request carries the user identification and the application identification.
  • the application corresponding to the application identifier is the application to be accessed, and the application access request may be triggered by the user. For example, if the user clicks on a link, the link can start the application to be accessed, and the user identification can include the user's account and avatar.
  • the electronic device may encrypt the user identification.
  • the encryption key carries first key information and second key information.
  • the application to be accessed can be accessed based on the Open Authorization (OAuth) protocol.
  • OAuth Open Authorization
  • I will introduce the OAuth protocol.
  • the OAuth protocol provides a safe, open and simple standard for the authorization of user resources.
  • the difference from previous authorization methods is that OAuth authorization does not allow third-party applications (applications to be accessed) to touch the user’s account information (such as user name and password), that is, third-party applications do not need to use the user’s user name and password. You can apply for authorization of the user’s resources.
  • the structure of the OAuth protocol is shown in Figure 1c.
  • the resource owner refers to the user.
  • the authorization server is the server that the service provider uses to process authorization.
  • the service provider stores the resources generated by the user. server. It and the authentication server can be the same server or different servers.
  • the third-party application obtains the access token from the authorization server according to the permission granting method.
  • the access token obtains the protected resource (such as the user name of the user) corresponding to the authorization request from the resource server. Further, please refer to Figure 1d.
  • the third-party application applies to the server for access to user resources, and the authorization server returns the authorization address to the third-party application.
  • the third-party application When the third-party application receives the authorization returned by the server Code, the application ID and authorization code of the third-party application are sent to the server so that the server can verify the authorization code and return the authorization code to the third-party application. Subsequently, the third-party application accesses user information based on the access token. After the card is successfully signed, the third-party application receives the resources authorized by the user through the external interface. Specifically, in order to ensure the security of the user data, an encryption key can be used to encrypt the user identification. It should be noted that the first key information and the second encryption information are not the same, and the encryption key can be calculated based on the encryption algorithm, the first key information, and the second encryption information.
  • the step of "collecting the encryption key” it may specifically include:
  • the electronic device can obtain the encryption algorithm and 10 different key information from the local database, and then randomly select two key information from the 10 different key information to obtain the first key information and the second key information. Information, and finally, an encryption key for encryption is calculated based on the encryption algorithm, the first key information, and the second key information.
  • the electronic device may generate authorization information for accessing the application to be accessed based on the encrypted key, and then generate the authorization credential corresponding to the application access request through the authorization information and the first key information.
  • the step of "generating an authorization credential corresponding to the application access request according to the encrypted user ID and the first key information" may specifically include:
  • the electronic device can add the first encrypted information to the authorization information to obtain the authorization credential corresponding to the application access request, that is, even if the application to be accessed is maliciously attacked by criminals, the criminals can only steal Up to the first key information, the encrypted identity cannot be decrypted to steal the user's personal information. Therefore, this solution can improve the security of application access.
  • the electronic device may send the authorization credential to the application to be accessed based on the transmission protocol, so that the application to be accessed generates an authorization request based on the authorization credential.
  • the transmission protocol may include the socket transmission protocol, the world wide web transmission protocol and the hypertext transmission protocol, depending on the actual situation. It should be noted that in the process of sending the authorization certificate to the application to be accessed, the authorization certificate carries the first key information.
  • the electronic device retains the second key information in a local database, where the local database can be It is an encrypted local database, that is to say, even if criminals obtain the first key information illegally, they cannot decrypt the encrypted user ID, and the second key information is stored in the encrypted local database. Further improve the security of user privacy, thereby improving the security of application access.
  • the electronic device can detect the authorization request.
  • the electronic device can obtain the first key information from the application to be accessed, and then, based on the detection result, the first key information And the second key information to access the application to be accessed.
  • the step "when the detection result meets the preset condition, access the application to be accessed based on the detection result and the second key information" may specifically include:
  • the electronic device may detect the type of the application to be accessed based on the authorization request.
  • the type of the application to be accessed is the authorized application type, it is determined that the detection result meets the preset condition, and then, based on the detection result and the second key The information is accessed by the application to be accessed.
  • the step "when the detection result meets the preset condition, access the application to be accessed based on the detection result and the second key information" includes:
  • the electronic device when the electronic device obtains the application identifier of the application to be accessed, it can query the local database whether the application identifier has corresponding authentication information, and when the application identifier has corresponding authentication information queried in the local database, it is determined that the application identifier has corresponding authentication information.
  • the application to be accessed is an authorized application, that is, the detection result meets the preset condition.
  • the first key information can be obtained from the application to be accessed, and the application to be accessed can be accessed based on the second key information and the detection result.
  • the step of "accessing the application to be accessed based on the detection result, the first key information, and the second key information" includes:
  • the encryption key can be calculated from the first key information and the second key information. It is understandable that this application uses a symmetric encryption method.
  • the data sender writes the plaintext (User ID) and the encryption key are processed together with a special encryption algorithm to turn it into a complex encrypted cipher text (user ID after encryption) and send it out.
  • the recipient third-party application
  • receives the ciphertext if it wants to interpret the original text, it needs to decrypt the ciphertext with the used encryption key and the inverse algorithm of the same algorithm to restore it to a readable plaintext.
  • the symmetric encryption algorithm there is only one key used. Both sender and receiver use this key to encrypt and decrypt data.
  • the decrypting party must know the encryption key in advance.
  • the user identification is After encryption, the encrypted user identification and the first key information in the encryption process are sent to the application to be accessed. That is, part of the key information of the encryption key is sent to the application to be accessed. If the application to be accessed is maliciously attacked by a criminal, the criminal can only steal the first key information, and cannot decrypt the encrypted identity to steal it. The user's personal information, therefore, the program can improve the security of application access.
  • the electronic device may extract the encrypted user ID and authorization credentials from the detection result, and then decrypt the encrypted user ID according to the encryption key. Specifically, the electronic device may use the encryption key and the inverse algorithm of the algorithm used during encryption to decrypt the encrypted user ID, and finally, access the application to be accessed based on the decryption result and authorization credentials.
  • the step of "accessing the application to be accessed according to the encryption key and the detection result" may specifically include:
  • the decryption result can be a user ID
  • the resource node of the authorized data is determined based on the user ID and authorization credentials, such as the resource node of avatar data, the resource node of nickname data, and/or the resource node of mobile phone number data.
  • the resource node is based on
  • the authentication algorithm verifies the authorization credential, and verifies whether the requested access content matches the authorization information in the authorization credential, and if the access content matches the authorization information in the authorization credential, the application to be accessed is accessed.
  • the type of the application to be accessed is detected based on the authorization request.
  • the type of the application to be accessed is not an authorized application type, it is determined that the detection result does not meet the preset condition. At this time, the application to be accessed is not accessed.
  • the application access method provided in this application may further include: when the detection result does not meet the preset condition, not accessing the application to be accessed.
  • the encryption key is collected, and the user identification is encrypted by the encryption key to obtain the encrypted user identification, and the encryption key is carried There are first key information and second key information, and then, according to the encrypted user ID and the first key information, an authorization certificate corresponding to the application access request is generated, and then the authorization certificate is sent to the application to be accessed for waiting
  • the access application generates an authorization request based on the authorization credential, receives the authorization request returned by the application to be accessed, and finally detects the authorization request. When the detection result meets the preset condition, the application to be accessed is accessed based on the detection result and the second key information.
  • the first key information is used as part of the authorization certificate and sent to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate, and then receives the return from the application to be accessed Authorization request, and the authorization request is detected.
  • the detection result meets the preset conditions
  • the application to be accessed is accessed based on the detection result and the second key information, that is, it is necessary to determine whether to execute the third-party application based on the detection result.
  • the first key information and the second key information are required to decrypt the encrypted user ID. If the third-party application is maliciously attacked by criminals, the criminals can only steal the first The key information cannot decrypt the encrypted identity to steal the user's personal information. Therefore, this solution can improve the security of application access.
  • the application access device is specifically integrated in the server as an example for description.
  • the server obtains an application access request.
  • the application access request carries the user identification and the application identification.
  • the application access request may be triggered by the user. For example, a page of application A is displayed on the display screen of the terminal. ), when the user clicks on the control key, the server can obtain the application access request triggered by the user.
  • the server collects the encryption key, and encrypts the user identification by using the encryption key to obtain the encrypted user identification.
  • the encryption key carries first key information and second key information.
  • the server may use the encryption key to encrypt the user identification, and then execute step 203.
  • the server generates an authorization credential corresponding to the application access request according to the encrypted user ID and the first key information.
  • the server generates authorization information for accessing the application to be accessed based on the encrypted key, and then generates the authorization credential corresponding to the application access request through the authorization information and the first key information.
  • the server can add the first encrypted information to the authorization information to obtain the authorization credential corresponding to the application access request. That is to say, even if the application to be accessed is maliciously attacked by criminals, the criminals can only steal The first key information cannot decrypt the encrypted identity to steal the user’s personal information. Therefore, this solution can improve the security of application access, and the first key information can also be used as an access parameter as a parameter to call the corresponding Application program interface.
  • the server sends the authorization credential to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization credential.
  • the server receives the authorization request returned by the application to be accessed.
  • the server detects the authorization request, and when the detection result meets the preset condition, accesses the application to be accessed based on the detection result and the second key information.
  • the server may detect the type of the application to be accessed based on the authorization request.
  • the type of the application to be accessed is an authorized application type, it is determined that the detection result meets the preset condition, and then the server extracts the encrypted user from the detection result Identification and authorization credentials, and then the server decrypts the encrypted user identification according to the encryption key.
  • the server may use the encryption key and the inverse algorithm of the algorithm used during encryption to decrypt the encrypted user ID, and finally, access the application to be accessed based on the decryption result and authorization credentials.
  • the server After the server in the embodiment of the application obtains the application access request, where the application access request carries the user identification and the application to be accessed, the server collects the encryption key, and encrypts the user identification through the encryption key to obtain the encrypted user identification. According to the encrypted user ID and the first key information, an authorization certificate corresponding to the application access request is generated. Then, the server sends the authorization certificate to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate. Then, the server receives the authorization certificate. Access the authorization request returned by the application, and finally, the server detects the authorization request, and when the detection result meets the preset condition, the application to be accessed is accessed based on the detection result and the second key information.
  • the first key information is used as part of the authorization certificate and sent to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate, and then receives the return from the application to be accessed Authorization request and detect the authorization request.
  • the detection result meets the preset condition
  • the application to be accessed is accessed based on the detection result and the second key information, that is, it is necessary to determine whether to execute the third-party inspection based on the detection result.
  • Application access, and when accessing third-party applications the first key information and second key information are required to decrypt the encrypted user ID. If the third-party application is maliciously attacked by criminals, the criminals can only steal it The first key information cannot decrypt the encrypted identity to steal the user's personal information. Therefore, this solution can improve the security of application access.
  • FIG. 2b Take a user calling a third-party application through an instant messaging application (hereinafter referred to as application) as an example.
  • application an instant messaging application
  • the application server obtains the application access triggered by the user. Request, the specific process is as follows:
  • the server In the user authorization stage, the server generates the first key information a and the second key information b.
  • the server calculates the first key information a, the second key information b, and the digest algorithm to obtain the encryption key according to the algorithm.
  • the server The user ID is encrypted based on the encryption key, and the authorization credential corresponding to the application access request is generated according to the encrypted user ID and the first key information a.
  • the server sends the authorization certificate to the third-party application, so that the third-party application generates an authorization request based on the authorization certificate.
  • the server sends the first key information a to the third-party application, and the server saves the second key information b locally, this design avoids the security brought about by directly giving the authorization certificate to the third party Hidden dangers, while enhancing storage security. For example, malicious access by internal employees can be avoided.
  • the server needs to verify the application to be accessed. When the verification result indicates that the application to be accessed is an authorized application, the server provides the second key information b based on the first key information a and The second key information b calculates the encryption key, and then the server uses the encryption key and the inverse algorithm of the algorithm used during encryption to decrypt the encrypted user ID.
  • the server accesses the third-party application based on the decryption result and authorization credentials.
  • the authorization certificate and the application ID of the third-party application are transferred with the authorization request, and the server determines the resource node that needs to be accessed according to the authorization certificate and the user ID in the authorization request.
  • the user ID carries the user's avatar data and the user's nickname data, and the server can access the resource nodes of the avatar data and the nickname data according to the user ID. Since the user identification does not carry the user's mobile phone number data, the server cannot access the resource node bound to the mobile phone number data according to the user identification, as shown in Figure 2c.
  • the server performs authentication verification on the authorization request to check whether the currently accessed data is authorized by the user. If unauthorized data access is found, the request is rejected. In other words, it is necessary to determine whether to perform access to third-party applications based on the detection results, and when accessing third-party applications, first key information and second key information are required to decrypt the encrypted user ID.
  • the third-party application is maliciously attacked by criminals. The criminals can only steal the first key information, but cannot decrypt the encrypted identity to steal the user's personal information. Therefore, this solution can improve the security of application access.
  • the embodiment of the present application also provides an application access device based on the above application (referred to as the access device).
  • the access device The meanings of the nouns are the same as in the above application access method, and the specific implementation details can refer to the description in the method embodiment.
  • FIG. 3a is a schematic structural diagram of an application access device provided by an embodiment of the application, where the application access device may include an acquisition module 301, a collection module 302, a generation module 303, a sending module 304, a receiving module 305, and an access module 307.
  • Each module included in the application access device can be implemented in whole or in part by software, hardware, or a combination thereof.
  • the obtaining module 301 is used to obtain an application access request.
  • the application access request carries a user identification and an application identification.
  • the application access request may be triggered by the user. For example, when the user clicks a link, the link can start the application to be accessed.
  • the user identification may include the user's account and avatar.
  • the collection module 302 is configured to collect an encryption key, and encrypt the user identification by the encryption key to obtain the encrypted user identification.
  • the collection module 302 may encrypt the user identification, where the encryption key carries the first key information and the second key information. It should be noted that the first key information and the second encryption information are not the same, and the encryption key can be calculated based on the encryption algorithm, the first key information, and the second encryption information.
  • the access device may further include a construction module 308, and the construction module 308 may be specifically used to: obtain an encryption algorithm and multiple key information, and select two secrets from the multiple key information. Key information, first key information and second key information are obtained, and an encryption key for encryption is constructed based on the encryption algorithm, the first key information, and the second key information.
  • the generating module 303 is configured to encrypt the user ID, and generate an authorization certificate corresponding to the application access request according to the encrypted user ID and the first key information.
  • the generation module 303 may use an encryption key to encrypt the user identification, and then the generation module 303 generates authorization information for accessing the application to be accessed based on the encrypted key. Finally, the generation module 303 passes the authorization information and the second A key information generates an authorization certificate corresponding to the application access request.
  • the generation module 303 may be specifically used to generate authorization information for accessing the application to be accessed based on the encrypted key, and generate authorization credentials corresponding to the application access request based on the authorization information and the first key information.
  • the first encrypted information can be added to the authorization information to obtain the authorization credential corresponding to the application access request. That is to say, even if the application to be accessed is maliciously attacked by criminals, the criminals can only steal the first One key information cannot decrypt the encrypted identity to steal the user's personal information. Therefore, this solution can improve the security of application access.
  • the sending module 304 is configured to send the authorization credential to the application to be accessed corresponding to the application identifier, so that the application to be accessed generates an authorization request based on the authorization credential.
  • the receiving module 305 is configured to receive the authorization request returned by the application to be accessed.
  • the access module 307 is configured to access the application to be accessed based on the detection result and the second key information when the detection result of the detection of the authorization request meets the preset condition.
  • the access device may specifically further include a detection module 306 for detecting the authorization request.
  • the type of the application to be accessed may be detected based on the authorization request.
  • the access module 307 may specifically include: an obtaining unit, configured to obtain the first key information from the application to be accessed when the detection result meets a preset condition; and an access unit, configured to obtain the first key information according to the detection result and The first key information and the second key information are used to access the application to be accessed.
  • the access unit may specifically include: a calculation subunit for calculating an encryption key used to encrypt the user identity based on the first key information and the second key information; and the access subunit, Based on the encryption key and the detection result, the application to be accessed is accessed.
  • the access subunit may be specifically used to: extract the encrypted user ID and authorization credentials from the detection result, decrypt the encrypted user ID according to the encryption key, and access the application to be accessed based on the decryption result and the authorization credentials .
  • the acquiring unit may be specifically configured to: extract the application identification of the application to be accessed from the detection result, verify the application to be accessed based on the application identification, and determine when the verification result indicates that the application to be accessed is an authorized application The detection result meets the preset condition, and the first key information is obtained from the application to be accessed.
  • the access module may also be specifically used to: when the detection result does not meet the preset condition, the application to be accessed is not accessed.
  • the collection module 302 collects the encryption key, and encrypts the user identification with the encryption key to obtain the encrypted User identification, the encryption key carries the first key information and the second key information, the generation module 303 encrypts the user identification, and generates an authorization certificate corresponding to the application access request according to the encrypted user identification and the first key information.
  • the sending module 304 sends the authorization certificate to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate.
  • the receiving module 305 receives the authorization request returned by the application to be accessed.
  • the detection module 306 performs the authorization request
  • the detection and access module 307 when the detection result meets the preset condition, accesses the application to be accessed based on the detection result and the second key information. Since this solution encrypts the user ID, the first key information is used as part of the authorization certificate and sent to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate, and then receives the return from the application to be accessed Authorization request and detect the authorization request.
  • the detection result meets the preset condition
  • the application to be accessed is accessed based on the detection result and the second key information, that is, it is necessary to determine whether to execute the third-party inspection based on the detection result.
  • an embodiment of the present application also provides an electronic device, as shown in FIG. 4, which shows a schematic structural diagram of the electronic device involved in the embodiment of the present application, specifically:
  • the electronic device may include one or more processing core processors 401, one or more computer-readable storage medium memory 402, power supply 403, input unit 404 and other components.
  • processing core processors 401 one or more computer-readable storage medium memory 402, power supply 403, input unit 404 and other components.
  • FIG. 4 does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or a combination of certain components, or different component arrangements. in:
  • the processor 401 is the control center of the electronic device. It uses various interfaces and lines to connect the various parts of the entire electronic device, runs or executes the software programs and/or modules stored in the memory 402, and calls Data, perform various functions of electronic equipment and process data, so as to monitor the electronic equipment as a whole.
  • the processor 401 may include one or more processing cores; preferably, the processor 401 may integrate an application processor and a modem processor, where the application processor mainly processes the operating system, user interface, and application programs, etc. , The modem processor mainly deals with wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 401.
  • the memory 402 may be used to store software programs and modules.
  • the processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402.
  • the memory 402 may mainly include a program storage area and a data storage area.
  • the program storage area may store an operating system, an application program required by at least one function (such as a sound playback function, an image playback function, etc.), etc.; Data created by the use of electronic equipment, etc.
  • the memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage devices.
  • the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.
  • the electronic device also includes a power supply 403 for supplying power to various components.
  • the power supply 403 may be logically connected to the processor 401 through a power management system, so that functions such as charging, discharging, and power consumption management can be managed through the power management system.
  • the power supply 403 may also include any components such as one or more DC or AC power supplies, a recharging system, a power failure detection circuit, a power converter or inverter, and a power status indicator.
  • the electronic device may further include an input unit 404, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.
  • an input unit 404 which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.
  • the electronic device may also include a display unit, etc., which will not be repeated here.
  • the processor 401 in the electronic device loads the executable file corresponding to the process of one or more application programs into the memory 402 according to the following instructions, and the processor 401 runs the executable file stored in the memory 402.
  • the application programs in the memory 402 thus realize various functions, as follows:
  • an authorization certificate corresponding to the application access request is generated and authorized
  • the voucher is sent to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization credential, receives the authorization request returned by the application to be accessed, and detects the authorization request.
  • the detection result meets the preset conditions, it is based on the detection result and the second secret.
  • the key information is used to access the application to be accessed.
  • the encryption key is collected, and the user identification is encrypted by the encryption key to obtain the encrypted user identification.
  • the identification and the first key information generate an authorization certificate corresponding to the application access request, and then send the authorization certificate to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate, and then receives the authorization request returned by the application to be accessed Finally, the authorization request is detected, and when the detection result meets the preset condition, the application to be accessed is accessed based on the detection result and the second key information.
  • the first key information is used as part of the authorization certificate and sent to the application to be accessed, so that the application to be accessed generates an authorization request based on the authorization certificate, and then receives the return from the application to be accessed Authorization request and detect the authorization request.
  • the detection result meets the preset condition
  • the application to be accessed is accessed based on the detection result and the second key information, that is, it is necessary to determine whether to execute the third-party inspection based on the detection result.
  • Application access, and when accessing third-party applications the first key information and second key information are required to decrypt the encrypted user ID. If the third-party application is maliciously attacked by criminals, the criminals can only steal it The first key information cannot decrypt the encrypted identity to steal the user's personal information. Therefore, this solution can improve the security of application access.
  • a computer device including a memory and a processor, and the memory stores a computer program.
  • the processor causes the processor to perform the steps in the foregoing method embodiments.
  • a computer-readable storage medium which stores a computer program, and when the computer program is executed by a processor, the processor causes the processor to execute the steps in the foregoing method embodiments.
  • a computer program product or computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the steps in the foregoing method embodiments.
  • Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory may include random access memory (RAM) or external cache memory.
  • RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Channel (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDRSDRAM double data rate SDRAM
  • ESDRAM enhanced SDRAM
  • SLDRAM synchronous chain Channel
  • memory bus Radbus direct RAM
  • RDRAM direct memory bus dynamic RAM
  • RDRAM memory bus dynamic RAM

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Storage Device Security (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种应用访问方法、装置、电子设备以及存储介质，所述方法包括：获取应用访问请求，应用访问请求携带用户标识以及应用标识，采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识，根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证，将授权凭证发送至应用标识所对应的待访问应用，以便待访问应用基于授权凭证生成授权请求，接收待访问应用返回的授权请求，对授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。

Description

应用访问方法、装置、电子设备以及存储介质
本申请要求于2020年3月18日提交中国专利局，申请号为202010188564.8，申请名称为“应用访问方法、装置、电子设备以及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，具体涉及一种应用访问方法、装置、电子设备以及存储介质。
背景技术
随着互联网技术的发展，越来越多的用户通过使用即时通讯的应用程序与亲朋好友进行聊天等社交活动，用户在使用这些应用程序的过程中，可以在应用程序中访问第三方应用来进行资料查阅、浏览新闻或者购物等操作。
目前，用户通常是通过对第三方应用进行授权，实现在应用程序中访问第三方应用，然而，传统的应用访问方式中，第三方应用在未被授权访问时，可以通过植入病毒恶意拉取用户的数据，实现在应用程序中访问第三方应用，降低了应用访问的安全性。
发明内容
根据本申请提供的各种实施例，提供一种应用访问方法、装置、电子设备以及存储介质。
一种应用访问方法，由电子设备执行，所述方法包括：
获取应用访问请求，所述应用访问请求携带用户标识以及应用标识；
采集加密密钥，并通过所述加密密钥对所述用户标识进行加密，得到加密后用户标识，所述加密密钥携带有第一密钥信息和第二密钥信息；
根据所述加密后用户标识以及所述第一密钥信息，生成与所述应用访问 请求对应的授权凭证；
将所述授权凭证发送至所述应用标识所对应的待访问应用，以便所述待访问应用基于所述授权凭证生成授权请求；
接收所述待访问应用返回的授权请求；及
当对所述授权请求进行检测的检测结果满足预设条件时，基于所述检测结果以及所述第二密钥信息对所述待访问应用进行访问。
一种应用访问装置，包括：
获取模块，用于获取应用访问请求，所述应用访问请求携带用户标识以及应用标识；
采集模块，用于采集加密密钥，并通过所述加密密钥对所述用户标识进行加密，得到加密后用户标识，所述加密密钥携带有第一密钥信息和第二密钥信息；
生成模块，用于根据所述加密后用户标识以及所述第一密钥信息，生成与所述应用访问请求对应的授权凭证；
发送模块，用于将所述授权凭证发送至所述应用标识所对应的待访问应用，以便所述待访问应用基于所述授权凭证生成授权请求；
接收模块，用于接收所述待访问应用返回的授权请求；及
访问模块，用于当对所述授权请求进行检测的检测结果满足预设条件时，基于所述检测结果以及所述第二密钥信息对所述待访问应用进行访问。
一种存储有计算机可读指令的非易失性存储介质，所述计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行应用访问方法的步骤。
一种计算机设备，包括存储器和处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述处理器执行应用访问方法的步骤。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征、目的和优点将从说明书、附图以及权利要求书变得明显。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1a是本申请实施例提供的应用访问方法的场景示意图；
图1b是本申请实施例提供的应用访问方法的流程示意图；
图1c是Oauth协议的架构示意图；
图1d是Oauth协议的交互流程图；
图2a是本申请实施例提供的应用访问方法的另一流程示意图；
图2b是本申请实施例提供的应用访问方法的另一场景示意图；
图2c是本申请实施例提供的应用访问方法对第三方应用进行访问的示意图；
图3a是本申请实施例提供的应用访问装置的结构示意图；
图3b是本申请实施例提供的应用访问装置的另一结构示意图；
图3c是本申请实施例提供的应用访问装置的另一结构示意图；及
图4是本申请实施例提供的电子设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请实施例提供一种应用访问系统，其中，该应用访问系统可以包括终端以及服务器，该应用访问装置具体可以集成在服务器中，服务器可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式系统，还可以是提供云服务、云数据库、云计算、云函数、云存储、网络服 务、云通信、中间件服务、域名服务、安全服务、CDN、以及大数据和人工智能平台等基础云计算服务的云服务器。终端可以是智能手机、平板电脑、笔记本电脑、台式计算机、智能音箱、智能手表等，但并不局限于此。终端以及服务器可以通过有线或无线通信方式进行直接或间接地连接，本申请在此不做限制。
例如，请参阅图1a，该应用访问装置集成在服务器上，用户可以打开即时通信的应用程序A，若用户想通过应用程序A访问第三方应用，如访问小程序B，服务器可以获取用户针对应用程序A的应用访问请求，该应用访问请求携带用户标识以及待访问应用(小程序B)。然后，服务器可以采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识，该加密密钥携带有第一密钥信息和第二密钥信息。接着，服务器可以根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证，再然后，服务器将授权凭证发送至待访问应用，以便待访问应用基于授权凭证生成授权请求，服务器接收待访问应用返回的授权请求，并对授权请求进行检测，当检测结果满足预设条件时，服务器基于检测结果以及第二密钥信息对待访问应用进行访问。
由于本方案在对用户标识进行加密后，将第一密钥信息作为授权凭证的一部分，并发送至待访问应用，以便待访问应用基于授权凭证生成授权请求，然后，接收待访问应用返回的授权请求，并对授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问，也就是说，需要根据检测结果确定是否执行对第三方应用的访问，并且，对第三方应用进行访问时，需要第一密钥信息和第二密钥信息对加密后用户标识进行解密，若第三方应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密从而窃取用户的个人信息，因此，该方案可以提高应用访问的安全性。
以下分别进行详细说明。需说明的是，以下实施例的描述顺序不作为对实施例优先顺序的限定。
一种应用访问方法，包括：获取应用访问请求，采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识，根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证，将授权凭证发送至待访问应用，以便待访问应用基于授权凭证生成授权请求，接收待访问应用返回的授权请求，当对授权请求进行检测的检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。
请参阅图1b，图1b为本申请实施例提供的应用访问方法的流程示意图。本实施例主要以该方法应用于电子设备来举例说明。该电子设备具体可以是服务器。该应用访问方法的具体流程可以如下：
101、获取应用访问请求。
其中，应用访问请求携带用户标识以及应用标识。该应用标识所对应的应用即为待访问应用，该应用访问请求可以是用户触发的。比如，用户点击某个链接，该链接可以启动待访问应用，用户标识可以包括用户的账号以及头像等等。
102、采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识。
为了保证用户数据的安全性，电子设备可以对用户标识进行加密。其中，加密密钥携带有第一密钥信息和第二密钥信息。在本申请实施例中，可以基于开放授权(Open Authorization，OAuth)协议对待访问应用进行访问。在此，介绍一下OAuth协议，OAuth协议为用户资源的授权提供了一个安全的、开放而又简易的标准。与以往的授权方式不同之处是OAuth的授权不会使第三方应用(待访问应用)触及到用户的帐号信息(如用户名与密码)，即第三方应用无需使用用户的用户名与密码就可以申请获得该用户资源的授权，OAuth协议的架构如图1c所示，资源所有者指的是用户，授权服务器是服务提供商专门用来处理授权的服务器，服务提供商存放用户生成的资源的服务器。它与认证服务器，可以是同一台服务器，也可以是不同的服务器，第三方应用在接收到权限授予方式后，根据权限授予方式从授权服务器中获取访问令牌， 随后，第三方应用根据获取到的访问令牌从资源服务器中获取与授权请求对应的受保护资源(如用户的用户名)。进一步的，请参阅图1d，当用户通过即时通讯软件访问第三方应用时，第三方应用向服务器申请访问用户资源，授权服务器返回授权地址至第三方应用，当第三方应用接收到服务器返回的授权码时，将第三方应用的应用标识和授权码发送至服务器，以便服务器验证授权码并返回授权码至第三方应用，随后，第三方应用基于访问令牌访问用户信息，当服务器校验访问令牌成功后，第三方应用通过对外接口接收用户所授权的资源，具体的，为了保证用户数据的安全性，可以采用加密密钥对用户标识进行加密。需要说明的是，第一密钥信息和第二加密信息是不相同的，并且，加密密钥可以基于加密算法、第一密钥信息和第二加密信息计算得到的。
在一些实施例中，步骤“采集加密密钥”之前，具体还可以包括：
(11)获取加密算法以及多个密钥信息；
(12)从多个密钥信息中选择两个密钥信息，得到第一密钥信息和第二密钥信息；及
(13)基于加密算法、第一密钥信息以及第二密钥信息构建用于加密的加密密钥。
比如，电子设备可以从本地数据库中获取加密算法以及10个不同的密钥信息，然后，在10个不同的密钥信息随机选择两个密钥信息，得到第一密钥信息和第二密钥信息，最后，基于加密算法、第一密钥信息以及第二密钥信息计算用于加密的加密密钥。
103、根据加密后用户标识以及第一密钥信息，生成与应用访问请求对应的授权凭证。
例如，具体的，电子设备可以基于加密后密钥生成用于访问待访问应用的授权信息，然后，通过授权信息以及第一密钥信息生成与应用访问请求对应的授权凭证。
在一些实施例中，步骤“根据加密后用户标识以及第一密钥信息生成与 应用访问请求对应的授权凭证”，具体可以包括：
(21)基于加密后密钥生成用于访问待访问应用的授权信息；及
(22)通过授权信息以及第一密钥信息生成与应用访问请求对应的授权凭证。
在本实施例中，电子设备可以将第一加密信息添加至授权信息中，从而得到与应用访问请求对应的授权凭证，也就是说，即便待访问应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密以窃取用户的个人信息，因此，该方案可以提高应用访问的安全性。
104、将授权凭证发送至待访问应用，以便待访问应用基于授权凭证生成授权请求。
其中，电子设备可以基于传输协议将授权凭证发送至待访问应用，以便待访问应用基于授权凭证生成授权请求。传输协议可以包括套接字传输协议、万维网传输协议以及超文本传输协议，具体根据实际情况而定。需要说明的是，将授权凭证发送至待访问应用的过程中，授权凭证携带有第一密钥信息，另外，电子设备将第二密钥信息保留至本地的数据库中，其中，本地的数据库可以是加密后的本地数据库，也就是说，即便不法分子通过非法的途径获取到第一密钥信息也无法对加密后用户标识进行解密，并且，第二密钥信息存放在加密后的本地数据库，进一步提高了用户隐私的安全性，从而提高了应用访问的安全性。
105、接收待访问应用返回的授权请求。
106、当对授权请求进行检测的检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。
例如，具体的，电子设备可以对授权请求进行检测，当检测结果满足预设条件时，电子设备可以从待访问应用中获取第一密钥信息，然后，再基于检测结果、第一密钥信息和第二密钥信息，对待访问应用进行访问。
在一些实施例中，步骤“当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问”，具体可以包括：
(31)当检测结果满足预设条件时，从待访问应用中获取第一密钥信息；及
(32)根据检测结果、第一密钥信息和第二密钥信息，对待访问应用进行访问。
例如，具体的，电子设备可以基于授权请求检测待访问应用的所属类型，当待访问应用的类型为授权应用类型时，则确定检测结果满足预设条件，然后，基于检测结果以及第二密钥信息对待访问应用进行访问。
在一些实施例中，步骤“当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问”，包括：
(41)从检测结果中提取待访问应用的应用标识；
(42)基于应用标识对待访问应用进行校验；及
(43)当校验结果指示待访问应用为授权应用时，则确定检测结果满足预设条件，并从待访问应用中获取第一密钥信息。
例如，具体的，电子设备在获取到待访问应用的应用标识，可以本地数据库中查询该应用标识是否具有对应的认证信息，当本地数据库中查询该应用标识具有对应的认证信息时，则确定该待访问应用为授权应用，即，检测结果满足预设条件，此时，可以从待访问应用中获取第一密钥信息，并基于第二密钥信息以及检测结果对待访问应用进行访问。
在一些实施例中，步骤“根据检测结果、第一密钥信息和第二密钥信息，对待访问应用进行访问”，包括：
(51)根据第一密钥信息和第二密钥信息，计算对用户标识进行加密所采用的加密密钥；及
(52)根据加密密钥以及检测结果对待访问应用进行访问。
在本申请中加密密钥可以通过第一密钥信息和第二密钥信息计算得到，可以理解的是，本申请采用的是对称加密的手段，在对称加密算法中，数据发信方将明文(用户标识)和加密密钥一起经过特殊加密算法处理后，使其变成复杂的加密密文(加密后用户标识)发送出去。收信方(第三方应用)收 到密文后，若想解读原文，则需要使用加密用过的密钥及相同算法的逆算法对密文进行解密，才能使其恢复成可读明文。在对称加密算法中，使用的密钥只有一个，发收信双方都使用这个密钥对数据进行加密和解密，这就要求解密方事先必须知道加密密钥，在本申请中，对用户标识进行加密后，将加密后用户标识以及加密过程中的第一密钥信息发送至待访问应用。即，将加密密钥的部分密钥信息发送至待访问应用，若待访问应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密从而窃取用户的个人信息，因此，该方案可以提高应用访问的安全性。
进一步的，电子设备可以从检测结果中提取加密后用户标识以及授权凭证，然后，根据加密密钥对加密后用户标识进行解密。具体的，电子设备可以使用加密密钥以及加密时所采用算法的逆算法对加密后用户标识进行解密，最后，基于解密结果以及授权凭证对待访问应用进行访问。
在一些实施例中，步骤“根据加密密钥以及检测结果对待访问应用进行访问”，具体可以包括：
(61)从检测结果中提取加密后用户标识以及授权凭证；
(62)根据加密密钥对加密后用户标识进行解密；及
(63)基于解密结果以及授权凭证对待访问应用进行访问。
其中，该解密结果可以为用户标识，基于用户标识以及授权凭证确定所授权的数据的资源节点，如头像数据的资源节点、昵称数据的资源节点和/或手机号数据的资源节点，资源节点基于认证算法校验授权凭证，并校验请求的访问内容是否匹配授权凭证中的授权信息，若访问内容匹配授权凭证中的授权信息，则对待访问应用进行访问。
还需要说明的是，基于授权请求检测待访问应用的所属类型，当待访问应用的类型不为授权应用类型时，则确定检测结果不满足预设条件，此时，则不访问待访问应用。
在一些实施例中，本申请提供的应用访问方法还可以包括：当检测结果不满足预设条件时，则不访问待访问应用。
本申请实施例在获取应用访问请求后，其中，应用访问请求携带用户标识以及待访问应用，采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识，加密密钥携带有第一密钥信息和第二密钥信息，然后，根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证，接着，将授权凭证发送至待访问应用中，以便待访问应用基于授权凭证生成授权请求，接收待访问应用返回的授权请求，最后，对授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。由于本方案在对用户标识进行加密后，将第一密钥信息作为授权凭证的一部分，并发送至待访问应用中，以便待访问应用基于授权凭证生成授权请求，然后，接收待访问应用返回的授权请求，并对授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问，也就是说，需要根据检测结果确定是否执行对第三方应用的访问，并且，对第三方应用进行访问时，需要第一密钥信息和第二密钥信息对加密后用户标识进行解密，若第三方应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密从而窃取用户的个人信息，因此，该方案可以提高应用访问的安全性。
根据实施例所述的方法，以下将举例进一步详细说明。
在本实施例中将以该应用访问装置具体集成在服务器中为例进行说明。
请参阅图2a，一种应用访问方法，具体流程可以如下：
201、服务器获取应用访问请求。
其中，应用访问请求携带用户标识以及应用标识，该应用访问请求可以是用户触发的，比如，终端的显示屏上显示有应用A的页面，该页面包括跳转至第三方应用(即待访问应用)的控键，当用户针对该控键进行点击操作时，服务器可以获取到由用户触发的应用访问请求。
202、服务器采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识。
其中，加密密钥携带有第一密钥信息和第二密钥信息。具体的，服务器 可以采用加密密钥对用户标识进行加密，然后，执行步骤203。
203、服务器根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证。
具体的，服务器基于加密后密钥生成用于访问待访问应用的授权信息，然后，通过授权信息以及第一密钥信息生成与应用访问请求对应的授权凭证。
在本实施例中，服务器可以将第一加密信息添加至授权信息中，从而得到与应用访问请求对应的授权凭证，也就是说，即便待访问应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密以窃取用户的个人信息，因此，该方案可以提高应用访问的安全性，并且，第一密钥信息还可以作为访问参数作为参数调用相应的应用程序接口。
204、服务器将授权凭证发送至待访问应用，以便待访问应用基于授权凭证生成授权请求。
205、服务器接收待访问应用返回的授权请求。
206、服务器对授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。
例如，具体的，服务器可以基于授权请求检测待访问应用的所属类型，当待访问应用的类型为授权应用类型时，则确定检测结果满足预设条件，然后，服务器从检测结果中提取加密后用户标识以及授权凭证，然后，服务器根据加密密钥对加密后用户标识进行解密。具体的，服务器可以使用加密密钥以及加密时所采用算法的逆算法对加密后用户标识进行解密，最后，基于解密结果以及授权凭证对待访问应用进行访问。
本申请实施例的服务器在获取应用访问请求后，其中，应用访问请求携带用户标识以及待访问应用，服务器采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识，服务器根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证，然后，服务器将授权凭证发送至待访问应用中，以便待访问应用基于授权凭证生成授权请求，接着，服务器接收待访问应用返回的授权请求，最后，服务器对授权请求进行检测， 当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。由于本方案在对用户标识进行加密后，将第一密钥信息作为授权凭证的一部分，并发送至待访问应用中，以便待访问应用基于授权凭证生成授权请求，然后，接收待访问应用返回的授权请求，并对所述授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问，也就是说，需要根据检测结果确定是否执行对第三方应用的访问，并且，对第三方应用进行访问时，需要第一密钥信息和第二密钥信息对加密后用户标识进行解密，若第三方应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密从而窃取用户的个人信息，因此，该方案可以提高应用访问的安全性。
为了便于对本申请实施例提供的应用访问方法的理解，请参阅图2b，以用户通过即时通信应用程序(以下简称应用程序)调用第三方应用为例，应用程序的服务器获取到用户触发的应用访问请求，具体流程如下：
在用户授权阶段，服务器生成第一密钥信息a和第二密钥信息b，服务器根据算法将第一密钥信息a、第二密钥信息b以及摘要算法计算得到加密密钥，然后，服务器基于加密密钥对用户标识进行加密，并根据加密后用户标识以及第一密钥信息a生成与应用访问请求对应的授权凭证。随后，服务器将授权凭证发送至第三方应用中，以便第三方应用基于授权凭证生成授权请求。在用户授权阶段中，由于服务器将第一密钥信息a发送至第三方应用，并且，服务器将第二密钥信息b保存在本地，该设计避免了授权凭证直接交给第三方带来的安全隐患，同时又增强了存储安全。比如，可以避免内部员工恶意访问。在第三方应用访问用户数据阶段，服务器需要对待访问应用进行校验，当校验结果指示待访问应用为授权应用时，服务器才提供第二密钥信息b，并基于第一密钥信息a和第二密钥信息b计算加密密钥，然后，服务器使用加密密钥以及加密时所采用算法的逆算法对加密后用户标识进行解密。最后，服务器基于解密结果以及授权凭证对第三方应用进行访问。需要说明的是，授权凭证和第三方应用的应用标识随授权请求流转，服务器根据授权请求中的授权 凭证和用户标识确定需要访问的资源节点。比如用户标识携带有用户的头像数据以及用户的昵称数据，服务器可以根据用户标识访问头像数据以及昵称数据的资源节点。由于用户标识中并没有携带用户的手机号数据，因此，服务器不能根据用户标识访问绑定手机号数据的资源节点，如图2c所示。
在访问控制阶段，服务器对授权请求进行认证校验，检查当前访问的数据是否被用户授权，如发现非授权的数据访问，则拒绝该请求。也就是说，需要根据检测结果确定是否执行对第三方应用的访问，并且，对第三方应用进行访问时，需要第一密钥信息和第二密钥信息对加密后用户标识进行解密，若第三方应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密从而窃取用户的个人信息，因此，该方案可以提高应用访问的安全性。
应该理解的是，虽然上述各实施例的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，上述各实施例中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
为便于更好的实施本申请实施例的应用访问方法，本申请实施例还提供一种基于上述应用访问装置(简称访问装置)。其中名词的含义与上述应用访问方法中相同，具体实现细节可以参考方法实施例中的说明。
请参阅图3a，图3a为本申请实施例提供的应用访问装置的结构示意图，其中该应用访问装置可以包括获取模块301、采集模块302、生成模块303、发送模块304、接收模块305以及访问模块307。应用访问装置中包括的各个模块可全部或部分通过软件、硬件或其组合来实现。
获取模块301，用于获取应用访问请求。
其中，应用访问请求携带用户标识以及应用标识，该应用访问请求可以是用户触发的，比如，用户点击某个链接，该链接可以启动待访问应用，用户标识可以包括用户的账号以及头像等等。
采集模块302，用于采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识。
为了保证用户数据的安全性，采集模块302可以对用户标识进行加密，其中，加密密钥携带有第一密钥信息和第二密钥信息。需要说明的是，第一密钥信息和第二加密信息是不相同的，并且，加密密钥可以基于加密算法、第一密钥信息和第二加密信息计算得到的。
在一些实施例中，请参阅图3b，访问装置具体还可以包括构建模块308，构建模块308具体可以用于：获取加密算法以及多个密钥信息，从多个密钥信息中选择两个密钥信息，得到第一密钥信息和第二密钥信息，基于加密算法、第一密钥信息以及第二密钥信息构建用于加密的加密密钥。
生成模块303，用于对用户标识进行加密，并根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证。
例如，具体的，生成模块303可以采用加密密钥对用户标识进行加密，然后，生成模块303基于加密后密钥生成用于访问待访问应用的授权信息，最后，生成模块303通过授权信息以及第一密钥信息生成与应用访问请求对应的授权凭证。
在一些实施例中，生成模块303具体可以用于：基于加密后密钥生成用于访问待访问应用的授权信息，通过授权信息以及第一密钥信息生成与应用访问请求对应的授权凭证。
在本实施例中，可以将第一加密信息添加至授权信息中，从而得到与应用访问请求对应的授权凭证，也就是说，即便待访问应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密以窃取用户的个人信息，因此，该方案可以提高应用访问的安全性。
发送模块304，用于将授权凭证发送至应用标识所对应的待访问应用，以 便待访问应用基于授权凭证生成授权请求。
接收模块305，用于接收待访问应用返回的授权请求。
访问模块307，用于当对授权请求的进行检测的检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。
在一些实施例中，请参阅图3c，访问装置具体还可以包括检测模块306，用于对授权请求进行检测。
例如，具体的，可以基于授权请求检测待访问应用所属的类型。
在一些实施例中，访问模块307具体可以包括：获取单元，用于当检测结果满足预设条件时，从待访问应用中获取第一密钥信息；及访问单元，用于根据检测结果、第一密钥信息和第二密钥信息，对待访问应用进行访问。
在一些实施例中，访问单元具体可以包括：计算子单元，用于根据第一密钥信息和第二密钥信息，计算对用户标识进行加密所采用的加密密钥；及访问子单元，用于根据加密密钥以及检测结果对待访问应用进行访问。
在一些实施例中，访问子单元具体可以用于：从检测结果中提取加密后用户标识以及授权凭证，根据加密密钥对加密后用户标识进行解密，基于解密结果以及授权凭证对待访问应用进行访问。
在一些实施例中，获取单元具体可以用于：从检测结果中提取待访问应用的应用标识，基于应用标识对待访问应用进行校验，当校验结果指示待访问应用为授权应用时，则确定检测结果满足预设条件，并从待访问应用中获取第一密钥信息。
在一些实施例中，访问模块具体还可以用于：当检测结果不满足预设条件时，则不访问待访问应用。
本申请实施例的获取模块301在获取应用访问请求后，其中，应用访问请求携带用户标识以及待访问应用，采集模块302采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识，加密密钥携带有第一密钥信息和第二密钥信息，生成模块303对用户标识进行加密，并根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证，然后，发送模块 304将授权凭证发送至待访问应用中，以便待访问应用基于授权凭证生成授权请求，接着，接收模块305接收待访问应用返回的授权请求，最后，检测模块306对授权请求进行检测，访问模块307当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。由于本方案在对用户标识进行加密后，将第一密钥信息作为授权凭证的一部分，并发送至待访问应用中，以便待访问应用基于授权凭证生成授权请求，然后，接收待访问应用返回的授权请求，并对所述授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问，也就是说，需要根据检测结果确定是否执行对第三方应用的访问，并且，对第三方应用进行访问时，需要第一密钥信息和第二密钥信息对加密后用户标识进行解密，若第三方应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密从而窃取用户的个人信息，因此，该方案可以提高应用访问的安全性。
此外，本申请实施例还提供一种电子设备，如图4所示，其示出了本申请实施例所涉及的电子设备的结构示意图，具体来讲：
该电子设备可以包括一个或者一个以上处理核心的处理器401、一个或一个以上计算机可读存储介质的存储器402、电源403和输入单元404等部件。本领域技术人员可以理解，图4中示出的电子设备结构并不构成对电子设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。其中：
处理器401是该电子设备的控制中心，利用各种接口和线路连接整个电子设备的各个部分，通过运行或执行存储在存储器402内的软件程序和/或模块，以及调用存储在存储器402内的数据，执行电子设备的各种功能和处理数据，从而对电子设备进行整体监控。可选的，处理器401可包括一个或多个处理核心；优选的，处理器401可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器401中。
存储器402可用于存储软件程序以及模块，处理器401通过运行存储在存储器402的软件程序以及模块，从而执行各种功能应用以及数据处理。存储器402可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据电子设备的使用所创建的数据等。此外，存储器402可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。相应地，存储器402还可以包括存储器控制器，以提供处理器401对存储器402的访问。
电子设备还包括给各个部件供电的电源403，优选的，电源403可以通过电源管理系统与处理器401逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。电源403还可以包括一个或一个以上的直流或交流电源、再充电系统、电源故障检测电路、电源转换器或者逆变器、电源状态指示器等任意组件。
该电子设备还可包括输入单元404，该输入单元404可用于接收输入的数字或字符信息，以及产生与用户设置以及功能控制有关的键盘、鼠标、操作杆、光学或者轨迹球信号输入。
尽管未示出，电子设备还可以包括显示单元等，在此不再赘述。具体在本实施例中，电子设备中的处理器401会按照如下的指令，将一个或一个以上的应用程序的进程对应的可执行文件加载到存储器402中，并由处理器401来运行存储在存储器402中的应用程序，从而实现各种功能，如下：
获取应用访问请求，采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识，根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证，将授权凭证发送至待访问应用中，以便待访问应用基于授权凭证生成授权请求，接收待访问应用返回的授权请求，对授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。
以上各个操作的具体实施可参见前面的实施例，在此不再赘述。
本申请实施例在获取应用访问请求后，其中，应用访问请求携带用户标识以及待访问应用，采集加密密钥，并通过加密密钥对用户标识进行加密，得到加密后用户标识，根据加密后用户标识以及第一密钥信息生成与应用访问请求对应的授权凭证，然后，将授权凭证发送至待访问应用中，以便待访问应用基于授权凭证生成授权请求，接着，接收待访问应用返回的授权请求，最后，对授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问。由于本方案在对用户标识进行加密后，将第一密钥信息作为授权凭证的一部分，并发送至待访问应用中，以便待访问应用基于授权凭证生成授权请求，然后，接收待访问应用返回的授权请求，并对所述授权请求进行检测，当检测结果满足预设条件时，基于检测结果以及第二密钥信息对待访问应用进行访问，也就是说，需要根据检测结果确定是否执行对第三方应用的访问，并且，对第三方应用进行访问时，需要第一密钥信息和第二密钥信息对加密后用户标识进行解密，若第三方应用被不法分子恶意攻击，不法分子仅能窃取到第一密钥信息，并不能对加密后身份标识进行解密从而窃取用户的个人信息，因此，该方案可以提高应用访问的安全性。
本领域普通技术人员可以理解，上述实施例的各种方法中的全部或部分步骤可以通过指令来完成，或通过指令控制相关的硬件来完成，该指令可以存储于一计算机可读存储介质中，并由处理器进行加载和执行。
在一个实施例中，提供了一种计算机设备，包括存储器和处理器，存储器存储有计算机程序，计算机程序被处理器执行时，使得处理器执行上述各方法实施例中的步骤。
在一个实施例中，提供了一种计算机可读存储介质，存储有计算机程序，计算机程序被处理器执行时，使得处理器执行上述各方法实施例中的步骤。
在一个实施例中，提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令， 处理器执行该计算机指令，使得该计算机设备执行上述各方法实施例中的步骤。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一非易失性计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对本申请专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (18)

  1. 一种应用访问方法，其特征在于，由电子设备执行，所述方法包括：
    获取应用访问请求，所述应用访问请求携带用户标识以及应用标识；
    采集加密密钥，并通过所述加密密钥对所述用户标识进行加密，得到加密后用户标识，所述加密密钥携带有第一密钥信息和第二密钥信息；
    根据所述加密后用户标识以及所述第一密钥信息，生成与所述应用访问请求对应的授权凭证；
    将所述授权凭证发送至所述应用标识所对应的待访问应用，以便所述待访问应用基于所述授权凭证生成授权请求；
    接收所述待访问应用返回的授权请求；及
    当对所述授权请求进行检测的检测结果满足预设条件时，基于所述检测结果以及所述第二密钥信息对所述待访问应用进行访问。
  2. 根据权利要求1所述的方法，其特征在于，所述当对所述授权请求进行检测的检测结果满足预设条件时，基于所述检测结果以及所述第二密钥信息对所述待访问应用进行访问，包括：
    当对所述授权请求进行检测的检测结果满足预设条件时，从所述待访问应用中获取所述第一密钥信息；及
    根据所述检测结果、所述第一密钥信息和所述第二密钥信息，对所述待访问应用进行访问。
  3. 根据权利要求2所述的方法，其特征在于，所述根据所述检测结果、所述第一密钥信息和所述第二密钥信息，对所述待访问应用进行访问，包括：
    根据所述第一密钥信息和所述第二密钥信息，计算对所述用户标识进行加密所采用的加密密钥；及
    根据所述加密密钥以及所述检测结果对所述待访问应用进行访问。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述加密密钥以及所述检测结果对所述待访问应用进行访问，包括：
    从所述检测结果中提取所述加密后用户标识以及所述授权凭证；
    根据所述加密密钥对所述加密后用户标识进行解密；及
    基于解密结果以及所述授权凭证对所述待访问应用进行访问。
  5. 根据权利要求2所述的方法，其特征在于，所述当对所述授权请求进行检测的检测结果满足预设条件时，从所述待访问应用中获取所述第一密钥信息，包括：
    从所述检测结果中提取所述待访问应用的应用标识；
    基于所述应用标识对所述待访问应用进行校验；及
    当校验结果指示所述待访问应用为授权应用时，则确定所述检测结果满足预设条件，并从所述待访问应用中获取所述第一密钥信息。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述根据所述加密后用户标识以及所述第一密钥信息，生成与所述应用访问请求对应的授权凭证，包括：
    基于所述加密后密钥生成用于访问所述待访问应用的授权信息；及
    通过所述授权信息以及所述第一密钥信息，生成与所述应用访问请求对应的授权凭证。
  7. 根据权利要求1至5任一项所述的方法，其特征在于，所述采集加密密钥之前，所述方法还包括：
    获取加密算法以及多个密钥信息；
    从所述多个密钥信息中选择两个密钥信息，得到第一密钥信息和第二密钥信息；及
    基于所述加密算法、所述第一密钥信息以及所述第二密钥信息，构建用于加密的加密密钥。
  8. 根据权利要求1至5任一项所述的方法，其特征在于，所述方法还包括：
    当对所述授权请求进行检测的检测结果不满足预设条件时，则不访问待访问应用。
  9. 一种应用访问装置，其特征在于，包括：
    获取模块，用于获取应用访问请求，所述应用访问请求携带用户标识以及应用标识；
    采集模块，用于采集加密密钥，并通过所述加密密钥对所述用户标识进行加密，得到加密后用户标识，所述加密密钥携带有第一密钥信息和第二密钥信息；
    生成模块，用于根据所述加密后用户标识以及所述第一密钥信息，生成与所述应用访问请求对应的授权凭证；
    发送模块，用于将所述授权凭证发送至所述应用标识所对应的待访问应用，以便所述待访问应用基于所述授权凭证生成授权请求；
    接收模块，用于接收所述待访问应用返回的授权请求；及
    访问模块，用于当对所述授权请求进行检测的检测结果满足预设条件时，基于所述检测结果以及所述第二密钥信息对所述待访问应用进行访问。
  10. 根据权利要求9所述的装置，其特征在于，所述访问模块包括：
    获取单元，用于当对所述授权请求进行检测的检测结果满足预设条件时，从待访问应用中获取第一密钥信息；及
    访问单元，用于根据所述检测结果、所述第一密钥信息和所述第二密钥信息，对所述待访问应用进行访问。
  11. 根据权利要求10所述的装置，其特征在于，所述访问单元包括：
    计算子单元，用于根据所述第一密钥信息和所述第二密钥信息，计算对所述用户标识进行加密所采用的加密密钥；及
    访问子单元，用于根据所述加密密钥以及所述检测结果对所述待访问应用进行访问。
  12. 根据权利要求11所述的装置，其特征在于，所述访问子单元具体用于从所述检测结果中提取所述加密后用户标识以及所述授权凭证；根据所述加密密钥对所述加密后用户标识进行解密；及基于解密结果以及所述授权凭证对所述待访问应用进行访问。
  13. 根据权利要求10所述的装置，其特征在于，所述获取单元具体用于 从所述检测结果中提取所述待访问应用的应用标识；基于所述应用标识对所述待访问应用进行校验；及当校验结果指示所述待访问应用为授权应用时，则确定所述检测结果满足预设条件，并从所述待访问应用中获取所述第一密钥信息。
  14. 根据权利要求9-13中任一项所述的装置，其特征在于，所述生成模块具体用于基于所述加密后密钥生成用于访问所述待访问应用的授权信息；及通过所述授权信息以及所述第一密钥信息，生成与所述应用访问请求对应的授权凭证。
  15. 根据权利要求9-13中任一项所述的装置，其特征在于，所述装置还包括构建模块，用于获取加密算法以及多个密钥信息；从所述多个密钥信息中选择两个密钥信息，得到第一密钥信息和第二密钥信息；及基于所述加密算法、所述第一密钥信息以及所述第二密钥信息，构建用于加密的加密密钥。
  16. 根据权利要求9-13中任一项所述的装置，其特征在于，所述访问模块还用于当对所述授权请求进行检测的检测结果不满足预设条件时，则不访问待访问应用。
  17. 一种计算机设备，包括存储器和处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述处理器执行如权利要求1至8中任一项所述的方法的步骤。
  18. 一种存储有计算机可读指令的非易失性存储介质，所述计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行如权利要求1至8中任一项所述的方法的步骤。
PCT/CN2020/123068 2020-03-18 2020-10-23 应用访问方法、装置、电子设备以及存储介质 WO2021184755A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20925036.4A EP4024809A4 (en) 2020-03-18 2020-10-23 APPLICATION ACCESS METHOD AND DEVICE, AND ELECTRONIC DEVICE AND STORAGE MEDIA
US17/698,774 US20220207164A1 (en) 2020-03-18 2022-03-18 Method for accessing application and apparatus, electronic device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010188564.8 2020-03-18
CN202010188564.8A CN111064757B (zh) 2020-03-18 2020-03-18 应用访问方法、装置、电子设备以及存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/698,774 Continuation US20220207164A1 (en) 2020-03-18 2022-03-18 Method for accessing application and apparatus, electronic device, and storage medium

Publications (1)

Publication Number Publication Date
WO2021184755A1 true WO2021184755A1 (zh) 2021-09-23

Family

ID=70307946

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/123068 WO2021184755A1 (zh) 2020-03-18 2020-10-23 应用访问方法、装置、电子设备以及存储介质

Country Status (4)

Country Link
US (1) US20220207164A1 (zh)
EP (1) EP4024809A4 (zh)
CN (1) CN111064757B (zh)
WO (1) WO2021184755A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114417287A (zh) * 2022-03-25 2022-04-29 阿里云计算有限公司 数据处理方法、系统、设备及存储介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111064757B (zh) * 2020-03-18 2020-06-19 腾讯科技（深圳）有限公司 应用访问方法、装置、电子设备以及存储介质
CN111625850A (zh) * 2020-05-19 2020-09-04 北京达佳互联信息技术有限公司 访问控制方法、装置、电子设备和存储介质
CN112115464A (zh) * 2020-09-11 2020-12-22 北京小米移动软件有限公司 解锁处理方法、装置、电子设备及存储介质
CN112163009A (zh) * 2020-09-30 2021-01-01 平安普惠企业管理有限公司 用户端数据采集方法、装置、电子设备及存储介质
CN112688857A (zh) * 2020-12-08 2021-04-20 北京北信源软件股份有限公司 一种调用即时通信功能的方法及相关设备
CN112383470B (zh) * 2021-01-15 2021-04-13 中国平安人寿保险股份有限公司 通讯好友添加方法、装置、计算机设备及存储介质
CN112836189B (zh) * 2021-02-26 2023-11-14 深圳证券交易所 第三方应用的访问方法、终端及计算机可读存储介质
CN113132362B (zh) * 2021-03-31 2022-03-22 青岛中瑞汽车服务有限公司 一种可信授权方法、装置、电子设备及存储介质
CN115941279A (zh) * 2022-11-10 2023-04-07 阿里巴巴（中国）有限公司 数据中用户标识的加解密方法、系统及设备

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101350717A (zh) * 2007-07-18 2009-01-21 中国移动通信集团公司 一种通过即时通信软件登录第三方服务器的方法及系统
CN101465735A (zh) * 2008-12-19 2009-06-24 北京大学 网络用户身份验证方法、服务器及客户端
EP2345975A1 (en) * 2010-01-18 2011-07-20 Trinity Mobile Limited Content delivery verification system
CN104901862A (zh) * 2014-03-05 2015-09-09 腾讯科技（深圳）有限公司 一种在定制界面展示第三方应用的应用信息的方法、装置和系统
CN105577691A (zh) * 2016-02-03 2016-05-11 飞天诚信科技股份有限公司 一种安全访问方法和服务器
CN110213195A (zh) * 2018-02-28 2019-09-06 中国移动通信集团内蒙古有限公司 一种登录认证方法、服务器及用户终端
CN111064757A (zh) * 2020-03-18 2020-04-24 腾讯科技（深圳）有限公司 应用访问方法、装置、电子设备以及存储介质

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103179114B (zh) * 2013-03-15 2015-09-23 华中科技大学 一种云存储中的数据细粒度访问控制方法
CN104967597B (zh) * 2014-11-04 2018-05-18 深圳市腾讯计算机系统有限公司 一种基于安全渠道的第三方应用消息鉴权方法及系统
CN106487763B (zh) * 2015-08-31 2020-01-10 腾讯科技（深圳）有限公司 一种基于云计算平台的数据访问方法及用户终端
EP3157272A1 (en) * 2015-10-16 2017-04-19 Gemalto Sa Method of managing an application
WO2018113130A1 (zh) * 2016-12-22 2018-06-28 华为技术有限公司 应用程序授权方法、终端及服务器
US10356088B1 (en) * 2017-01-25 2019-07-16 Salesforce.Com, Inc. User authentication based on multiple asymmetric cryptography key pairs
CN108733991B (zh) * 2017-04-19 2021-04-06 腾讯科技（深圳）有限公司 网页应用访问方法及装置、存储介质
CN110881015B (zh) * 2018-09-05 2021-10-01 程强 用于处理用户信息的系统和方法
CN110636062B (zh) * 2019-09-20 2022-02-08 百度在线网络技术（北京）有限公司 设备的安全交互控制方法、装置、电子设备及存储介质

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101350717A (zh) * 2007-07-18 2009-01-21 中国移动通信集团公司 一种通过即时通信软件登录第三方服务器的方法及系统
CN101465735A (zh) * 2008-12-19 2009-06-24 北京大学 网络用户身份验证方法、服务器及客户端
EP2345975A1 (en) * 2010-01-18 2011-07-20 Trinity Mobile Limited Content delivery verification system
CN104901862A (zh) * 2014-03-05 2015-09-09 腾讯科技（深圳）有限公司 一种在定制界面展示第三方应用的应用信息的方法、装置和系统
CN105577691A (zh) * 2016-02-03 2016-05-11 飞天诚信科技股份有限公司 一种安全访问方法和服务器
CN110213195A (zh) * 2018-02-28 2019-09-06 中国移动通信集团内蒙古有限公司 一种登录认证方法、服务器及用户终端
CN111064757A (zh) * 2020-03-18 2020-04-24 腾讯科技（深圳）有限公司 应用访问方法、装置、电子设备以及存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114417287A (zh) * 2022-03-25 2022-04-29 阿里云计算有限公司 数据处理方法、系统、设备及存储介质

Also Published As

Publication number Publication date
CN111064757B (zh) 2020-06-19
EP4024809A4 (en) 2022-12-07
EP4024809A1 (en) 2022-07-06
CN111064757A (zh) 2020-04-24
US20220207164A1 (en) 2022-06-30

Similar Documents

Publication Publication Date Title
WO2021184755A1 (zh) 应用访问方法、装置、电子设备以及存储介质
US11063944B2 (en) Out-of-band authentication based on secure channel to trusted execution environment on client device
CN111488598B (zh) 访问控制方法、装置、计算机设备和存储介质
US9191394B2 (en) Protecting user credentials from a computing device
US9197420B2 (en) Using information in a digital certificate to authenticate a network of a wireless access point
CN109756337B (zh) 一种服务接口的安全接入方法和装置
CN112333198A (zh) 安全跨域登录方法、系统及服务器
US20160085861A1 (en) Private cloud api
CN108234442B (zh) 获取合约的方法、系统及可读存储介质
CN107918731A (zh) 用于控制对开放接口进行访问的权限的方法和装置
CN110445840B (zh) 一种基于区块链技术的文件存储和读取的方法
US11824850B2 (en) Systems and methods for securing login access
WO2020062667A1 (zh) 数据资产管理方法、数据资产管理装置及计算机可读介质
US8516602B2 (en) Methods, apparatuses, and computer program products for providing distributed access rights management using access rights filters
CN105556893B (zh) 使用口令对移动设备的安全访问
WO2014153982A1 (en) Methods and systems for broadcasting pictures
CN111538973A (zh) 基于国密算法的个人授权访问控制系统
CN113904830B (zh) 一种spa认证的方法、装置、电子设备和可读存储介质
WO2022193494A1 (zh) 权限控制方法及服务器、终端、存储介质和计算机程序
Berrios et al. Factorizing 2fa: Forensic analysis of two-factor authentication applications
CN112565156A (zh) 信息注册方法、装置和系统
CN110619236A (zh) 一种基于文件凭证信息的文件授权访问方法、装置及系统
US20220417020A1 (en) Information processing device, information processing method, and non-transitory computer readable storage medium
WO2022042746A1 (zh) 密钥管理方法及装置
CN113271306B (zh) 数据请求、发送方法、设备以及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20925036

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020925036

Country of ref document: EP

Effective date: 20220330

NENP Non-entry into the national phase

Ref country code: DE