CN102638473B

CN102638473B - User data authorization method, device and system

Info

Publication number: CN102638473B
Application number: CN201210137848.XA
Authority: CN
Inventors: 胡溢洋; 杜江杰; 王奎
Original assignee: SHENGQU INFORMATION TECHNOLOGY (SHANGHAI) Co Ltd
Current assignee: SHENGQU INFORMATION TECHNOLOGY (SHANGHAI) Co Ltd
Priority date: 2012-05-04
Filing date: 2012-05-04
Publication date: 2014-12-10
Anticipated expiration: 2032-05-04
Also published as: CN102638473A

Abstract

The invention discloses a user data authorization method, a user data authorization device and a user data authorization system. The method comprises the steps that an authorization server receives an authorization request transmitted by a third-party application server, wherein the authorization request comprises a server identifier and a server address; an identity authentication request is transmitted to an authentication gateway to authenticate the identity of a client user by the authentication gateway; an identity authentication response which is fed back by the authentication gateway is received, wherein the identity authentication response comprises an user identifier of the authenticated user; user sub-accounts which are matched with the user identifier are searched from the authorization server and are transmitted to a client for the client user to select an authorized sub-account; the authorized sub-account which is fed back by the client is received, and a corresponding relationship among the server identifier, the user identifier and the authorized sub-account is built and saved; and the user identifier, the authorized sub-account and an access token are transmitted to the third-party application server by using the server address. The third-party partial use authorization by the user is realized, the network service quality is improved and the service experience of the user is improved.

Description

A kind of user data authorization method, Apparatus and system

Technical field

The present invention relates to web services technologies field, relate in particular to a kind of user data authorization method, Apparatus and system.

Background technology

Current, network service has comprehensively been applied in people's routine work and life.In the time using network service, the user data that Internet Service Provider preserves according to its inside, for user provides corresponding service.

Taking online game as example, in the time that user enjoys this network service of online game, the user data relating to may comprise: multiple game roles that user basic information (such as address name, age of user, ownership place etc.), user gradation, this user create, the distinctive information of each game role (such as role's grade, the game article of configuration, and other user roles between relation) etc., the above-mentioned user data that Internet Service Provider's game server just can be preserved according to its inside, for user provides game services.

Along with the development of information technology, for the value of the data that farthest excavation Internet Service Provider preserves, each macroreticular service provider releases open platform one after another, and the data opening that itself is stored is gone out, for third party developer.But, because include the higher user data of security requirement in the data that Internet Service Provider opens away, therefore, in the time that third party need to access this part user data, to obtain on the one hand user's use authority, on the other hand also will be by Internet Service Provider's authentication, only have and meet this two aspects requirement simultaneously, the user data that third party's ability access network services provider preserves.

To obtain this requirement of use authority of user for third party, the authorization method being widely adopted at present completes taking user as unit, that is to say, user or third party is carried out to use authority, third party is not carried out to use authority, can not realize user to third-party part use authority.But, generally, under user's a account, tend to include multiple sub-accounts, if only wanting user data corresponding to parton account being had, user carries out use authority to third party, existing technical scheme just cannot meet this demand.

Still taking online game as example, multiple game roles in user data are just equivalent to the multiple sub-account under a user account, if user only wants to the mandate of third party's application server one of them or several game role, in the time adopting the scheme of prior art to carry out use authority, as long as user carries out use authority to third party's application server, what third party's application server obtained so is exactly the use authority of all game roles of user's establishment, this authorization obvious and user is contrary, can not meet user's demand, reduce the service experience of user to online game.

Summary of the invention

Technical problem to be solved by this invention is to provide a kind of user data authorization method, Apparatus and system, to realize the object of the part use authority of user to third party's application server.

For solving the problems of the technologies described above, the embodiment of the present invention provides a kind of user data authorization method, comprising:

Authorization server receives the authorization requests that third party's application server sends, and described authorization requests comprises server identification and server address;

Send ID authentication request to authentication gateway, so that described authentication gateway carries out authentication to client user;

Receive the authentication response that described authentication gateway returns, described authentication response comprises that certification is by user's user ID;

In authorization server, search the sub-account of the user who matches with described user ID, and be sent to client, select to authorize sub-account for client user;

Receive the sub-account of mandate that client is returned, set up and preserve the corresponding relation between the sub-account of described server identification, user ID and mandate;

Utilize described server address by described user ID, the sub-account of described mandate and represent that the access token of access rights is sent to described third party's application server.

Preferably, described authentication gateway carries out authentication to client user, specifically comprises:

Obtain client user's logging status, successfully login if, judges that user passes through user as certification; If unsuccessful login, points out user to carry out username and password checking, and after username and password is verified, judge that user passes through user as certification;

Described certification is converted to user ID by user's user name, and described user ID is added in authentication response and is sent to authorization server.

Preferably, described method also comprises: after the sub-account of mandate of returning in described reception client,

The user data that sub-described mandate account is comprised is sent to client, selects authorized user data for client user; ,

Described foundation is also preserved described corresponding relation and is specifically comprised: after receiving the authorized user data that described client returns, set up and preserve the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data;

The described information of utilizing described server address to send to described third party's application server is specially: user ID, authorize sub-account, authorized user data and access token.

Preferably, described method also comprises: before described foundation preserving the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data,

Judge whether the sub-account of described mandate is contained in the sub-account of described user, and judge whether described authorized user data are contained in described user data, if judged result is are, continue to carry out the step of setting up and preserving described corresponding relation.

Preferably, described utilize described server address by described user ID, authorize sub-account and access token to be sent to described third party's application server, specifically comprise:

Generate authorization code, and utilize described server address by described user ID, authorize sub-account and authorization code to be sent to described third party's application server;

Receive server identification and authorization code that described third party's application server sends, if described server identification conforms to the server identification in described authorization requests, and described authorization code conforms to the authorization code of described generation, described access token is sent to described third party's application server.

Preferably, described method also comprises:

Receive the access request of described third party's application server transmission of open platform gateway forwards, described access request comprises server identification, access token, user ID, four information of sub-account, and the endorsement method of the digital signature of described four information and the described digital signature employing of generation;

Described access request is carried out to legitimacy authentication, if authentication is passed through, allow all customer data that the sub-account in access request comprises described in described third party's application server access;

Wherein, described legitimacy authentication comprises:

Utilize described endorsement method to carry out digital signature to described four information, and with described access request in the digital signature that comprises compare, if identical, judge that described access request is legal;

Judge whether server identification, user ID and sub-account in described access request meets the corresponding relation between the sub-account of described authorization server, user ID and mandate that described authorization server preserves, if meet, judge that authorization server, user ID and the sub-account in described access request is legal;

Judge that whether described access token sends to the access token of third party's application server to conform to described authorization server, if conformed to, judges that described access token is legal.

Preferably, described method also comprises:

Described access request also comprises user data,,

Digital signature in described access request is specially the digital signature of utilizing server identification, access token, user ID, sub-account and five Information generations of user data;

Described legitimacy authentication specifically comprises:

Utilize described endorsement method to carry out digital signature to described five information, and with described access request in the digital signature that comprises compare, if identical, judge that described access request is legal;

Judge whether server identification, user ID, sub-account and user data in described access request meets the corresponding relation between the sub-account of described authorization server, user ID, mandate and the authorized user data that described authorization server preserves, if meet, judge that authorization server, user ID, sub-account and the user data in described access request is legal;

Preferably, described method also comprises:

Described access request also comprises current time stamp; ,

Described legitimacy authentication also comprises:

Judge that described current time stamp is whether in default time of delay section, if so, judge described current time stab legal.

The embodiment of the present invention also provides a kind of user data authorization device, comprising:

Authorization requests receiving element, the authorization requests sending for receiving third party's application server, described authorization requests comprises server identification and server address;

Authentication request transmitting element, for sending ID authentication request to authentication gateway, so that described authentication gateway carries out authentication to client user;

Authentication response receiving element, the authentication response of returning for receiving described authentication gateway, described authentication response comprises that certification is by user's user ID;

Search unit, for search the sub-account of the user who matches with described user ID in authorization server, and be sent to client, select to authorize sub-account for client user;

Corresponding relation is set up unit, and the sub-account of mandate of returning for receiving client, sets up and preserve the corresponding relation between the sub-account of described server identification, user ID and mandate;

Authorization message transmitting element, for utilizing described server address by described user ID, the sub-account of described mandate and representing that the access token of access rights is sent to described third party's application server.

Preferably, described device also comprises:

User data transmitting element, is sent to client for the user data that sub-described mandate account is comprised, and selects authorized user data for client user;

Described corresponding relation is set up unit, for after receiving the authorized user data that described client returns, sets up and preserve the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data;

Described authorization message transmitting element, for utilize described server address by described user ID, authorize sub-account, authorized user data and access token to be sent to described third party's application server.

Preferably, described device also comprises:

Judging unit, be used for judging whether the sub-account of described mandate is contained in the sub-account of described user, and judge whether described authorized user data are contained in described user data, if judged result is are, notify described corresponding relation to set up unit and set up and preserve described corresponding relation.

Preferably, described authorization message transmitting element specifically comprises:

Authorization code generation unit, for generating authorization code;

Communication unit, for utilize described server address by described user ID, authorize sub-account and authorization code to be sent to described third party's application server; And receive server identification and the authorization code that described third party's application server sends;

Comparing unit, whether conform to the server identification of described authorization requests for comparing described server identification, and whether described authorization code conforms to the authorization code of described generation, if all conformed to, described access token is sent to described third party's application server.

Preferably, described device also comprises:

Access request receiving element, the access request sending for receiving described third party's application server of open platform gateway forwards, described access request comprises server identification, access token, user ID, four information of sub-account, and the endorsement method of the digital signature of described four information and the described digital signature employing of generation;

Authenticating unit, for described access request is carried out to legitimacy authentication, if authentication is passed through, allows all customer data that the sub-account in access request comprises described in described third party's application server access;

Wherein, described legitimacy authentication comprises:

The embodiment of the present invention also provides a kind of user data authoring system, and described system comprises: authorization server, third party's application server, authentication gateway, client,

Described authorization server, the authorization requests sending for receiving described third party's application server, and send ID authentication request to authentication gateway, so that described authentication gateway carries out authentication to client user, described authorization requests comprises server identification and server address;

Described authentication gateway, for client user is carried out to authentication, and sends and comprises that certification is by the authentication response of user's user ID to described authorization server;

Described authorization server, also for receiving described authentication response, and searches the sub-account of the user who matches with described user ID, and is sent to client;

Described client, for receiving the sub-account of described user, and therefrom selects to authorize sub-account to be sent to described authorization server;

Described authorization server, the sub-account of mandate of also returning for receiving client, sets up and preserves the corresponding relation between the sub-account of described server identification, user ID and mandate; And utilize described server address by described user ID, the sub-account of described mandate and represent that the access token of access rights is sent to described third party's application server.

Preferably, described authentication gateway specifically comprises:

Logging status acquiring unit, for obtaining client user's logging status, successfully login if, judges that user passes through user as certification; If unsuccessful login, points out user to carry out username and password checking, and after username and password is verified, judge that user passes through user as certification;

Converting unit, for described certification is converted to user ID by user's user name, and adds described user ID in authentication response to and is sent to authorization server.

Preferably, described authorization server, also be sent to client for the user data that sub-described mandate account is comprised, and after receiving the authorized user data that described client returns, set up and preserve the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data; And utilize described server address by described user ID, authorize sub-account, authorized user data and access token to be sent to described third party's application server.

Preferably, described authorization server, also for judging whether the sub-account of described mandate is contained in the sub-account of described user, and judges whether described authorized user data are contained in described user data, to continue to carry out the step of setting up and preserving described corresponding relation if judged result is.

Preferably, described system also comprises open platform gateway;

Described open platform gateway, the access request sending for receiving described third party's application server, and be forwarded to described authorization server, described access request comprises server identification, access token, user ID, four information of sub-account, and the endorsement method of the digital signature of described four information and the described digital signature employing of generation;

Described authorization server, for described access request is carried out to legitimacy authentication, if authentication is passed through, allows all customer data that the sub-account in access request comprises described in described third party's application server access;

Wherein, described legitimacy authentication comprises:

Preferably, in the described access request that described authorization server receives, also comprise user data, and digital signature in described access request is specially the digital signature of utilizing server identification, access token, user ID, sub-account and five Information generations of user data;

, described authorization server carries out legitimacy authentication and specifically comprises:

Preferably, in the described access request that described authorization server receives, also comprise current time stamp;

, described authorization server carries out legitimacy authentication and also comprises:

The user data authorization method of the embodiment of the present invention, Apparatus and system, in authorization server, preserve the multiple sub-account information under a user account, thereby in the time that guiding user carries out use authority to third party's application server, can be by searching the multiple sub-account information matching with user ID, therefrom select parton account as the mode of authorizing sub-account by user, realize the part use authority of user to third party's application server, improve the service quality of network service, improved user's service experience.

Brief description of the drawings

In order to be illustrated more clearly in the embodiment of the present application or technical scheme of the prior art, to the accompanying drawing of required use in embodiment or description of the Prior Art be briefly described below, apparently, the accompanying drawing the following describes is only some embodiment that record in the application, for those of ordinary skill in the art, do not paying under the prerequisite of creative work, can also obtain according to these accompanying drawings other accompanying drawing.

Fig. 1 is the schematic flow sheet of the inventive method embodiment 1;

Fig. 2 is the schematic flow sheet of the inventive method embodiment 2;

Fig. 3 is the schematic flow sheet of the inventive method embodiment 3;

Fig. 4 is the schematic flow sheet of the inventive method embodiment 4;

Fig. 5 is the schematic flow sheet of the inventive method embodiment 5;

Fig. 6 is the schematic flow sheet of the inventive method embodiment 6;

Fig. 7 is the structural representation of apparatus of the present invention embodiment 1;

Fig. 8 is the structural representation of authorization message transmitting element 706 in apparatus of the present invention embodiment 1;

Fig. 9 is the structural representation of apparatus of the present invention embodiment 2;

Figure 10 is the structural representation of apparatus of the present invention embodiment 3;

Figure 11 is the structural representation of apparatus of the present invention embodiment 4;

Figure 12 is the structural representation of system embodiment 1 of the present invention;

Figure 13 is the structural representation of authentication gateway 113 in system embodiment 1 of the present invention;

Figure 14 is the structural representation of system embodiment 2 of the present invention.

Embodiment

In order to make those skilled in the art person understand better the present invention program, below in conjunction with the accompanying drawing in the embodiment of the present invention, technical scheme in the embodiment of the present invention is clearly and completely described, obviously, described embodiment is only the present invention's part embodiment, instead of whole embodiment.Based on the embodiment in the present invention, those of ordinary skill in the art, not making the every other embodiment obtaining under creative work prerequisite, belong to the scope of protection of the invention.

User data authorization method of the present invention, Apparatus and system are intended to realize user to third-party part use authority this purpose, understand for convenient, and paper is applied environment of the present invention once.

Original network service only relates to two sides, the one, as user's user, the one, as the service provider of service provider, user saves the data in service provider's server, and send request to server when needed, provide corresponding network service by service provider for user.For example, user A has created a user account on the game server of game services provider magnificence, and (for example preserve the user data relevant to user A on this game server, the user basic information of filling in when registration, the user data such as the role of the user gradation that produces in game process, game article, establishment), so in the time that user A wants to enjoy this network service of online game, only need with game server between sets up and communicates by letter, game server just can provide game services for user A according to the user data of preservation.

Along with the development of information technology, open platform arises at the historic moment, service provider by the data opening of its preservation to third party (can be company can be also individual), at this new network service mode, user just can enjoy the network service that third party provides by service provider's platform, for example, user A can the stars that provide of playing are provided more be become the network service that game is supplemented with money by the magnificence open platform of playing; Also can equip inquiry service etc. by the magnificence AION role that open platform enjoys Sina microblogging and provide that plays.

For this new network service mode, if user wants to enjoy by open platform the service that third party provides, so just must can obtain its user data as prerequisite from service provider taking third party, otherwise third party just cannot, for user provides service, depend on that user is to third-party use authority and can third party get user data.In prior art, user can only do himself as a wholely, taking user as unit, third party is carried out to use authority, but can not realize part use authority, and the present invention has proposed the user data authorization method that a kind of authorized granularity is little under this demand.

Embodiment mono-

Referring to Fig. 1, show the flow chart of a kind of user data authorization method embodiment 1 of the present invention, can comprise the following steps:

Step 101, authorization server receives the authorization requests that third party's application server sends, and described authorization requests comprises server identification and server address.

If user A has registered a user account on the platform of game services provider, under this user account, create three sub-accounts simultaneously, be respectively game role A ₁, A ₂and A ₃(game role can be presented as game identifier, Game Zone mark, game group mark and the game role mark that each role has), these data have just been stored in game services business's platform so.In addition, if two third party B have been given in game services business's platform opening ₁and B ₂, that is to say third party B ₁and B ₂on platform, completed registration, platform is also preserved B so ₁and B ₂log-on message (for example third-party server identification ID ₁, communication for the information such as key).

If user A wants with sub-account A ₁identity login third party B ₁, enjoy B ₁the network service providing, so B ₁receiving A ₁logging request after, can go open platform to obtain sub-account A ₁corresponding user data, B like this ₁could provide corresponding network service for user A.If user A is to third party B ₁carry out sub-account A ₁use authority, open platform will be to B so ₁access request carry out authentication, and after judgement request is legal, by B ₁the A of request ₁user data return to B ₁, and then by B ₁for user provides services on the Internet.But, if user A is not to B ₁carry out sub-account A ₁use authority or open platform to B ₁authentication do not pass through, open platform will be pointed out third party B so ₁guide user A to carry out sub-account A to it ₁use authority.

The authorization requests that this step authorization server receives the transmission of third party's application server is that third party guides user to carry out the setting up procedure of use authority.Wherein, in authorization requests, comprise server identification ID ₁object be the third party that carries out this authorization requests for authorization server is known be who (in addition, authorization server can also be according to ID ₁judge whether this third party registered at open platform, because the third party who only registered at open platform just has authority request user to carry out use authority to it), the object that comprises server address is in order to complete after use authority user, the third party that authorization server can send to authorization message request to authorize accurately.

It should be noted that, so-called " guiding " is that webpage is redirected, and namely forwards a diverse network request again fixed direction to other position by various methods.Guiding in this step refers to that the page that is shown to user A is from third party B ₁login interface jump to prompting user to B ₁carry out the process at the interface of the mandate website of use authority.

Step 102, sends ID authentication request to authentication gateway, so that described authentication gateway carries out authentication to client user.

Step 103, receives the authentication response that described authentication gateway returns, and described authentication response comprises that certification is by user's user ID.

Authorization server receives after third-party authorization requests, does not directly point out user A to third party B ₁carry out use authority, but to first guide user A to carry out authentication (guiding herein refers to the page that is shown to A from authorizing the interface of website to jump to the interface of authentication) to authentication gateway, this is because if user is not carried out authentication and just cannot be known user's identity information, and then also just cannot know the sub-account information that this user has, cause Authorized operation to be obstructed.

The mode that authentication gateway carries out authentication to user can be presented as:

First, obtain the logging status of user A, successfully login if, judges that user passes through user as certification; If unsuccessful login, points out user A to carry out username and password checking, and after username and password is verified, judge that user passes through user as certification.

Need to illustrate for user's logging status herein, the user who is generally directed to authentication gateway through authorization server is the user of unsuccessful login, but also may (interconnect because of interconnecting between network, refer between different telecommunication networks and set up effectively and connect, make can communicate by letter between the user of heterogeneous networks, or the user of a network can use the service of another network) situation causes user's logging status for successfully login.

Secondly, described certification is converted to user ID by user's user name, and described user ID is added in authentication response and is sent to authorization server.

The user name of successful login user is converted to user ID ID ₂object be the fail safe in order to ensure user data, directly user's privacy information (for example user name) is not revealed to third party.

Step 104 is searched the sub-account of the user who matches with described user ID, and is sent to client in authorization server, selects to authorize sub-account for client user.

Authorization server extracts user ID ID from authentication response ₂, and in this authorization server, search the sub-account of the user who matches with this mark, for example find the sub-account matching with the mark of user A and comprise A ₁, A ₂and A ₃, these three sub-accounts are sent to client, show to user, therefrom select to want to third party B for user ₂the sub-account of authorizing, for example user has selected sub-account A ₁.

Step 105, receives the sub-account of mandate that client is returned, and sets up and preserve the corresponding relation between the sub-account of described server identification, user ID and mandate.

After authorization server is pushed to the whole sub-account of user A user and checks, just wait for the feedback information that receives user, and the sub-account that user is selected licenses to B as this ₁the sub-account of mandate, then set up server identification ID ₁, user ID ID ₂with the sub-account A of mandate ₁between corresponding relation.Like this, which user authorization server has just known has licensed to by which sub-account of its subordinate for which third party, so that in the time that third party sends access request, authorization server can carry out legitimacy authentication to access request.

Step 106, utilizes described server address by described user ID, the sub-account of described mandate and represents that the access token of access rights is sent to described third party's application server.

Authorization server has just been known the authorization conditions between third party, user and sub-account after execution step 105, if and completing user is to third-party use authority, also need to allow third party also know it and obtained the use authority of which sub-account of which user, therefore authorization server also needs according to the server address in step 101 authorization requests user ID, authorizes sub-account and represent that the access token of access rights is sent to third party.So far, just completed user to third-party part use authority process.

According to above-mentioned example, just realize user A to third party B by carrying out step of the present invention ₁authorize sub-account A ₁rights of using (be in fact to third party B ₁authorize its antithetical phrase account A ₁the access rights of corresponding user data) this purpose.

As a kind of implementation of step 106, can be embodied as:

First, generate authorization code, and utilize described server address by described user ID, authorize sub-account and authorization code to be sent to described third party's application server.

Secondly, receive server identification and authorization code that described third party's application server sends, if described server identification conforms to the server identification in described authorization requests, and described authorization code conforms to the authorization code of described generation, described access token is sent to described third party's application server.

Authorization server can be directly by user ID, authorize sub-account and access token to send to third party's application server, but, for the safety and reliability that ensures to communicate by letter between authorization server and third party's application server, authorization server generates one group of random number as authorization code, and by user ID, authorize sub-account and authorization code to send to third party's application server; Third party's application server is receiving after above-mentioned authorization message, and authorization code and the server identification of self are fed back to authorization server, exchanges access token for this.

Embodiment bis-

On the basis of embodiment 1, the present invention also further refinement, to third-party authorized granularity, carries out use authority taking user data corresponding to sub-account as unit to third party.Referring to Fig. 2, show the flow chart of a kind of user data authorization method embodiment 2 of the present invention, can comprise the following steps:

Step 201, authorization server receives the authorization requests that third party's application server sends, and described authorization requests comprises server identification and server address.

Step 202, sends ID authentication request to authentication gateway, so that described authentication gateway carries out authentication to client user.

Step 203, receives the authentication response that described authentication gateway returns, and described authentication response comprises that certification is by user's user ID.

Step 204 is searched the sub-account of the user who matches with described user ID, and is sent to client in authorization server, selects to authorize sub-account for client user.

Step 201 ~ step 204 is identical with step 101 ~ step 104, repeats no more herein.

Step 205, receives the sub-account of mandate that client is returned, and the user data that sub-described mandate account is comprised is sent to client, selects authorized user data for client user.

Different from embodiment 1, the further refinement of the present embodiment to third party authorize granularity, after authorization server receives the sub-account of mandate of user's selection, also further remove to obtain the user data that this sub-account comprises, for example, the pet name of sub-account, grade, head portrait, good friend, dynamic etc., then these user data that sub-account comprised push to client, being shown to user checks, so that user can therefrom select which user data of wanting to authorize to third party sub-account, select its wish by sub-account A by user A ₁which user data license to third party B ₁, for example user has selected A ₁" head portrait " user data.

Step 206, receives the authorized user data that described client is returned, and sets up and preserve the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data.

Through after step 205, what in this step, authorization server was known is exactly which user data of which sub-account of its subordinate has been licensed to which third party by which user, therefore the corresponding relation that, authorization server need to be set up is exactly the corresponding relation between server identification, user ID, the sub-account of mandate and authorized user data.

According to above-mentioned example, that authorization server is now set up and preserved is server identification ID ₁, user ID ID ₂, authorize sub-account A ₁and corresponding relation between authorized user data " head portrait ".

Step 207, utilize described server address by described user ID, authorize sub-account, authorized user data and access token to be sent to described third party's application server.

Embodiment tri-

In order to improve mandate reliability, prevent that user's the act of authorization is maliciously tampered, referring to Fig. 3, show the flow chart of a kind of user data authorization method embodiment 3 of the present invention, can comprise the following steps:

Step 301, authorization server receives the authorization requests that third party's application server sends, and described authorization requests comprises server identification and server address.

Step 302, sends ID authentication request to authentication gateway, so that described authentication gateway carries out authentication to client user.

Step 303, receives the authentication response that described authentication gateway returns, and described authentication response comprises that certification is by user's user ID.

Step 304 is searched the sub-account of the user who matches with described user ID, and is sent to client in authorization server, selects to authorize sub-account for client user.

Step 301 ~ step 304 is identical with step 101 ~ step 104, repeats no more herein.

Step 305, receives the sub-account of mandate that client is returned, and judges whether the sub-account of described mandate is contained in the sub-account of described user.

Step 306, in the time that the sub-account of described mandate is contained in the sub-account of described user, sets up and preserves the corresponding relation between the sub-account of described server identification, user ID and mandate.

Authorization server is before setting up and preserve described corresponding relation, first judge the legitimacy of its sub-account of mandate receiving, judge that whether authorize sub-account is one or more in the multiple sub-account of user underling, if, judge that the sub-account of mandate receiving is legal, and then set up described corresponding relation.If through authorization server judges, (the sub-account of mandate for example, receiving is A in the sub-account of discovery user underling, not have the sub-account of the mandate receiving ₄, user A subordinate's sub-account A ₁, A ₂and A ₃all cannot match), the sub-account of mandate that user selects so may be maliciously tampered, and now judged that the sub-account of mandate receiving is illegal, no longer continued to set up described corresponding relation, simultaneously also can be to user's alarm.

Step 307, utilizes described server address by described user ID, the sub-account of described mandate and represents that the access token of access rights is sent to described third party's application server.

Step 307 is identical with step 106, also repeats no more herein.

Embodiment tetra-

Similarly, in order to improve mandate reliability, prevent that user's the act of authorization is maliciously tampered, referring to Fig. 4, show the flow chart of a kind of user data authorization method embodiment 4 of the present invention, can comprise the following steps:

Step 401, authorization server receives the authorization requests that third party's application server sends, and described authorization requests comprises server identification and server address.

Step 402, sends ID authentication request to authentication gateway, so that described authentication gateway carries out authentication to client user.

Step 403, receives the authentication response that described authentication gateway returns, and described authentication response comprises that certification is by user's user ID.

Step 404 is searched the sub-account of the user who matches with described user ID, and is sent to client in authorization server, selects to authorize sub-account for client user.

Step 405, receives the sub-account of mandate that client is returned, and the user data that sub-described mandate account is comprised is sent to client, selects authorized user data for client user.

Step 401 ~ step 405 is identical with step 201 ~ step 205, repeats no more herein.

It should be noted that, after step 405 receives the sub-account of mandate that client returns, also can utilize the sub-account of user underling to judge the legitimacy of the sub-account of mandate receiving, ensure the mandate reliability of sub-account.

Step 406, receives the authorized user data that described client is returned, and judges whether described authorized user data are contained in described user data.

Step 407, in the time that described authorized user packet is contained in described user data, sets up and preserves the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data.

Authorization server is before setting up and preserve described corresponding relation, first judge the legitimacy of its authorized user data that receive, judge that whether authorized user data are to authorize one or more in multiple user data that sub-account comprises, if, judge that the authorized user data that receive are legal, and then set up described corresponding relation.If through authorization server judges, in the user data of finding to authorize sub-account to comprise, there is not authorized user data (for example, the sub-account A of user A receiving ₁the user data comprising is grade, head portrait, good friend, dynamic, and the authorized user data that authorization server receives are " pet name ", so sub-account A ₁the all customer data comprising all cannot match), the authorized user data that user selects may be maliciously tampered, and now judged that the authorized user data that receive are illegal, no longer continued to set up described corresponding relation, simultaneously also can be to user's alarm.

Process step 406 and step 407 just can ensure the mandate reliability of user data.

Step 408, utilize described server address by described user ID, authorize sub-account, authorized user data and access token to be sent to described third party's application server.

Embodiment five

Referring to Fig. 5, show the flow chart of a kind of user data authorization method embodiment 5 of the present invention, at the embodiment 3 shown in the embodiment 1 shown in Fig. 1 and Fig. 3 by user ID, authorize after sub-account and access token be sent to third party's application server, described method can also comprise the process of the access request of authentication third party application server transmission, is embodied as following steps:

Step 501, receive the access request of described third party's application server transmission of open platform gateway forwards, described access request comprises server identification, access token, user ID, four information of sub-account, and the endorsement method of the digital signature of described four information and the described digital signature employing of generation.

Step 502, carries out legitimacy authentication to described access request, if authentication is passed through, allows all customer data that the sub-account in access request comprises described in described third party's application server access;

Wherein, described legitimacy authentication comprises:

(1) utilize described endorsement method to carry out digital signature to described four information, and with described access request in the digital signature that comprises compare, if identical, judge that described access request is legal;

(2) judge whether server identification, user ID and sub-account in described access request meets the corresponding relation between the sub-account of described authorization server, user ID and mandate that described authorization server preserves, if meet, judge that authorization server, user ID and the sub-account in described access request is legal;

(3) judge that whether described access token sends to the access token of third party's application server to conform to described authorization server, if conformed to, judges that described access token is legal.

If access request, authorization server, user ID, sub-account and access token are all legal, judge that authentication passes through.

Embodiment six

Referring to Fig. 6, show the flow chart of a kind of user data authorization method embodiment 6 of the present invention, at the embodiment 4 shown in the embodiment 2 shown in Fig. 2 and Fig. 4 by user ID, authorize after sub-account, authorized user data and access token be sent to third party's application server, described method can also comprise the process of the access request of authentication third party application server transmission, is embodied as following steps:

Step 601, receive the access request of described third party's application server transmission of open platform gateway forwards, described access request comprises that (user data is the content of this request access of third party for server identification, access token, user ID, sub-account, user data, can be presented as access program interface API Name) five information, and the digital signature of described five information and generate the endorsement method that described digital signature adopts.

Step 602, carries out legitimacy authentication to described access request, if authentication is passed through, allows all customer data that the sub-account in access request comprises described in described third party's application server access;

Wherein, described legitimacy authentication specifically comprises:

(1) utilize described endorsement method to carry out digital signature to described five information, and with described access request in the digital signature that comprises compare, if identical, judge that described access request is legal;

(2) judge whether server identification, user ID, sub-account and user data in described access request meets the corresponding relation between the sub-account of described authorization server, user ID, mandate and the authorized user data that described authorization server preserves, if meet, judge that authorization server, user ID, sub-account and the user data in described access request is legal;

If access request, authorization server, user ID, sub-account, user data and access token are all legal, judge that authentication passes through.

Embodiment seven

In order to prevent Replay Attack, on the basis of the embodiment 6 shown in the embodiment 5 shown in Fig. 5 and Fig. 6, the present invention's access request that also authentication third party application server sends in accordance with the following methods, particularly, also comprises current time stamp in described access request; Described legitimacy authentication also comprises: judge that described current time stamp is whether in default time of delay section, if so, judge described current time stab legal.

If access request, authorization server, user ID, sub-account, user data, access token and current time stamp are all legal, judge that authentication passes through.

Embodiment eight

Referring to Fig. 7, show the structured flowchart of a kind of user data authorization device embodiment 1 of the present invention, described device comprises:

Authorization requests receiving element 701, the authorization requests sending for receiving third party's application server, described authorization requests comprises server identification and server address;

Authentication request transmitting element 702, for sending ID authentication request to authentication gateway, so that described authentication gateway carries out authentication to client user;

Authentication response receiving element 703, the authentication response of returning for receiving described authentication gateway, described authentication response comprises that certification is by user's user ID;

Search unit 704, for search the sub-account of the user who matches with described user ID in authorization server, and be sent to client, select to authorize sub-account for client user;

Corresponding relation is set up unit 705, and the sub-account of mandate of returning for receiving client, sets up and preserve the corresponding relation between the sub-account of described server identification, user ID and mandate;

Authorization message transmitting element 706, for utilizing described server address by described user ID, the sub-account of described mandate and representing that the access token of access rights is sent to described third party's application server.

Further, as shown in Figure 8, described authorization message transmitting element specifically can comprise:

Authorization code generation unit 7061, for generating authorization code;

Communication unit 7062, for utilize described server address by described user ID, authorize sub-account and authorization code to be sent to described third party's application server; And receive server identification and the authorization code that described third party's application server sends;

Comparing unit 7063, whether conform to the server identification of described authorization requests for comparing described server identification, and whether described authorization code conforms to the authorization code of described generation, if all conformed to, described access token is sent to described third party's application server.

Embodiment nine

Referring to Fig. 9, show the structured flowchart of a kind of user data authorization device embodiment 2 of the present invention, described device also comprises:

User data transmitting element 707, is sent to client for the user data that sub-described mandate account is comprised, and selects authorized user data for client user;

Described corresponding relation is set up unit 705, for after receiving the authorized user data that described client returns, sets up and preserve the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data;

Described authorization message transmitting element 706, for utilize described server address by described user ID, authorize sub-account, authorized user data and access token to be sent to described third party's application server.

Embodiment ten

Referring to Figure 10, show the structured flowchart of a kind of user data authorization device embodiment 3 of the present invention, described device also comprises:

Judging unit 708, be used for judging whether the sub-account of described mandate is contained in the sub-account of described user, and judge whether described authorized user data are contained in described user data, if judged result is are, notify described corresponding relation to set up unit and set up and preserve described corresponding relation.

Embodiment 11

Referring to Figure 11, show the structured flowchart of a kind of user data authorization device embodiment 4 of the present invention, described device also comprises:

Access request receiving element 709, the access request sending for receiving described third party's application server of open platform gateway forwards, described access request comprises server identification, access token, user ID, four information of sub-account, and the endorsement method of the digital signature of described four information and the described digital signature employing of generation;

Authenticating unit 710, for described access request is carried out to legitimacy authentication, if authentication is passed through, allows all customer data that the sub-account in access request comprises described in described third party's application server access;

Wherein, described legitimacy authentication comprises:

Embodiment 12

Referring to Figure 12, show the structured flowchart of a kind of user data authoring system embodiment 1 of the present invention, described system comprises: authorization server 111, third party's application server 112, authentication gateway 113, client 114, wherein,

Authorization server, third party's application server, authentication gateway and client in user data authoring system of the present invention cooperatively interacts and just realized the object of user of the present invention to third party's part use authority.Referring to Figure 13, show the structured flowchart of authentication gateway, specifically comprise:

Logging status acquiring unit 1131, for obtaining client user's logging status, successfully login if, judges that user passes through user as certification; If unsuccessful login, points out user to carry out username and password checking, and after username and password is verified, judge that user passes through user as certification;

Converting unit 1132, for described certification is converted to user ID by user's user name, and adds described user ID in authentication response to and is sent to authorization server.

Further, the granularity that the present invention also can refinement user authorizes third party, realizing the user data that comprises taking sub-account authorizes as unit, now, described authorization server, also be sent to client for the user data that sub-described mandate account is comprised, and after receiving the authorized user data that described client returns, set up and preserve the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data; And utilize described server address by described user ID, authorize sub-account, authorized user data and access token to be sent to described third party's application server.

Further, in order to improve mandate reliability, the act of authorization that prevents user is maliciously tampered, described authorization server, also for judging whether the sub-account of described mandate is contained in the sub-account of described user, and judge whether described authorized user data are contained in described user data, if judged result is are, continue to carry out the step of setting up and preserving described corresponding relation.

Embodiment 13

Referring to Figure 14, show the structured flowchart of a kind of user data authoring system embodiment 2 of the present invention, described system also comprises open platform gateway 115;

Wherein, described legitimacy authentication comprises:

Further, if the user data that user comprises taking sub-account carries out use authority to third party as unit, so in the time of authentication third party access request legitimacy, in the described access request that described authorization server receives, also comprise user data, and digital signature in described access request is specially the digital signature of utilizing server identification, access token, user ID, sub-account and five Information generations of user data; ,

Described authorization server carries out legitimacy authentication and specifically comprises:

Further, in order to prevent Replay Attack, in the time of authentication third party access request legitimacy, in the described access request that described authorization server receives, also comprise current time stamp so; ,

Described authorization server carries out legitimacy authentication and also comprises:

The present invention can describe in the general context of computer executable instructions, for example program module.Usually, program module comprises and carries out particular task or realize routine, program, object, assembly, data structure of particular abstract data type etc.Also can in distributed computing environment (DCE), put into practice the present invention, in these distributed computing environment (DCE), be executed the task by the teleprocessing equipment being connected by communication network.In distributed computing environment (DCE), program module can be arranged in the local and remote computer-readable storage medium including memory device.

It should be noted that, in this article, relational terms such as the first and second grades is only used for an entity or operation to separate with another entity or operating space, and not necessarily requires or imply and between these entities or operation, have the relation of any this reality or sequentially.And, term " comprises ", " comprising " or its any other variant are intended to contain comprising of nonexcludability, thereby the process, method, article or the equipment that make to comprise a series of key elements not only comprise those key elements, but also comprise other key elements of clearly not listing, or be also included as the intrinsic key element of this process, method, article or equipment.The in the situation that of more restrictions not, the key element being limited by statement " comprising ... ", and be not precluded within process, method, article or the equipment that comprises described key element and also have other identical element.

For device embodiment, because it corresponds essentially to embodiment of the method, so relevant part is referring to the part explanation of embodiment of the method.Device embodiment described above is only schematic, the wherein said unit as separating component explanation can or can not be also physically to separate, the parts that show as unit can be or can not be also physical locations, can be positioned at a place, or also can be distributed in multiple network element.Can select according to the actual needs some or all of module wherein to realize the object of the present embodiment scheme.Those of ordinary skill in the art, in the situation that not paying creative work, are appreciated that and implement.

The above is only the specific embodiment of the present invention; it should be pointed out that for those skilled in the art, under the premise without departing from the principles of the invention; can also make some improvements and modifications, these improvements and modifications also should be considered as protection scope of the present invention.

Claims

1. a user data authorization method, is characterized in that, comprising:

Receive the authentication response that described authentication gateway returns, described authentication response comprises that certification is by user's user ID, and described user ID is obtained by the user name conversion authenticating by user;

2. method according to claim 1, is characterized in that, described authentication gateway carries out authentication to client user, specifically comprises:

3. method according to claim 1, is characterized in that, described method also comprises: after the sub-account of mandate of returning in described reception client,

4. method according to claim 3, is characterized in that, described method also comprises: before described foundation preserving the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data,

5. method according to claim 1, is characterized in that, described utilize described server address by described user ID, authorize sub-account and access token to be sent to described third party's application server, specifically comprise:

6. according to the method described in claim 1-5 any one, it is characterized in that, described method also comprises:

Wherein, described legitimacy authentication comprises:

7. method according to claim 6, is characterized in that, described method also comprises:

Described access request also comprises user data,,

Described legitimacy authentication specifically comprises:

8. method according to claim 6, is characterized in that, described method also comprises:

Described access request also comprises current time stamp; ,

Described legitimacy authentication also comprises:

9. a user data authorization device, is characterized in that, comprising:

Authentication response receiving element, the authentication response of returning for receiving described authentication gateway, described authentication response comprises that certification is by user's user ID, described user ID is obtained by the user name conversion authenticating by user;

10. device according to claim 9, is characterized in that, described device also comprises:

11. devices according to claim 10, is characterized in that, described device also comprises:

12. devices according to claim 9, is characterized in that, described authorization message transmitting element specifically comprises:

Authorization code generation unit, for generating authorization code;

13. according to the device described in claim 9-12 any one, it is characterized in that, described device also comprises:

Wherein, described legitimacy authentication comprises:

14. 1 kinds of user data authoring systems, is characterized in that, described system comprises: authorization server, third party's application server, authentication gateway, client,

Described authentication gateway, for client user is carried out to authentication, and sends and comprises that certification is by the authentication response of user's user ID to described authorization server, and described user ID is obtained by the user name conversion authenticating by user;

15. systems according to claim 14, is characterized in that, described authentication gateway specifically comprises:

16. systems according to claim 14, is characterized in that,

Described authorization server, also be sent to client for the user data that sub-described mandate account is comprised, and after receiving the authorized user data that described client returns, set up and preserve the corresponding relation between described server identification, user ID, the sub-account of mandate and authorized user data; And utilize described server address by described user ID, authorize sub-account, authorized user data and access token to be sent to described third party's application server.

17. systems according to claim 16, is characterized in that,

Described authorization server, also for judging whether the sub-account of described mandate is contained in the sub-account of described user, and judge whether described authorized user data are contained in described user data, if judged result is are, continue to carry out the step of setting up and preserving described corresponding relation.

18. according to the system described in claim 14-17 any one, it is characterized in that, described system also comprises open platform gateway;

Wherein, described legitimacy authentication comprises:

19. systems according to claim 18, is characterized in that,

In the described access request that described authorization server receives, also comprise user data, and digital signature in described access request is specially the digital signature of utilizing server identification, access token, user ID, sub-account and five Information generations of user data;

20. systems according to claim 18, is characterized in that,

In the described access request that described authorization server receives, also comprise current time stamp;