CN103124252B - Client application access authentication treating method and apparatus - Google Patents

Abstract

Embodiments of the present invention provide a client application access authentication processing method and device, as well as a client application business processing device and a client application device, wherein the method includes: receiving a request for a specific user or a third party sent by the client application device A first authorization request message authorizing the use of client application services; sending a second authorization request message to the user equipment of the specific user or a third-party device, the second authorization request message is used to request the specific user or third-party authorization Use the client application service; receive an authorization result returned by the user equipment of the specific user or a third-party device, and determine whether to allow the client application device to provide the client application to the specific user according to the authorization result business. The technical scheme of the invention can improve the security of the service provided by the SP to the target user by using the operator's telecommunication network capability.

Description

Client application access authentication processing method and device

technical field

The embodiments of the present invention relate to the field of communication technologies, and in particular, to a method and device for processing client application access authentication.

Background technique

With the advent of the mobile Internet era, the Internet and telecommunication networks are becoming more and more closely integrated. On the Internet and user terminals, more and more colorful Internet applications and terminal applications have emerged, such as Web applications, terminal Widget applications, and native terminal applications. These applications usually need to access the operator's telecommunications network capabilities to achieve specific service features. For example, a Widget application for traffic information query needs to be able to send MMS messages carrying traffic route maps to a terminal mobile phone user. Therefore, operators need a safe, open, and controllable means to allow client applications to access the operator's telecommunications network capabilities.

In the prior art, the opening of the operator's telecommunications network capabilities is mainly for the service application server of a trusted service provider (Service Provider, hereinafter referred to as: SP), and various Internet applications and terminal applications of the SP provide services for users. Accessing the operator's network capabilities mainly includes the following process: the service application server of the SP sends an access request to the operator's network operation platform, requesting to invoke the operator's telecommunications network capabilities, for example, the web application server of the SP may request to invoke the telecommunications network capabilities and send Mobile newspaper in the form of MMS. The access request sent by the SP's business application server will carry the SP's identity, password, and target user's mobile phone number. After the operator's network operation platform authenticates and confirms the SP, it will, according to the requirements of the SP's business application server, Provide the service required by the SP to the target user by utilizing the capability of the telecommunication network, and further charge for the service provided to the target user.

In the prior art, the scheme in which the SP utilizes the operator's telecommunication network capabilities to provide services to target users has poor security and is easily used by the SP to provide some illegal services.

Contents of the invention

Embodiments of the present invention provide a client application access authentication processing method and device, as well as a client application business processing device and client application equipment, to improve the security of the solution in which SP uses the operator's telecommunication network capabilities to provide services to target users sex.

An embodiment of the present invention provides a client application access authentication processing method, including:

receiving a first authorization request message sent by the client application device for requesting a specific user or a third party to authorize the use of the client application service;

Sending a second authorization request message to the user equipment of the specific user or a third-party device, where the second authorization request message is used to request the specific user or a third party to authorize the use of the client application service;

Receive an authorization result returned by the user equipment of the specific user or a third-party device, and determine whether to allow the client application device to provide the client application service to the specific user according to the authorization result.

The embodiment of the present invention also provides a client application access authentication processing device, including:

The first receiving module is configured to receive a first authorization request message sent by the client application device and used to request a specific user or a third party to authorize the use of the client application service;

A first sending module, configured to send a second authorization request message to the user equipment of the specific user or a third-party device, where the second authorization request message is used to request the specific user or a third party to authorize the use of the client application business;

The service authorization module is configured to receive an authorization result returned by the user equipment of the specific user or a third-party device, and determine whether to allow the client application device to provide the client application service to the specific user according to the authorization result.

The embodiment of the present invention also provides a client application service processing device, including the above-mentioned client application access authentication processing device and a telecommunications network open gateway module, the telecommunications network open gateway module is used to receive the client application device After sending the invocation request message carrying the access password, send an authentication authentication request message requesting authentication of the access password to the client application access authentication processing device, and invoke the telecommunication network capability for the client application device after the authentication is passed .

The embodiment of the present invention also provides a client application device, including a telecommunication network access authentication processing module and a telecommunication network service invocation module, and the telecommunication network access authentication processing module is used to send an A first authorization request message requesting a specific user to authorize or a third party to use the client application service, when the specific user accepts the client application service, obtain permission to call the telecommunications network capability, and provide the specific user with access to the client application service password; the telecommunication network service invocation module is used to send an invocation request message carrying the access password to the network system of the telecommunication operator, and the invocation request message is used to request the invocation of the telecommunication network capability to provide the client application for the specific user business.

In the above technical solution of the present invention, if the client application device of the SP wants to provide the client application service to the user, it first sends the first authorization request message, and then the client application access authentication set in the network system of the telecom operator The processing means processes by sending a second authorization request message to the specific user's user equipment or third-party equipment, asking the specific user or third party whether to authorize the use of the client application service, and then according to the specific user's user equipment or third-party equipment The returned authorization result determines whether the client application device is allowed to provide the client application service to the specific user, so that all the client application services provided by the client application device to the specific user are authorized by the specific user or a third party , improving the security of the client application service provided by the SP to the user.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flowchart of Embodiment 1 of a client application access authentication processing method according to the present invention;

FIG. 2 is a schematic flowchart of Embodiment 2 of the client application access authentication processing method of the present invention;

FIG. 3 is a schematic flowchart of Embodiment 3 of the client application access authentication processing method of the present invention;

FIG. 4 is a schematic structural diagram of Embodiment 1 of an apparatus for processing client application access authentication according to the present invention;

FIG. 5 is a schematic structural diagram of Embodiment 2 of an apparatus for processing client application access authentication according to the present invention;

FIG. 6 is a schematic structural diagram of an embodiment of a client application business processing device according to the present invention;

FIG. 7 is a schematic structural diagram of an embodiment of a client application device according to the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Aiming at the problem of poor security in the prior art when SP utilizes the operator's telecommunication network capabilities to provide users with services, the embodiment of the present invention provides a solution, which is to increase client application access in the telecommunication operator's network system Realized by the authentication processing device, FIG. 1 is a schematic flowchart of Embodiment 1 of the client application access authentication processing method of the present invention, as shown in FIG. 1 , including the following steps:

Step 101. Receive a first authorization request message sent by a client application device for requesting a specific user or a third party to authorize the use of client application services;

Step 102: Send a second authorization request message to the user equipment of the specific user or a third-party device, where the second authorization request message is used to request the specific user or third party to authorize the use of the client application service;

Step 103: Receive an authorization result returned by the user equipment of the specific user or a third-party device, and determine whether to allow the client application device to provide the client application service to the specific user according to the authorization result.

In the above-mentioned embodiments of the present invention, if the client application device of the SP wants to provide the client application service to the client user, it first sends the first authorization request message, and then is accessed by the client application installed in the network system of the telecom operator. The authentication processing means sends a second authorization request message to the specific user's user equipment or third-party equipment to ask the specific user or third party whether to authorize the use of the client application service, and then according to the specific user's user equipment or third-party equipment The authorization result returned by the third-party device determines whether the client application device is allowed to provide the client application service to the specific user, so that the client application device provides the client application service for the specific user through the specific user or a third party. Authorized, to improve the security of the client application service provided by the SP to the user.

The second authorization request message in the above embodiments of the present invention may be a user equipment held by a specific user, so that the specific user himself can confirm whether to accept the client application service, or it can be confirmed by a third party, such as the above-mentioned third-party device It can be a device held by the manager of a specific user, and the manager of the specific user confirms whether the specific user accepts the client application service, or the server of the operator acts as a third-party device, and the operator determines whether the specific user accepts the application service. Client application business.

In the above embodiments of the present invention, the operator can determine whether to provide client application services for specific users or third parties according to their wishes, that is, to determine whether to allow client application equipment to access telecommunications network capabilities, and corresponding settings can be set in the client application equipment. The telecommunications network access authentication processing device performs corresponding processing. In the specific implementation process, the client application equipment can be controlled to access the telecommunications network by assigning access passwords to the client application equipment. Specifically, it can include two types: implementation.

One is to first send the first authorization request message to the client application access authentication processing device in the network system of the telecom operator before the client application device sends the first authorization request message for requesting a specific user to authorize the use of the client application service. For a password application message, the client application access authentication processing device returns the first access password assigned to the client application device after receiving the first password application message sent by the client application device. The above-mentioned first access password can be regarded as a temporary password, which has not taken effect, and the client application device cannot access the telecommunications network capabilities of the operator according to the temporary password. Only when the specific user's user equipment or third-party equipment returns an authorization result, and the authorization result is that the specific user accepts the client application service, can the property of the above-mentioned first access password be changed in the local system It is an official password, so as to authorize the client application device to use the first access password to access the capability of the telecommunications network, and provide the client application service to the specific user. Furthermore, the client application device can use the first access password to execute the client application service, specifically, the client application device sends a service request message carrying the first access password to the first service processing module in the network system of the telecom operator, When the above-mentioned first service processing module receives the service request message and confirms that the above-mentioned first access password is available, it allows the client application device to access the capability of the telecommunications network, and provides the client application service to the specific user. The client application access authentication processing device in the operator's network system confirms whether the first access password is available.

In addition, there is another embodiment, which is different from the above-mentioned embodiments in that the operator's client application access authentication processing device does not change the first access method when the authorization result is that the specific user accepts the client application service. password, but generate a verification code corresponding to the first access password, and send the verification code to the client application device, and receive the first access password sent by the client application device and the second password application message of the verification code, return a second access password to the client application device, the second access password is an official password, to authorize the client application device to use the second access password to access telecommunications A network capability, providing the client application service to the specific user.

Specifically, when using the second access password, the client application device sends a service request message carrying the second access password to the second service processing module in the network system of the telecom operator, and the above-mentioned second service processing receives the service request message, And when it is confirmed that the second access password is available, allow the client application device to access the capability of the telecommunications network, and provide the client application service to the specific user, specifically, the client application service in the network system of the telecommunications operator may be provided. The access authentication processing device confirms whether the second access password is available.

In the above embodiments of the present invention, after receiving the authorization result returned by the user equipment of the specific user or a third-party device, and confirming that the authorization result is that the specific user accepts the client application service, further The specific user performs identity authentication, and returns an authorization result to the client application device after the authentication is passed. Specifically, for the above-mentioned embodiment of using the second access password, it may first generate a verification code corresponding to the first access password, Then carry the verification code in the authorization result and send it to the client application device.

FIG. 2 is a schematic flow diagram of Embodiment 2 of the client application access authentication processing method of the present invention, as shown in FIG. 2 , including the following steps:

Step 201, before the telecommunication network access authentication processing device of the client application equipment accesses the operator's telecommunication network capabilities, first apply for a temporary password from the client application access authentication processing device in the network system of the telecommunication operator, that is, send the first Password request message, the client application equipment in the embodiment of the present invention, can be divided into mobile terminal client according to terminal type, such as mobile phone, PDA, or computer client etc.; According to client application development language, can be divided into Widge application client, JAVA application client, Brew application client, Web client, etc. The telecommunication network access authentication processing device is a function module set inside the client application equipment and dedicated to authentication to the telecommunication network;

Step 202: After the client application access authentication processing device of the operator's network system passes the authentication on the client application device, it returns the first access password assigned to it to the telecommunications network access authentication processing device, and the first access password is It is a temporary password that has not taken effect, that is, the client application device cannot directly use the first access password to access the telecommunications network;

Step 203, the telecommunications network access authentication processing device sends a first authorization request message to the client application access authentication processing device, requesting a specific user or third party to authorize the use of client application services;

Step 204, the client application access authentication processing device sends a second authorization request message to the user equipment of a specific user or a third-party device, and the second authorization request message is used to request the specific user to authorize the use of the client application service; Specifically, the request method may be in accordance with a Web method, a Wireless Application Protocol (Wireless Application Protocol, hereinafter referred to as: WAP) method, an Unstructured Supplementary Service Data (hereinafter referred to as: USSD) method, or an Interactive Voice Response (InteractiveVoiceResponse, hereinafter referred to as: IVR) or a short message to send a second authorization request message to the user equipment of the specific user. Optionally, the second authorization request message may include the telecommunication network capability information corresponding to the client application service, the tariff information for using the telecommunication network capability, and the period type for authorizing the use of the client application service, for example, authorizing a single use The above-mentioned client application services, authorization to use the above-mentioned client application services multiple times, authorization to use the above-mentioned client application services before a set period, or authorization to use the above-mentioned client application services within a set time range;

Step 205, a specific user or a third party performs an authorization operation, and returns an authorization result to the client application access authentication processing device. For different request methods, the user can submit identity authentication information and authorize in different ways, for example, for Web or WAP pages , the user can submit personal user name and password on the Web or WAP page, and confirm on the page that he agrees to use the client application service; for the short message request method, the user can send a message to the telecom operator's network by confirming and replying to the short message. The client application access authentication processing device in the system returns an authorization result;

Step 206, the client application access authentication processing device identifies the authorization result returned by the specific user's user equipment or third-party equipment, and performs identity authentication on the specific user when the specific user accepts the above-mentioned client application service;

Step 207: After passing the identity authentication of the specific user, the client application access authentication processing device returns the authorization result to the telecommunications network access authentication processing device, and at the same time modifies the nature of the first access password returned in step 202 to an official password , so that the client application device can access the telecommunications network to provide services for specific users;

Step 208, the client application device uses the first access password to initiate an invocation request message, specifically, the telecommunication network service invocation module of the client application device may send an invocation request message to the telecommunication network open gateway module in the network system of the telecommunication operator , call the telecommunications network capability and access the operator's telecommunications network;

Step 209: After receiving the above-mentioned invocation request message, the telecommunications network open gateway module obtains the first access password carried in the invocation request message, and sends an authentication authentication request message to the client application access authentication processing device, further, For the first access password, after receiving the authorization result of the specific user, its nature is transformed into an official password. Each of the first access passwords corresponds to a specific user. Therefore, the first access password only allows To provide a service to a specific user, in the call request message in step 208, the user identification can also be further carried, such as the SIM card number of the mobile phone used by the user. In this step, the user identification will be further authenticated to determine whether it is compatible with the first Corresponding to an access password, so as to prevent the client application device from using the first access password to provide services for other users;

Step 210, the client application access authentication processing device authenticates the legitimacy and validity period of the user ID and the first access password;

Step 211, the client application access authentication processing device returns the authentication result to the telecommunications network open gateway module;

Step 212: After passing the authentication, the telecommunications network open gateway module invokes the telecommunications network capability, and returns the calling result to the client application device to provide services for specific users.

In the above-mentioned embodiments of the present invention, in step 206, after the specific user accepts the client application service, the user identity of the specific user is authenticated. In practical applications, this step is an optional step, and the above identity The authentication process, or it may also be to perform identity authentication before sending the second authorization request message to the user equipment of the specific user or the third-party equipment in the above step 204, and after the identity authentication is passed, perform the authentication to the user equipment of the specific user or the third-party equipment. A step in which the third-party device sends the second authorization request message. In the above embodiments of the present invention, the client application access authentication processing device can be set in each gateway device of the operator's network system, and its specific setting location does not affect the implementation of the technical solution of the present invention. In this embodiment, before invoking the telecommunications network capability and providing client application services for specific users, first request authorization from the specific user or a third party, and then provide client application services after obtaining authorization, which can improve the SP's ability to provide services for users. safety.

The above-mentioned embodiment shown in FIG. 2 corresponds to an implementation scheme in which only the first access password is assigned. FIG. 3 is a schematic flowchart of Embodiment 3 of the client application access authentication processing method of the present invention. In this embodiment, the client application access authentication The processing device will further assign the second access password as the official password, as shown in Figure 3, including the following steps:

Steps 301 to 306 perform basically the same functions as steps 201 to 206 in the above embodiment.

Step 307, after passing the identity authentication of the specific user, generating a verification code corresponding to the first access password;

Step 308, returning an authorization result to the telecommunication network access authentication processing device, the authorization result carrying the above-mentioned verification code;

Step 309, the telecommunications network access authentication processing device sends a second password application message carrying the first access password and the verification code to the operator's client application access authentication processing device;

Step 310, the client application access authentication processing device assigns a second access password, the second access password is an official password, and is used to authorize the client application device to use the second access password to access the telecommunications network capabilities, and to the above-mentioned specific The user provides the client application service;

Step 311, the client application access authentication processing device returns the second access password to the telecommunications network access authentication processing device;

Steps 312 to 316 perform basically the same functions as steps 208 to 212 in the above embodiment, the only difference being that the device for processing the telecommunications network access authentication uses the second access password to initiate a call request message.

In this embodiment, by assigning the first access password and the second access password to the client application device respectively, and finally the client application device invokes the power network capability according to the second access password to provide client application services for specific users, which can improve SP provides users with the security of customer single application services.

The embodiment of the present invention also provides a client application access authentication processing device. FIG. 4 is a schematic structural diagram of Embodiment 1 of the client application access authentication processing device of the present invention. As shown in FIG. 4, the client application access authentication The right processing device 40 includes a first receiving module 11, a first sending module 12, and a service authorization module 13, wherein the first receiving module 11 is used to receive a request from a client application device for requesting a specific user or a third party to authorize the use of the client application. A first authorization request message for a service; the first sending module 12 is configured to send a second authorization request message to the user equipment of the specific user or a third-party device, and the second authorization request message is used to request the specific user or the third party device The three parties authorize the use of the client application service; the service authorization module 13 is used to receive the authorization result returned by the user equipment of the specific user or the third party equipment, and determine whether to allow the client application device to send the application service to the client according to the authorization result. A specific user provides the client application service.

In the embodiment of the present invention, after receiving the first authorization request message, the client application access authentication processing device set in the network system of the telecom operator sends the second authorization request message to the user equipment of a specific user or a third-party equipment, Ask the specific user or third party whether to authorize the use of the client application service, and then determine whether the client application device is allowed to provide the client application service to the specific user according to the authorization result returned by the user equipment of the specific user or the third party device , so that all customer single application services provided by the client application device for a specific user are authorized by the specific user, thereby improving the security of the service provided by the SP to the user.

It has been introduced in the above-mentioned method embodiments that the client application device can be controlled to access the telecommunications network to provide services for specific users through passwords. Specifically, it can include the situation of assigning only one access password and assigning two access passwords, corresponding to Embodiments of the method shown in FIGS. 2 and 3 .

For the embodiment shown in FIG. 2 above, for the situation where only the first access password needs to be assigned, as shown in FIG. 5, the client application access authentication processing device 50 further includes a first password assignment module 14, and the first password The distribution module 14 is configured to receive the first password request message sent by the client application device before receiving the first authorization request message sent by the client application device for requesting a specific user or a third party to authorize the use of the client application service, and send the The client application device returns the first access password assigned to it; and the above-mentioned service authorization module 13 is specifically configured to authorize the specific user when the authorization result is that the specific user accepts the client application service. The client application device uses the first access password to access the capability of the telecommunications network, and provides the client application service to the specific user.

For the above-mentioned embodiment shown in FIG. 3 , the situation where the first access password and the second access password need to be assigned also includes the above-mentioned first password assignment module 14, which assigns the first access password to the client application device, and the business therein The authorization module 13 is specifically configured to generate a verification code corresponding to the first access password when the authorization result is that the specific user accepts the client application service, and send the verification code to the client application device , and after receiving the second password request message carrying the first access password and the verification code sent by the client application device, return the second access password to the client application device to authorize the client application device The client application service is provided to the specific user by using the second access password to access a telecommunications network capability.

In addition, in the embodiment of the present invention, the identity of a specific user can be further authenticated, that is, a user identity authentication module 15 is set in the client application access authentication processing device, and the user identity authentication module 15 is used for receiving the described After the authorization result returned by the specific user's user equipment or third-party equipment, and the authorization result is that the specific user accepts the client application service, the specific user is authenticated, and after the authentication is passed, the client The terminal application device returns an authorization result, and if a verification code corresponding to the first access password is generated, the verification code is included in the authorization result and sent to the client application device.

Further, the embodiment of the present invention also provides a client application service processing device. FIG. 6 is a schematic structural diagram of an embodiment of the client application service processing device of the present invention. As shown in FIG. 6 , the client application service processing device 60 includes The client application access authentication processing device 21 and the telecom network open gateway module 22, wherein the client application access authentication processing device 21 can adopt the client application access authentication processing device provided in any of the above-mentioned embodiments, and the telecom network open gateway module 22 Module 22 is configured to, after receiving the invocation request message carrying the access password sent by the client application device, send an authentication request message requesting authentication of the access password to the client application access authentication processing device, and After passing, call the telecom network capability for the client application equipment.

The embodiment of the present invention also provides a client application device. FIG. 7 is a schematic structural diagram of an embodiment of the client application device of the present invention. As shown in FIG. 7, the client application device 70 includes a telecommunication network access authentication processing module 31 and The telecommunication network service calling module 32, the telecommunication network access authentication processing module 31 is used to send a first authorization request message for requesting a specific user to authorize the use of the client application service to the network system of the telecommunication operator, and after the specific user accepts the When using the client application service, obtain the access password that allows calling the telecommunications network capability, and provide the specific user with the access password of the client application service; the telecommunication network service calling module 32 is used to send the access password carrying the access password to the network system of the telecom operator An invocation request message, where the invocation request message is used to request invocation of a telecommunications network capability to provide client application services for the specific user.

The client application access authentication processing method and device provided by the above embodiments of the present invention, as well as the client application service processing device and the client application device, wherein before invoking the capability of the telecommunications network to provide the client application service for the user, firstly, to the specific user The used user equipment or third-party equipment sends an authorization request message to request authorization of the specific user to use the above-mentioned client application service, and after the user accepts the above-mentioned client application service, authorize the client application device to access the telecommunications network capability, Providing the client application service to the specific user, through the above technical solution, can improve the security of the SP providing the client application service to the user. In addition, the operator can also provide the service with the consent of the user, and charge according to the service, which can effectively prevent the third party from using the operator's telecommunications network capabilities to conduct billing fraud.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (11)

1. a client application access authentication processing method, it is characterised in that including:

Client application access authentication processing means receives the first authorization request message being used for asking specific user or third party to license client application business that client application equipment sends；

Described client application access authentication processing means sends the second authorization request message to subscriber equipment or the third party device of described specific user, and described second authorization request message is used for asking described specific user or third party to license described client application business；

Described client application access authentication processing means receives subscriber equipment or the Authorization result of third party device return of described specific user, determines whether that described client application equipment provides described client application business to described specific user according to described Authorization result；

Wherein, described client application access authentication processing means also includes before receiving the first authorization request message being used for asking specific user or third party to license client application business that client application equipment sends:

Described client application access authentication processing means receives the first password solicitation message that client application equipment sends, and is returned as the first access password of its distribution to described client application equipment；

According to Authorization result, described client application access authentication processing means determines whether that described client application equipment provides described client application business to include to described specific user:

Described Authorization result be described specific user accept described client application business time, described in client application equipment utilization described in client application access authentication processing means mandate, the first access password accesses telecommunication network capability, provides described client application business to described specific user；Or, described Authorization result be described specific user accept described client application business time, generate the identifying code corresponding with described first access password, and described identifying code is sent to described client application equipment, and after receiving the second password solicitation message carrying described first access password and described identifying code that client application equipment sends, the second access password is returned to client application equipment, to authorize the second access password described in described client application equipment utilization to access telecommunication network capability, described client application business is provided to described specific user.

Client application access authentication processing method the most according to claim 1, it is characterized in that, receive the subscriber equipment of described specific user or the Authorization result of third party device return in described client application access authentication processing means after, and described Authorization result is described specific user when accepting described client application business, described method also includes:

Described client application access authentication processing means carries out authentication to described specific user, and returns Authorization result to client application equipment after certification is passed through.

Client application access authentication processing method the most according to claim 1, it is characterized in that, if according to Authorization result, described client application access authentication processing means determines whether that described client application equipment provides described client application business to include to described specific user: described Authorization result be described specific user accept described client application business time, described in client application equipment utilization described in client application access authentication processing means mandate, the first access password accesses telecommunication network capability, described client application business is provided to described specific user, described method also includes:

Described client application access authentication processing means receives the call request message carrying the first access password that client application equipment sends, and when confirming that described first access password can use, allow client application equipment calls telecommunication network capability, provide described client application business to described specific user.

nullClient application access authentication processing method the most according to claim 1，It is characterized in that，If according to Authorization result, described client application access authentication processing means determines whether that described client application equipment provides described client application business to include to described specific user: described Authorization result be described specific user accept described client application business time，Generate the identifying code corresponding with described first access password，And described identifying code is sent to described client application equipment，And after receiving the second password solicitation message carrying described first access password and described identifying code that client application equipment sends，The second access password is returned to client application equipment，To authorize the second access password described in described client application equipment utilization to access telecommunication network capability，Described client application business is provided to described specific user，Described method also includes:

Described client application access authentication processing means receives the business request information carrying the second access password that client application equipment sends, and when confirming that described second access password can use, allow client application equipment to access telecommunication network capability, provide described client application business to described specific user.

Client application access authentication processing method the most according to claim 1, it is characterised in that described client application access authentication processing means sends the second authorization request message include to subscriber equipment or the third party device of specific user:

Described client application access authentication processing means sends the second authorization request message according to Web mode, WAP mode, unstructured supplementary data traffic mode, interactive voice answering or short message way to the subscriber equipment or third party device with described specific user.

Client application access authentication processing method the most according to claim 1, it is characterized in that, described second authorization request message includes telecommunication network capability information corresponding to described client application business, uses the tariff information of described network capabilities and license the time limit type of described client application business.

Client application access authentication processing method the most according to claim 6, it is characterised in that described in license the time limit type of described client application business and include:

Mandate is intended for single use described client application business, mandate is used for multiple times described client application business, mandate uses described client application business or mandate to use described client application business in one sets time range before one sets the time limit.

8. a client application access authentication processing means, it is characterised in that including:

First receiver module, for receive client application equipment send for asking specific user or third party to license the first authorization request message of client application business；

First sending module, for sending the second authorization request message to subscriber equipment or the third party device of described specific user, described second authorization request message is used for asking described specific user or third party to license described client application business；

Service authorization module, the Authorization result that the subscriber equipment or third party device for receiving described specific user returns, determine whether that described client application equipment provides described client application business to described specific user according to described Authorization result；

First password distribution module, for receive that client application equipment sends before ask the first authorization request message that specific user or third party license client application business, receive the first password solicitation message that client application equipment sends, and be returned as the first access password of its distribution to described client application equipment；

Described service authorization module specifically for described Authorization result be described specific user accept described client application business time, authorize the first access password described in described client application equipment utilization to access telecommunication network capability, provide described client application business to described specific user；Or, described Authorization result be described specific user accept described client application business time, generate the identifying code corresponding with described first access password, and described identifying code is sent to described client application equipment, and after receiving the second password solicitation message carrying described first access password and described identifying code that client application equipment sends, the second access password is returned to client application equipment, to authorize the second access password described in described client application equipment utilization to access telecommunication network capability, described client application business is provided to described specific user.

Client application access authentication processing means the most according to claim 8, it is characterised in that also include:

Authenticating user identification module, after the Authorization result returned at the subscriber equipment or third party device that receive described specific user, and described Authorization result is that described specific user is when accepting described client application business, described specific user is carried out authentication, and return Authorization result to client application equipment after certification is passed through, if generating the identifying code corresponding with described first access password, and described identifying code is carried in described Authorization result, it is sent to described client application equipment.

10. a client application business processing device, it is characterized in that, including the open gateway module of the client application access authentication processing means described in claim 8 or 9 and communication network, the open gateway module of described communication network is for after receiving the call request message carrying access password that client application equipment sends, to client application access authentication processing means send request described access password is authenticated authentication request message, and in certification by rear for client application equipment calls telecommunication network capability.

11. 1 kinds of client application equipment, it is characterized in that, including communication network access authentication processing module and telecommunication network services calling module, described communication network access authentication processing module for sending the first authorization request message for asking specific user or third party to license client application business to the network system of telecom operators, when specific user accepts described client application business, acquisition allows to call telecommunication network capability, provides the access password of client application business to described specific user；Described telecommunication network services calling module carries the call request message of described access password to the network system of telecom operators for sending, and described call request message provides client application business for request call telecommunication network capability for described specific user.