HK1235562B - Authentication method and apparatus - Google Patents

Description

Authentication method and device

Technical Field

The present application relates to the field of computer technology, and in particular to an authentication method and device.

Background Art

Currently, various terminal applications (APPs) are widely used. Users can authenticate with the application server using a pre-registered account and password, and successfully log in to the application after passing the authentication. These terminals include, but are not limited to, smartphones, tablets, smartwatches, and in-car mobile devices.

In the prior art, many application servers also provide methods for authenticating users based on terminal identifiers and verification codes, eliminating the need for users to register accounts for each application. The terminal identifier can be a mobile phone number, etc. It should be noted that mobile phone numbers are not limited to mobile phones. The aforementioned other terminals can also use mobile phone numbers to implement functions such as sending and receiving short message services (SMS).

Taking the terminal identifier as a mobile phone number as an example, the authentication method based on the terminal identifier and verification code in the prior art is explained, which mainly includes the following operating steps: starting the application on the mobile phone; the user enters the mobile phone number of the mobile phone in the login interface of the application, and sends a verification code acquisition request carrying the mobile phone number to the server of the application by clicking a specific button provided on the login page. After receiving the verification code acquisition request, the server generates a verification code (generally a 4-digit or 6-digit random number string) and returns it to the mobile phone to which the mobile phone number carried in the verification code acquisition request belongs (that is, the user's mobile phone) via SMS. The user can view the verification code in the SMS received by the mobile phone and enter the verification code on the login page. The mobile phone can then send the verification code entered by the user to the server to request to log in to the application. When the server determines that the verification code received is the same as the verification code sent by the server to the mobile phone to which the mobile phone number belongs, it determines that the user is authenticated and allows the mobile phone to log in to the application with the mobile phone number. Correspondingly, the login interface on the mobile phone jumps to the login success page.

However, in the above authentication process, after receiving the verification code SMS, the mobile phone needs to wait for the user to manually check the verification code SMS, and manually enter and send the verification code before the server can authenticate the user. Therefore, the operation steps are cumbersome and the authentication efficiency is low.

Summary of the Invention

The embodiments of the present application provide an authentication method and device to solve the problem of low efficiency of server authentication of users in the prior art.

The embodiments of the present application provide another authentication method and device to solve the problem of low efficiency of server authentication of users in the prior art.

An authentication method provided in an embodiment of the present application includes:

The terminal sends an operation request carrying the terminal identification and identity information to the server of the target application;

Receiving an open link (OpenURL) returned by the server according to the terminal identifier, wherein the OpenURL carries the encrypted identity information of the server;

According to the OpenURL, the identity information is obtained through the target application, and the obtained identity information and the encrypted identity information are sent to the server, so that the server performs authentication based on the received identity information and the encrypted identity information.

Another authentication method provided in an embodiment of the present application includes:

The server of the target application receives the operation request sent by the terminal, which carries the terminal identification and identity information;

Generate an OpenURL carrying the encrypted identity information of the server based on the identity information;

Returning the OpenURL to the terminal according to the terminal identifier;

receiving the identity information and the encrypted identity information obtained by the terminal through the target application according to the OpenURL and sent to the server;

Authentication is performed based on the received identity information and the encrypted identity information.

An authentication device provided in an embodiment of the present application includes:

A sending module, configured to send an operation request carrying terminal identification and identity information to a target application server on behalf of the terminal;

A receiving module, configured to receive an OpenURL returned by the server according to the terminal identifier, wherein the OpenURL carries the encrypted identity information of the server;

The authentication module is used to obtain the identity information through the target application according to the OpenURL, and send the obtained identity information and the encrypted identity information to the server, so that the server performs authentication based on the received identity information and the encrypted identity information.

Another authentication device provided in an embodiment of the present application includes:

A first receiving module is configured to receive, for a server of a target application, an operation request sent by a terminal and carrying a terminal identifier and identity information;

A generating module, configured to generate an OpenURL carrying the encrypted identity information of the server according to the identity information;

A returning module, configured to return the OpenURL to the terminal according to the terminal identifier;

A second receiving module is configured to receive the identity information and the encrypted identity information that the terminal obtains through the target application according to the OpenURL and sends to the server;

The authentication module is used to perform authentication based on the received identity information and the encrypted identity information.

In the embodiment of the present application, through at least one of the above technical solutions, the user can trigger the server to perform user authentication by clicking the OpenURL. The operation steps are simple and the authentication efficiency is high.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

FIG1 illustrates the process of the authentication method provided in an embodiment of the present application;

FIG2 is a process of another authentication method provided in an embodiment of the present application;

FIG3 is a detailed process of authentication login in an actual application scenario provided by an embodiment of the present application;

FIG4 is a schematic diagram of the structure of an authentication device corresponding to FIG1 provided in an embodiment of the present application;

FIG5 is a schematic diagram of the structure of the authentication device corresponding to FIG2 provided in an embodiment of the present application.

DETAILED DESCRIPTION

To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

FIG1 illustrates the authentication method according to an embodiment of the present invention, which specifically includes the following steps:

S101: A terminal sends an operation request carrying a terminal identifier and identity information to a server of a target application.

In the embodiment of the present application, the execution subject of the authentication method in Figure 1 can be a terminal equipped with the target application, and the terminal includes but is not limited to: a mobile phone, a tablet computer, a smart watch, a vehicle-mounted mobile station, a personal computer, etc. The target application can be any application installed on the terminal.

In an embodiment of the present application, the terminal may send the operation request to the server to request the service provided by the server and corresponding to the operation request.

In actual applications, to improve the security of interactions between the terminal and the server, the terminal may be allowed to obtain the corresponding service from the server only after the server has authenticated the terminal (the user using the terminal). The authentication process itself is also a type of the corresponding service. In this case, the operation request may be: an authentication request, and other requests containing the authentication request (the other requests may be login requests, payment requests, user information change requests, etc.). The above is an example of the operation request, and this application does not limit the operation request.

In an embodiment of the present application, the terminal identifier can be a communication address used when the terminal interacts with the server (used to address the terminal), such as the terminal identifier can be the mobile phone number of the terminal, the email address currently used by the terminal, and so on.

The identity information can uniquely identify the terminal. Since, in actual applications, a terminal is generally used by a fixed user, it can be considered that the identity information not only represents the identity of the terminal, but also the identity of the user using the terminal. The identity information can be the International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identification Number (IMSI), and Media Access Control (MAC) address of the terminal, etc.

S102: Receive an open link OpenURL returned by the server according to the terminal identifier, wherein the OpenURL carries the encrypted identity information of the server.

To facilitate understanding, the following describes OpenURL. OpenURL is a runnable Uniform Resource Locator (URL) that can carry metadata and resource address information. It can be used to implement functions such as waking up applications and transferring predefined parameters and data between different applications. These features of OpenURL can be used to address the issues mentioned in the background technology.

In this embodiment of the present application, the encrypted identity information is generated by the server after encrypting the identity information received from the terminal. It should be noted that when encrypting the identity information, the server may also encrypt the current timestamp and the terminal identifier sent by the receiving terminal. In this case, the encrypted identity information may also include the encrypted terminal identifier, the encrypted current timestamp, and other information.

Furthermore, since the server returns the OpenURL based on the terminal identifier, even if an attacker impersonates a user using the terminal, as long as the attacker does not have the terminal, he or she will not be able to receive the OpenURL returned by the server and will not be able to pass subsequent authentication. Therefore, the security of the authentication method improved by this application is improved.

S103: According to the OpenURL, the identity information is obtained through the target application, and the obtained identity information and the encrypted identity information are sent to the server, so that the server performs authentication according to the received identity information and the encrypted identity information.

In the embodiment of the present application, the OpenURL is executable, and the user can click on the OpenURL to trigger the terminal and server to automatically execute the subsequent authentication process. Compared with the existing technology in which users manually view, enter and submit verification codes, the operation is simple and the authentication efficiency is high.

In the embodiment of the present application, under normal circumstances, since step S101 and step S103 are executed by the same terminal, the identity information in step S101 is the same as the identity information obtained by the terminal in step S103, and the terminal can pass the server's authentication. In abnormal circumstances, for example, assuming that terminal A obtains the OpenURL by executing step S101, and terminal B copies the OpenURL from terminal A, and then step S103 is executed by terminal B instead of terminal A, in this case, the identity information in step S101 (obtained by terminal A) is different from the identity information obtained by terminal B in step S103, and terminal B cannot impersonate terminal A to pass the server's authentication.

Therefore, the authentication method provided in the embodiment of the present application can prevent attackers from stealing the OpenURL generated by the server for the legitimate terminal for authentication.

Through the above method, since the user can trigger the server to perform user authentication by clicking the OpenURL, the operation steps are simple and the authentication efficiency is high. Therefore, the problem of low efficiency of the server in authenticating users can be solved.

In an embodiment of the present application, the terminal identification and identity information carried in the operation request sent by the terminal to the server can be manually input by the user or automatically obtained by the terminal.

For example, for step S101, the terminal sends an operation request carrying the terminal identification and identity information to the server of the target application, which may specifically include: the terminal receives the terminal identification input by the user; obtains the identity information through the target application; and sends an operation request carrying the terminal identification and the identity information to the server of the target application.

More specifically, the target application on the terminal can provide a specific operation interface and operation control for the user, so that the user can input the terminal identification in the operation interface and click the operation control to trigger the terminal to obtain the terminal identification and identity information and execute step S101.

It should be noted that the above is only an example of a specific implementation of step S101. In actual applications, when different methods are used to obtain the terminal identifier and identity information, the specific implementation of step S101 may also be different accordingly.

In an embodiment of the present application, the server may address the terminal using the terminal identifier and then send an OpenURL to the terminal. To enable the user to normally use (including but not limited to at least one of viewing, clicking to run, and copying) the OpenURL received by the terminal, the server may send the OpenURL in a message with a predetermined format, wherein the predetermined format is determined based on the terminal identifier.

For example, the terminal identifier is a mobile phone number. In this case, step S102 includes receiving the open link OpenURL returned by the server based on the terminal identifier, specifically including receiving specific information including the OpenURL returned by the server to the terminal corresponding to the terminal identifier using the information sending method corresponding to the terminal identifier, wherein the information sending method corresponding to the terminal identifier includes a short message service (SMS) method, and the specific information includes a text message. The embodiments of the present application are primarily illustrative of this scenario.

Of course, in actual applications, the terminal identifier may also be other information, such as an email address used by the user on the terminal. In this case, the information sending method corresponding to the terminal identifier includes an email service method, and the specific information includes email.

In addition, when using SMS or email as the server to send OpenURL to the terminal, since SMS service and email service are already very popular application services on the terminal, when implementing the authentication method, the implementation cost of sending OpenURL is very low and the reliability is high.

In an embodiment of the present application, in order to implement the authentication process in step S103, the server does not arbitrarily generate an OpenURL and return it to the terminal, but generates an OpenURL that can be applied to the authentication process so that the terminal can wake up the target application based on the OpenURL, and pass the relevant information needed for the authentication to the server through the target application. The OpenURL generated by the server is described in detail below.

The OpenURL not only carries the encrypted identity information of the server, but also may carry the Uniform Resource Locator Schemes (URL Schemes) field information of the target application and the processing identifier of the target application corresponding to the operation request.

In this case, for step S103, according to the OpenURL, the identity information is obtained through the target application, and the obtained identity information and the encrypted identity information are sent to the server, which may specifically include: when a resolution request for the OpenURL is received, according to the URLSchemes field information contained in the OpenURL, waking up the target application, wherein the resolution request is sent by the user by clicking the OpenURL in the specific information; sending the encrypted identity information and the processing identifier contained in the OpenURL to the awakened target application, so that the target application performs the following operations: obtaining the identity information according to the processing identifier, and sending the obtained identity information and the encrypted identity information to the server.

It can be seen that when the specific information is a text message, the user only needs to click the OpenURL in the text message to initiate the execution of step S103, which is simple to operate and provides a good user experience.

To facilitate understanding, the URL Schemes field information and processing identifiers are explained.

For URL Schemes field information, each application can have a URL Schemes field information, which can be defined by the server or developer of the application. The URL Schemes field information can uniquely identify the application. Therefore, in the embodiment of the present application, the terminal can address the location of the target application on the terminal based on the URL Schemes field information of the target application, and then wake up the target application and jump to the target application from other locations on the terminal.

Each application can have multiple processing identifiers, each of which can correspond to an operation request from the terminal for that application. The application's server or developer can define the business logic for each operation request. The target application or server can determine the entry point for the business logic corresponding to the operation request based on the processing identifier corresponding to the operation request, and then execute the business logic. In the embodiments of the present application, the business logic can be the business logic used to implement processes such as authentication and login.

In the embodiment of the present application, as mentioned above, the operation request may be other requests including an authentication request. In this case, after successfully authenticating the terminal, the server may further execute other business logic involved in the other requests.

For example, when the operation request includes a login request, after the server authenticates the terminal, it can also generate a login success page based on the terminal identifier and return it to the terminal. The terminal can then jump from the current page to the login success page of the target application, thereby successfully completing the login process.

The above describes in detail the OpenURL generated by the server. For ease of understanding, we will further illustrate the OpenURL generated by the server in a certain actual application scenario with an example. Assuming that the operation request is a login request, the target application is an e-commerce application, the URL Schemes field information of the e-commerce application is "alipay", and the processing identifier corresponding to the login request of the e-commerce application is "phoneMsgLogin". The encrypted identity information of the server is represented as "sdasdqwe123213sadasdas". Then the server can generate the OpenURL as follows:

"alipay:phoneMsgLogin?token=sdasdqwe123213sadasdas";

Here, "token" is a predetermined name of a parameter used to store the encrypted identity information of the server. In actual applications, there is no limitation on the predetermined name of the parameter, and other character strings may also be used as the predetermined name of the parameter.

The above is the process of the authentication method provided by the embodiment of the present application with the terminal as the execution subject. Based on the same idea, the embodiment of the present application also provides an authentication method with the server of the target application as the execution subject, as shown in Figure 2.

FIG2 is a process of another authentication method provided in an embodiment of the present application, which specifically includes the following steps:

S201: The server of the target application receives an operation request sent by a terminal, which carries the terminal identification and identity information.

In the embodiment of the present application, the execution subject of the authentication method in FIG2 may be the server of the target application, and the server includes but is not limited to: a personal computer, a large or medium-sized computer, a computer cluster, etc.

202: Generate an open link OpenURL carrying the encrypted identity information of the server according to the identity information.

203: Return the OpenURL to the terminal according to the terminal identifier.

204: Receive the identity information and the encrypted identity information that the terminal obtains through the target application according to the OpenURL and sends to the server.

205: Perform authentication based on the received identity information and the encrypted identity information.

Through the above method, the user can trigger the server to perform user authentication by clicking the OpenURL, the operation steps are simple, and the authentication efficiency is high. Therefore, the problem of low efficiency of the server in authenticating users can be solved.

In an embodiment of the present application, for step S202, based on the identity information, an open link OpenURL carrying the encrypted identity information of the server is generated, which can specifically include: combining the terminal identifier, the identity information and the current timestamp into a character string, and using a predetermined reversible algorithm to encrypt the character string to generate encrypted identity information; based on the target application and the operation request, obtaining the Uniform Resource Locator Scheme URLSchemes field information of the target application and the processing identifier corresponding to the operation request; generating an OpenURL carrying the encrypted identity information, the URL Schemes field information and the processing identifier.

The current timestamp can be used by the server to subsequently verify whether the OpenURL has timed out. In this case, when generating the OpenURL, the server can set a maximum lifetime for the OpenURL (which can be 1 minute, 3 minutes, 5 minutes, etc.). After the maximum lifetime has expired, the server can determine that the OpenURL is invalid and refuse to execute the authentication process triggered by the OpenURL, requiring the terminal to re-acquire the OpenURL generated by the server for authentication. Therefore, the current timestamp helps improve the security of the authentication method.

The above encryption process can prevent the terminal identification, identity information and current timestamp of the terminal from being tampered with by an attacker during transmission, thereby improving the security of the authentication method.

The embodiment of the present application does not limit the combination method used to generate the character string and the reversible algorithm used to encrypt the character string. The following example illustrates a combination method in actual application.

For example, assuming the terminal identifier is the mobile phone number "186XXXXXXXX," the identity information is the terminal's MAC address, IMEI, and IMSI, and the current timestamp is 01:25 on September 6, 2015 (converted to milliseconds: 1441473914543). The terminal identifier, identity information, and current timestamp are concatenated to generate a string, which can be represented as "186XXXXXXXX+MAC+IMEI+IMSI+1441473914543." This string can then be encrypted to generate encrypted identity information. It can be seen that in this case, the encrypted identity information includes not only the encrypted identity information, but also the encrypted terminal identifier and the encrypted current timestamp. It should be noted that due to the long number of digits in the terminal's MAC, IMEI, and IMSI, they are not represented in detail in the above string and are instead represented directly by their names.

Furthermore, in an embodiment of the present application, for step S203, returning the OpenURL to the terminal according to the terminal identifier may specifically include: adopting the information sending method corresponding to the terminal identifier, returning specific information containing the OpenURL to the terminal corresponding to the terminal identifier, wherein the information sending method corresponding to the terminal identifier includes a short message service SMS method, and the specific information includes a text message.

In the embodiment of the present application, step 205 specifically includes:

The reversible algorithm is used to decrypt the received encrypted identity information to obtain the character string; when it is determined that the received identity information is the same as the identity information contained in the character string, and the interval between the timestamp contained in the character string and the current time is not greater than a preset threshold, the authentication is determined to be successful; when it is determined that the received identity information is not the same as the identity information contained in the character string, or the interval between the timestamp contained in the character string and the current time is greater than a preset threshold, the authentication is determined to be unsuccessful.

The preset threshold may be the maximum lifetime of the OpenURL mentioned above.

Similar to the authentication process in Figure 1, when the operation request includes a login request, after step S205, if the server determines that the authentication is successful, it can generate a login success page based on the terminal identifier and return it to the terminal. In this case, the server uses the terminal identifier as the account used by the user after successfully logging into the target application. Therefore, the user does not need to pre-register an account for each application. Instead, they can use the same terminal identifier to log in to each application, improving user login convenience.

The above describes the authentication method provided by this application from the perspective of the terminal and the server respectively. The embodiment of this application also provides a two-end (terminal, target application server) interaction flow chart in combination with the process in Figures 1 and 2 to illustrate a detailed implementation process of the authentication method provided by this application in actual application. As shown in Figure 3, assuming that the terminal identifier is a mobile phone number, the operation request is a login request, and the identity information includes at least one of IMEI, IMSI and MAC address, the detailed implementation process may specifically include the following steps:

S301: The user enters the mobile phone number of the terminal in the target application on the terminal and clicks the login button provided by the target application.

S302: After detecting that the user clicks the login button, the target application obtains the identity information of the terminal and sends a login request carrying the identity information and the mobile phone number input by the user to the server of the target application.

S303: The server combines the received terminal identification, identity information and the determined current timestamp into a character string, and encrypts the character string using a predetermined reversible algorithm to generate encrypted identity information.

S304: The server obtains the URL Schemes field information of the target application and the processing identifier corresponding to the login request according to the target application and the login request.

S305: The server generates an OpenURL that carries the encrypted identity information, the URL Schemes field information, and the processing identifier.

S306: The server sends a text message containing the OpenURL to the terminal corresponding to the mobile phone number via text message.

S307: The terminal receives the SMS message through the SMS application, and the user clicks the OpenURL in the SMS message.

S308: The terminal parses the OpenURL to obtain the encrypted identity information, the URL Schemes field information, and the processing identifier.

S309: The terminal wakes up the target application according to the URL Schemes field information, and sends the encrypted identity information and the processing identifier to the target application.

S310: The target application obtains the identity information of the terminal according to the processing identifier, and sends the obtained identity information and the encrypted identity information to the server.

S311: The server uses the reversible algorithm to decrypt the received encrypted identity information to obtain the character string.

S312: When the server determines that the received identity information is the same as the identity information included in the character string, and the interval between the timestamp included in the character string and the current time is not greater than a preset threshold, the server determines that the authentication is successful.

S313: After confirming that the authentication is successful, the server generates a login success page based on the mobile phone number contained in the character string and returns it to the terminal.

S314: The terminal jumps to the target application's login success page.

It should be noted that the authentication method provided in the embodiments of the present application can also be used for wireless websites by replacing the target application in the authentication method with the wireless website. In this case, the user can receive authentication from the wireless website's server based on the authentication method, and then log in to the wireless website after passing the authentication, and request other services from the server of the network website.

The above is the authentication method provided in the embodiment of the present application. Based on the same idea, the embodiment of the present application also provides a corresponding authentication device, as shown in Figures 4 and 5.

FIG4 is a schematic diagram of the structure of the authentication device corresponding to FIG1 provided in an embodiment of the present application, specifically including:

The sending module 401 is used to send an operation request carrying the terminal identification and identity information to the server of the target application on behalf of the terminal;

A receiving module 402 is configured to receive an OpenURL returned by the server according to the terminal identifier, wherein the OpenURL carries the encrypted identity information of the server;

The authentication module 403 is configured to obtain the identity information through the target application according to the OpenURL, and send the obtained identity information and the encrypted identity information to the server, so that the server performs authentication based on the received identity information and the encrypted identity information.

The sending module 401 is specifically configured to: receive a terminal identifier input by a user for the terminal; obtain identity information through the target application; and send an operation request carrying the terminal identifier and the identity information to the server of the target application.

The receiving module 402 is specifically used to: receive the specific information containing OpenURL returned by the server to the terminal corresponding to the terminal identifier using the information sending method corresponding to the terminal identifier, wherein the information sending method corresponding to the terminal identifier includes the SMS method, and the specific information includes text messages.

The OpenURL also carries the URL Schemes field information of the target application and the processing identifier of the target application corresponding to the operation request;

The authentication module 403 is specifically used to: when receiving a resolution request for the OpenURL, wake up the target application according to the URL Schemes field information contained in the OpenURL, wherein the resolution request is sent by the user by clicking the OpenURL in the specific information; send the encrypted identity information and the processing identifier contained in the OpenURL to the awakened target application, so that the target application performs the following operations: obtain the identity information according to the processing identifier, and send the obtained identity information and the encrypted identity information to the server.

The operation request includes a login request;

The device further comprises:

The login module 404 is used to jump to the login success page of the target application after passing the authentication; wherein the login success page is generated by the server according to the terminal identifier and returned to the terminal.

The terminal identification includes a mobile phone number, and the identity information includes at least one of an International Mobile Equipment Identity (IMEI), an International Mobile Subscriber Identity (IMSI), and a Media Access Control (MAC) address;

The information sending mode corresponding to the terminal identifier includes a short message service (SMS) mode, and the specific information includes a short message.

Specifically, the device shown in FIG. 4 may be located on a terminal.

FIG5 is a schematic diagram of the structure of the authentication device provided in an embodiment of the present application, corresponding to FIG2 , specifically including:

The first receiving module 501 is configured to receive an operation request sent by a terminal and carrying terminal identification and identity information for a server of a target application;

A generating module 502 is configured to generate an OpenURL carrying the encrypted identity information of the server according to the identity information;

A returning module 503 is configured to return the OpenURL to the terminal according to the terminal identifier;

A second receiving module 504 is configured to receive the identity information and the encrypted identity information that the terminal obtains through the target application according to the OpenURL and sends to the server;

The authentication module 505 is configured to perform authentication based on the received identity information and the encrypted identity information.

The generation module 502 is specifically used to: combine the terminal identification, the identity information and the current timestamp into a character string, and use a predetermined reversible algorithm to encrypt the character string to generate encrypted identity information; obtain the URL Schemes field information of the target application and the processing identifier corresponding to the operation request according to the target application and the operation request; generate an OpenURL carrying the encrypted identity information, the URL Schemes field information and the processing identifier.

The return module 503 is specifically used to: use the information sending method corresponding to the terminal identifier to return specific information including the OpenURL to the terminal corresponding to the terminal identifier, wherein the information sending method corresponding to the terminal identifier includes the SMS method, and the specific information includes text messages.

The authentication module 505 is specifically used to: use the reversible algorithm to decrypt the received encrypted identity information to obtain the character string; when it is determined that the received identity information is the same as the identity information contained in the character string, and the interval between the timestamp contained in the character string and the current time is not greater than the preset threshold, determine that the authentication is successful; when it is determined that the received identity information is not the same as the identity information contained in the character string, or the interval between the timestamp contained in the character string and the current time is greater than the preset threshold, determine that the authentication is unsuccessful.

The operation request includes a login request;

The device further comprises:

The login module 506 is configured to generate a login success page according to the terminal identifier and return the page to the terminal after determining that the authentication is successful.

The terminal identification includes a mobile phone number, and the identity information includes at least one of an International Mobile Equipment Identity (IMEI), an International Mobile Subscriber Identity (IMSI), and a Media Access Control (MAC) address;

The information sending mode corresponding to the terminal identifier includes a short message service (SMS) mode, and the specific information includes a short message.

Specifically, the device shown in FIG. 5 may be located on a server.

The embodiment of the present application provides an application login method and device, which includes: a terminal sending an operation request carrying a terminal identifier and identity information to a target application's server; receiving an OpenURL returned by the server based on the terminal identifier, wherein the OpenURL carries the encrypted identity information of the server; obtaining the identity information through the target application based on the OpenURL, and sending the obtained identity information and the encrypted identity information to the server, so that the server performs authentication based on the received identity information and the encrypted identity information. Through the above method, a user can trigger the server to perform user authentication by clicking on the OpenURL, which has simple operation steps and high authentication efficiency.

It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

The present invention is described with reference to the flowcharts and/or block diagrams of the methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of processes and/or boxes in the flowchart and/or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims (24)

1. An authentication method, characterized in that it comprises: The terminal sends an operation request carrying the terminal identifier and identity information to the server of the target application; Receive the OpenURL returned by the server based on the terminal identifier, wherein the OpenURL carries the encrypted identity information of the server; The target application is woken up according to the OpenURL, the identity information is obtained through the target application, and the obtained identity information and the encrypted identity information are sent to the server, so that the server can perform authentication based on the received identity information and the encrypted identity information. 2. The method as described in claim 1, characterized in that the terminal sends an operation request carrying terminal identifier and identity information to the server of the target application, specifically including: The terminal receives the terminal identifier input by the user; Identity information is obtained through the target application; Send an operation request carrying the terminal identifier and the identity information to the server of the target application. 3. The method as described in claim 1, characterized in that receiving the OpenURL returned by the server based on the terminal identifier specifically includes: The server receives specific information containing an OpenURL returned to the terminal corresponding to the terminal identifier by the information sending method corresponding to the terminal identifier, wherein the information sending method corresponding to the terminal identifier includes SMS service, and the specific information includes SMS. 4. The method as described in claim 3, wherein the OpenURL further carries the Uniform Resource Locator (URL) Scheme (URL Schemes) field information of the target application and the processing identifier of the target application corresponding to the operation request; Based on the OpenURL, the identity information is obtained through the target application, and the obtained identity information and the encrypted identity information are sent to the server, specifically including: When a parsing request for the OpenURL is received, the target application is activated based on the URL Schemes field information contained in the OpenURL, wherein the parsing request is sent by the user by clicking on the OpenURL in the specific information; The encrypted identity information and the processing identifier contained in the OpenURL are sent to the target application after it is woken up, so that the target application can perform the following operations: obtain the identity information according to the processing identifier, and send the obtained identity information and the encrypted identity information to the server. 5. The method as described in claim 1, wherein the operation request includes a login request; The method further includes: After successful authentication, the user is redirected to the login success page of the target application; wherein the login success page is generated by the server and returned to the terminal based on the terminal identifier. 6. The method according to any one of claims 1 to 5, wherein the terminal identifier includes a mobile phone number, and the identity information includes at least one of International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), and Media Access Control (MAC) address. 7. An authentication method, characterized in that it comprises: The target application's server receives operation requests sent by the terminal, carrying the terminal's identifier and identity information; Based on the identity information, generate an OpenURL that carries the encrypted identity information from the server; The OpenURL is returned to the terminal based on the terminal identifier; The receiving terminal wakes up the target application according to the OpenURL, and obtains and sends the identity information and the encrypted identity information to the server through the target application; Authentication is performed based on the received identity information and the encrypted identity information. 8. The method as described in claim 7, characterized in that, generating an OpenURL carrying the encrypted identity information of the server based on the identity information specifically includes: The terminal identifier, the identity information, and the current timestamp are combined into a string, and the string is encrypted using a predetermined reversible algorithm to generate encrypted identity information. Based on the target application and the operation request, obtain the URLSchemes field information of the target application and the processing identifier corresponding to the operation request; Generate an OpenURL that carries the encrypted identity information, the URL Schemes field information, and the processing identifier. 9. The method as described in claim 7, characterized in that, returning the OpenURL to the terminal according to the terminal identifier specifically includes: Using the information sending method corresponding to the terminal identifier, specific information containing an OpenURL is returned to the terminal corresponding to the terminal identifier, wherein the information sending method corresponding to the terminal identifier includes SMS service, and the specific information includes SMS. 10. The method as described in claim 8, characterized in that, authentication based on the received identity information and the encrypted identity information specifically includes: The received encrypted identity information is decrypted using the reversible algorithm to obtain the string; When it is determined that the received identity information is the same as the identity information contained in the string, and the interval between the timestamp contained in the string and the current time is not greater than a preset threshold, the authentication is determined to be successful; If the received identity information is determined to be different from the identity information contained in the string, or if the interval between the timestamp contained in the string and the current time is greater than a preset threshold, the authentication is determined to fail. 11. The method as described in claim 7, wherein the operation request includes a login request; The method further includes: After confirming that the authentication is successful, a login success page is generated based on the terminal identifier and returned to the terminal. 12. The method according to any one of claims 7 to 11, wherein the terminal identifier includes a mobile phone number, and the identity information includes at least one of International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), and Media Access Control (MAC) address. 13. An authentication device, characterized in that it comprises: The sending module is used to send an operation request carrying the terminal identifier and identity information from the terminal to the server of the target application. The receiving module is configured to receive the OpenURL returned by the server based on the terminal identifier, wherein the OpenURL carries the encrypted identity information of the server; The authentication module is used to wake up the target application according to the OpenURL, obtain the identity information through the target application, and send the obtained identity information and the encrypted identity information to the server, so that the server can perform authentication based on the received identity information and the encrypted identity information. 14. The apparatus of claim 13, wherein the sending module is specifically configured to: receive a terminal identifier input by a user for the terminal; obtain identity information through the target application; and send an operation request carrying the terminal identifier and the identity information to the server of the target application. 15. The apparatus of claim 13, wherein the receiving module is specifically configured to: receive specific information containing an OpenURL returned by the server to the terminal corresponding to the terminal identifier using the information sending method corresponding to the terminal identifier, wherein the information sending method corresponding to the terminal identifier includes SMS service, and the specific information includes SMS. 16. The apparatus of claim 15, wherein the OpenURL further carries the Uniform Resource Locator (URL) Schemes field information of the target application and the processing identifier of the target application corresponding to the operation request; The authentication module is specifically used to: when receiving a parsing request for the OpenURL, wake up the target application based on the URL Schemes field information contained in the OpenURL, wherein the parsing request is sent by the user by clicking the OpenURL in the specific information; send the encrypted identity information and the processing identifier contained in the OpenURL to the woken target application so that the target application can perform the following operations: obtain the identity information according to the processing identifier, and send the obtained identity information and the encrypted identity information to the server. 17. The apparatus of claim 13, wherein the operation request includes a login request; The device further includes: The login module is used to redirect to the login success page of the target application after the authentication is passed; wherein the login success page is generated by the server based on the terminal identifier and returned to the terminal. 18. The apparatus according to any one of claims 13 to 17, wherein the terminal identifier includes a mobile phone number, and the identity information includes at least one of International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), and Media Access Control (MAC) address. 19. An authentication device, characterized in that it comprises: The first receiving module is used to receive operation requests sent by the terminal, carrying terminal identifier and identity information, from the server of the target application. The generation module is used to generate an OpenURL that carries the encrypted identity information of the server, based on the identity information. The return module is used to return the OpenURL to the terminal based on the terminal identifier; The second receiving module is used to receive the identity information and the encrypted identity information obtained by the terminal through the target application after waking up the target application according to the OpenURL and sending it to the server. The authentication module is used to perform authentication based on the received identity information and the encrypted identity information. 20. The apparatus of claim 19, wherein the generation module is specifically configured to: combine the terminal identifier, the identity information, and the current timestamp into a string, and encrypt the string using a predetermined reversible algorithm to generate encrypted identity information; obtain the Uniform Resource Locator (URL) Scheme (URL Schemes) field information of the target application and the processing identifier corresponding to the operation request according to the target application and the operation request; and generate an OpenURL carrying the encrypted identity information, the URL Schemes field information, and the processing identifier. 21. The apparatus of claim 19, wherein the return module is specifically configured to: return specific information containing an OpenURL to the terminal corresponding to the terminal identifier using the information sending method corresponding to the terminal identifier, wherein the information sending method corresponding to the terminal identifier includes SMS service, and the specific information includes SMS. 22. The apparatus of claim 20, wherein the authentication module is specifically configured to: decrypt the received encrypted identity information using the reversible algorithm to obtain the string; determine that authentication is successful when it is determined that the received identity information is the same as the identity information contained in the string and the interval between the timestamp contained in the string and the current time is not greater than a preset threshold; and determine that authentication fails when it is determined that the received identity information is not the same as the identity information contained in the string, or the interval between the timestamp contained in the string and the current time is greater than a preset threshold. 23. The apparatus of claim 19, wherein the operation request includes a login request; The device further includes: The login module is used to generate a login success page and return it to the terminal based on the terminal identifier after confirming that the authentication is successful. 24. The apparatus of claim 21, wherein the terminal identifier includes a mobile phone number, and the identity information includes at least one of International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), and Media Access Control (MAC) address; The information sending method corresponding to the terminal identifier includes SMS service, and the specific information includes SMS.