Abstract:
The present invention relates to the technical field of computer application, and more particularly to a method for allowing user access, a client, a server, and a system, for solving the problem that when a user accesses a server, it cannot be determined whether the user is allowed to continue accessing the server. The method comprises: a server receiving a type identifier and/or server identifier and user identity information sent from a client, for each application accessed by a login user, the client generating a type identifier and/or server identifier corresponding to the application; the server determining the number of type identifiers and/or server identifiers received for the user according to the user identity information, and determining whether to allow access of the user. The method can solve the problem that when a user accesses a server, it is determined whether the user is allowed to continue accessing the server.

Description:
[0001]    This application claims priority from Chinese Patent Application No. 201110393869.3, filed with the Chinese Patent Office on Dec. 1, 2011 and entitled “Method for allowing user access, client, server, and system”, which is hereby incorporated by reference in its entirety. 
       FIELD OF THE INVENTION 
       [0002]    The present invention relates to the technical field of computer application and particularly to a method for allowing user access, client, server and system. 
       BACKGROUND OF THE INVENTION 
       [0003]    At present, Internet has pervaded into daily life of people, and a web operating system is an indispensable application program for people in the process of using the Internet; and the web operating system generally provides the following two approaches for a possible access of a user to a server: 
         [0004]    In a first approach, the user is at a client, i.e., a general PC machine, and can access the server through a browser provided by the web operating system; and 
         [0005]    In a second approach, flexible and diverse client application programs are developed in various mobile terminals via Application Programming Interfaces (APIs). The user accesses the server by way of the client application programs, which are developed via the open APIs and can operate under a variety of operating system environments. These mobile terminals include hand phones, flat panel computers, professional handheld devices and other various types of mobile devices. 
         [0006]    As can be seen, the web operating system has to offer a service in a hybrid of the foregoing two modes to thereby better satisfy demands of numerous users. 
         [0007]    Regardless of whether the user accesses the server through the foregoing access modes on a general PC machine or a mobile terminal, the server has to authenticate and judge user&#39;s identity and usage permission. In the prior art, it is common to authenticate statically the user&#39;s identity and the usage permission of relevant functions available to the user when the user logins to thereby ensure user information of the user to be synchronized and shared across various application scenarios and to judge from the authentication result whether the user has the right to use a specific function. 
         [0008]    However the inventors have found that in the prior art, static authentication is performed only when the user logins, but it is impossible to determine during the access of the user to the server whether the user has the right to use some applications, that is, it is impossible to determine during the access of the user whether the user is allowed to continue accessing the server. 
       SUMMARY OF THE INVENTION 
       [0009]    Embodiments of the invention provide a method for allowing user access so as to solve the problem that it cannot be determined whether the user is allowed to continue accessing during the access of the user to the server. 
         [0010]    A method for allowing user access includes: 
         [0011]    receiving, by a server, type identifiers and/or service identifiers and user identity information of a login user transmitted from a client, wherein the client generates, for each application accessed by the login user, a type identifier and/or a service identifier corresponding to the application, the type identifier is used to identify a type of the application, and the service identifier is used to identify uniquely the application; and 
         [0012]    determining, by the server, the number of the type identifiers and/or the service identifiers received for the login user according to the user identity information, and judging whether the login user is allowed to access from a determination result. 
         [0013]    A system for allowing user access includes: 
         [0014]    a server configured to receive type identifiers and/or service identifiers and user identity information of a login user transmitted from a client, to determine the number of the type identifiers and/or of the service identifiers received for the login user according to the user identity information and to judge whether the login user is allowed to access from a determination result, wherein the type identifier is used to identify a type of an application, and the service identifier is used to identify uniquely the application; and 
         [0015]    the client configured to generate, for each application accessed by the login user, a type identifier and/or a service identifier corresponding to the application. 
         [0016]    A client includes: 
         [0017]    a generating unit configured to generate, for each application accessed by a login user, a type identifier and/or a service identifier corresponding to the application, wherein the type identifier is used to identify a type of the application, and the service identifier is used to identify uniquely the application; and 
         [0018]    a transmitting unit configured to transmit the type identifier and/or the service identifier generated by the generating unit and user identity information to a server. 
         [0019]    A server includes: 
         [0020]    a receiving unit configured to receive type identifiers and/or service identifiers and user identity information of a login user transmitted from a client, wherein the type identifier is used to identify a type of an application, and the service identifier is used to identify uniquely the application; and 
         [0021]    a determining unit configured to determine the number of the type identifiers and/or the service identifiers received for the login user and to judge whether the login user is allowed to access from a determination result. 
         [0022]    Apparently with the embodiments of the invention, it is judged during an access of a user to a server whether to allow the user for a continued access to the server from the number of types of applications accessed and/or the number of applications accessed by the user; and apparently the method can address the problem of judging during the access of the user to the server whether to allow the user for the continued access. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0023]      FIG. 1  is a schematic flow chart of a method for allowing user access according to an embodiment of the invention; 
           [0024]      FIG. 2  is a schematic flow chart of a first method for allowing user access according to an embodiment of the invention; 
           [0025]      FIG. 3  is a schematic flow chart of a second method for allowing user access according to an embodiment of the invention; 
           [0026]      FIG. 4  is a schematic flow chart of a third method for allowing user access according to an embodiment of the invention; 
           [0027]      FIG. 5  is a schematic structural diagram of a system for allowing user access according to an embodiment of the invention; 
           [0028]      FIG. 6  is a schematic structural diagram of a client according to an embodiment of the invention; and 
           [0029]      FIG. 7  is a schematic structural diagram of a server according to an embodiment of the invention. 
       
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
       [0030]    An embodiment of the invention provides a method for allowing user access, which is used to judge during an access of a user to a server whether to allow the user for a continued access to the server according to the number of types of applications accessed and/or the number of applications accessed by the user; and as illustrated in  FIG. 1 , a particular process is as follows: 
         [0031]    In step  11 , a server receives type identifiers and/or service identifiers and user identity information of a login user transmitted from a client, wherein the client generates, for each application accessed by the login user, a type identifier and/or a service identifier corresponding to the application, the type identifier is used to identify a type of the application, and the service identifier is used to identify uniquely the application; and 
         [0032]    In step  12 , the server determines the number of the type identifiers and/or the service identifiers received for the login user according to the user identity information and judges whether the login user is allowed to access from a determination result. 
         [0033]    Specifically, in the step  12 , judging whether the login user is allowed to access from the determination result includes: 
         [0034]    Judging whether the total number of the type identifiers received for the user is greater than the preset number of types, and if not so, then allowing the login user to access; or judging whether the total number of the service identifiers received for the user is greater than the preset total number of services, and if not so, then allowing the login user to access; or judging whether the sum of the numbers of the type identifiers and of the service identifiers received for the user is greater than the preset total number of accesses, and if not so, then allowing the login user to access. 
         [0035]    Preferably, in order to reduce operations at the server side, between the step  11  and the step  12 , it can be further included that the client reserves one of a plurality of identical type identifiers generated. 
         [0036]    Preferably, in order to facilitate judging whether the current login user is a legal user, it can be further included before the step  11  that the client generates account information for the login user, where the account information identifies the user identity; and at this time, specifically in the step  12 , the client transmits the generated type identifiers and/or service identifiers, the account information and the user identity information to the server. 
         [0037]    Preferably, in order to judge more accurately whether the current login user is a legal user, after the client transmits the generated type identifiers and/or service identifiers and account information to the server, and before the server determines the number of the type identifiers and/or the service identifiers received for the login user according to the user identity information, it is further included that the server judges whether the received account information is valid from a preset login condition; and at this time, the determination process is performed upon judging that the account information is valid. 
         [0038]    Preferably, in order to simplify the operation of verifying the same user for legality when the use accesses the server at different times, after the user logins initially and the server determines that the user can continue accessing an application, the server generates a token according to the received type identifiers and/or service identifiers and account information of the user, determines a period of validity of the token, and transmits the token to the client. When this user logins the server again at another time, the use transmits the token to the server while accessing the server, and the server allows the user for a continued access upon determining that the received token does not expire. Apparently the process of and the period of time for verifying the user identity for legality can be shortened greatly. 
         [0039]    An introduction will be made below in particular embodiments. 
       First Embodiment 
       [0040]    The first embodiment of the invention provides a first method for allowing user access, and as illustrated in  FIG. 2 , a specific process is as follows: 
         [0041]    In step  201 , a client assigns a type identifier to each application currently accessed by a login user as well as user identity information of the login user, where the login user will be referred simply to as a user hereinafter, and the type identifier identifies the type of the application; 
         [0042]    In step  202 , the client transmits the generated type identifiers and user identity information to a server; 
         [0043]    In step  203 , the server judges whether the total number of the type identifiers received for the user is greater than the preset number of types from the user identity information, and if not so, then the process turns to step  204 , otherwise the user is prohibited for a continued access; and 
         [0044]    In the step  204 , the user is allowed for a continued access. 
       Second Embodiment 
       [0045]    The second embodiment of the invention provides a second method for allowing user access, and as illustrated in  FIG. 3 , a specific process is as follows: 
         [0046]    In step  301 , a client assigns a service identifier to each application currently accessed by a login user as well as user identity information of the login user, where the service identifier identifies uniquely the application, and the login user will be referred simply to as a user hereinafter; 
         [0047]    In step  302 , the client transmits the generated service identifiers and user identity information to a server; 
         [0048]    In step  303 , the server judges whether the total number of service identifiers received for the user is greater than the preset total number of services from the user identity information, and if not so, then the process turns to step  304 , otherwise the user is prohibited for a continued access; and 
         [0049]    In the step  304 , the user is allowed for a continued access. 
       Third Embodiment 
       [0050]    The third embodiment of the invention provides a third method for allowing user access, and as illustrated in  FIG. 4 , a specific process is as follows: 
         [0051]    In step  401 , a client assigns a service identifier and a type identifier to each application currently accessed by a login user as well as user identity information of the login user, where the login user will be referred simply to as a user hereinafter; 
         [0052]    In step  402 , the client transmits the generated service identifiers, type identifiers and user identity information to a server; 
         [0053]    In step  403 , the server judges whether the total number of service identifiers received for the user is greater than the preset total number of services from the user identity information, and if not so, then the process turns to step  404 , otherwise the user is prohibited for a continued access; or the server judges whether the total number of received type identifiers is greater than the preset number of types, and if not so, then the process turns to step  404 , otherwise the user is prohibited for a continued access; or the server judges whether the sum of the number of received type identifiers and the number of received service identifiers is greater than the preset number of accesses, and if not so, then the process turns to step  404 , otherwise the user is prohibited for a continued access; and 
         [0054]    In the step  404 , the user is allowed for a continued access. 
         [0055]    Preferably, in order to judge more accurately whether the user has an access privilege, in the step  201 , the step  301  or the step  401 , the client can further generate account information for the login user; then in the step  202 , the step  302  or the step  402 , the client will further transmit the account information to the server; and after the step  202 , the step  302  or the step  402  and before the step  203 , the step  303  or the step  403 , it is further included that upon reception of the account information, the server firstly judges from the account information whether the login user corresponding to the account information has an access privilege, and if so, then the process proceeds to the step  203 , the step  303  or the step  403 ; otherwise it is determined that the user has no access privilege, that is, the user is prohibited for a continued access. 
         [0056]    Preferably, in order to simplify the operations of the server, after the step  201  or the step  401  and before the step  202  or the step  402 , the client can reserve one of a plurality of identical type identifiers generated; and in the step  202  or the step  402 , the client transmits the simplified type identifier to the server. 
         [0057]    Preferably, in order to simplify the operations of the server to verify the same user for legality each time the user accesses the server repeatedly in different periods of time, after the step of allowing the user for an access in all the foregoing embodiments, the server can generate a token according to the account information, the type identifiers and the service identifiers, set a period of validity for the token and transmit the generated token to the client. When the user accesses the server again, the client transmits the token corresponding to the user directly to the server, and the server determines that the client has an access privilege according to the token. When the user logouts of the server actively or the token expires, the server considers that the user has no access qualification; and the server can also transmit an access prohibition token to the client when the server does not allow the user to access. 
         [0058]    Preferably in the foregoing embodiments, the number of types, the number of accesses and the total number of services can be set to be different according to different account information, or the number of types, the number of accesses and the total number of services can be set to be the same. 
         [0059]    Preferably in the foregoing embodiments, the client can assign a type identifier to an application as follows: 
         [0060]    When the user accesses the server via a PC browser, the same type identifier can be assigned to all the accessed applications; or when the user accesses the server via an API interface of the client, a different type identifier can be assigned to each accessed application. 
         [0061]    Preferably in the foregoing embodiments, the client can further assign a service identifier to an application as follows: 
         [0062]    When the user accesses a plurality of applications of the server through the same client, for each application, a service identifier, which is different from that of any other application, is generated; or when the user accesses the server through a PC browser of the client, a service identifier is generated each time a new session status connection is set up with the server. 
         [0063]    As illustrated in  FIG. 5 , an embodiment of the invention provides a system for allowing user access, which includes: 
         [0064]    A server  52  configured to receive type identifiers and/or service identifiers and user identity information of a login user transmitted from a client, to determine the number of the type identifiers and/or of the service identifiers received for the login user according to the user identity information and to judge whether the login user is allowed to access from a determination result, wherein the type identifier is used to identify a type of an application, and the service identifier is used to identify uniquely the application; and 
         [0065]    The client  51  configured to generate, for each application accessed by the login user, a type identifier and/or a service identifier corresponding to the application. 
         [0066]    The client  51  is further configured: 
         [0067]    to reserve one of a plurality of identical type identifiers generated. 
         [0068]    The client  51  is further configured: 
         [0069]    to generate account information for the login user and to transmit the generated type identifiers and/or service identifiers and account information to the server  52 , where the account information identifies the user identity. 
         [0070]    The server  52  is further configured: 
         [0071]    to judge whether the account information is valid from a preset login condition, and to determine the number of the type identifiers and/or the service identifiers received for the login user according to the user identity information upon determining that the account information is valid. 
         [0072]    The server  52  is further configured: 
         [0073]    to generate a token according to the received type identifiers and/or service identifiers and account information, to determine a period of validity of the token and to transmit the token to the client  51 . 
         [0074]    As illustrated in  FIG. 6 , an embodiment of the invention further provides a client, which includes: 
         [0075]    A generating unit  61  configured to generate, for each application accessed by a login user, a type identifier and/or a service identifier corresponding to the application, wherein the type identifier is used to identify a type of the application, and the service identifier is used to identify uniquely the application; and 
         [0076]    A transmitting unit  63  configured to transmit the type identifier and/or the service identifier generated by the generating unit  61  and user identity information to a server. 
         [0077]    The client further includes: 
         [0078]    A reserving unit  62  configured to reserve one of a plurality of identical type identifiers generated by the generating unit  61 . 
         [0079]    The generating unit  61  is further configured to generate account information for the login user, where the account information identifies the user identity; and 
         [0080]    The transmitting unit  63  is specifically configured to transmit the type identifiers and/or the service identifiers and account information generated by the generating unit  61  to the server. 
         [0081]    As illustrated in  FIG. 7 , an embodiment of the invention further provides a server, which includes: 
         [0082]    A receiving unit  71  configured to receive type identifiers and/or service identifiers and user identity information of a login user transmitted from a client, wherein the type identifier is used to identify a type of an application, and the service identifier is used to identify uniquely the application; and 
         [0083]    A determining unit  73  configured to determine the number of the type identifiers and/or the service identifiers received for the login user and to judge whether the login user is allowed to access from a determination result. 
         [0084]    The receiving unit  71  is further configured to receive account information, transmitted from the client, generated for the login user, where the account information identifies an identity of the login user. 
         [0085]    The server further includes: 
         [0086]    An account judging unit  72  configured to judge whether the account information is valid according to a preset login condition; and 
         [0087]    The determining and judging unit  73  is further configured to make the determination for the received type identifiers and/or service identifiers when the account judging unit  72  judges that the account information is valid. 
         [0088]    The server  52  further includes: 
         [0089]    A first generating unit  74  configured to generate a token according to the type identifiers and/or the service identifiers and the account information received by the receiving unit  71 , to determine a period of validity of the token and to transmit the token to the client. 
         [0090]    In summary, advantageous effects are as follows: 
         [0091]    With the methods according to the embodiments of the invention, it is judged during an access of a user to a server whether to allow the user for a continued access to the server according to the number of types of applications accessed and/or the total number of applications accessed by the user or the sum of the number of types of accessed applications and the total number of accessed applications; and apparently the method can address the problem of judging during the access of the user to the server whether to allow the user for a continued access. 
         [0092]    Those skilled in the art shall appreciate that the embodiments of the invention can be embodied as a method, a system or a computer program product. Therefore the invention can be embodied in the form of an all-hardware embodiment, an all-software embodiment or an embodiment of software and hardware in combination. Furthermore, the invention can be embodied in the form of a computer program product embodied in one or more computer useable storage mediums (including but not limited to a disk memory, a CD-ROM, an optical memory, etc.) in which computer useable program codes are contained. 
         [0093]    The invention has been described with reference to flow charts and/or block diagrams of the method, the device (system) and the computer program product according to the embodiments of the invention. It shall be appreciated that respective flows and/or blocks in the flow charts and/or the block diagrams and combinations of the flows and/or the blocks in the flow charts and/or the block diagrams can be embodied in computer program instructions. These computer program instructions can be loaded onto a general-purpose computer, a specific-purpose computer, an embedded processor or a processor of another programmable data processing device to produce a machine so that the instructions executed on the computer or the processor of the other programmable data processing device create means for performing the functions specified in the flow(s) of the flow charts and/or the block(s) of the block diagrams. 
         [0094]    These computer program instructions can also be stored into a computer readable memory capable of directing the computer or the other programmable data processing device to operate in a specific manner so that the instructions stored in the computer readable memory create manufactures including instruction means which perform the functions specified in the flow(s) of the flow charts and/or the block(s) of the block diagrams. 
         [0095]    These computer program instructions can also be loaded onto the computer or the other programmable data processing device so that a series of operational steps are performed on the computer or the other programmable data processing device to create a computer implemented process so that the instructions executed on the computer or the other programmable device provide steps for performing the functions specified in the flow(s) of the flow charts and/or the block(s) of the block diagrams. 
         [0096]    Although the preferred embodiments of the invention have been described, those skilled in the art benefiting from the underlying inventive concept can make additional modifications and variations to these embodiments. Therefore the appended claims are intended to be construed as encompassing the preferred embodiments and all the modifications and variations coming into the scope of the invention. 
         [0097]    Evidently those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus the invention is also intended to encompass these modifications and variations thereto so long as these modifications and variations come into the scope of the claims appended to the invention and their equivalents.