Patent Description:
With the development of Internet technologies, more and more users use instant messaging applications to conduct social activities such as chatting with relatives and friends. When using these applications, users may access third-party applications in these applications to perform operations such as viewing data, browsing news, or shopping.

Often, a user accesses a third-party application in an application by authorizing the third-party application. However, in the conventional method for accessing an application, when the third-party application is not authorized to access the application, data of the user may be maliciously pulled by implanting a virus to access the third-party application in the application, which decreases the security of accessing the application. <CIT> at best discloses a high-security authentication method and system, and provides a third-party application message authentication method and system based on a secure channel. The method comprises the following steps: establishing connection between a third-party application server and a social application server through a social application; the social application receiving a registration request of a user for registering a third-party application; sending the registration request to the social application server through the social application; the social application server receiving the registration request, parsing the registration request to form a new request and then sending the new request to the third-party application server; the third-party application server, in response to a new standard request, according to a preset secret key, a long shaping time stamp and a user identification, performing Hash algorithm to generate a first token, and returning the first token, the long shaping time stamp, the user identification and a response result to the social application server; the social application server, according to the content returned by the third-party application server, generating visualized content for sending to the social application for displaying; and the social application receiving click operation of the user on the visualized content so as to finish authentication. <CIT> at best discloses a webpage application access method and device and a storage medium. The method comprises the following steps of: operating a webpage application corresponding to an application account number of a public platform in a browser, and simulating a host environment operated at a social network client for the webpage application in the browser; calling the social network client to load an authorization webpage returned by a social network background and obtaining an authorization code returned by the social network background; obtaining identity information, in a social network, of a user from the social network background through an application account number background on the basis of the authorization code, and redirecting the webpage application to a callback page and carrying out login via the identity information; and loading an interface with a terminal function and a social network client function in the webpage application, using the terminal function and/or the social network client function through an interface calling manner and loading an interface calling result in the webpage application. By implementing the method, webpage applications can be accessed in browsers to realize webpage authorization and businesses of the webpage applications can be realized. <CIT> at best discloses an application program authorization method includes: when a first application on a terminal is logged into, sending, by the terminal to a first application server by using the first application, a first request message used for negotiating a token binding identifier of the first application; receiving, by the terminal, a first response message including generation information of the token binding identifier from the first application server; generating, by the terminal, the token binding identifier based on the generation information of the token binding identifier, and sending the token binding identifier to the first application server; and when the at least one second application on the terminal logs in by using the first application, sending, by the terminal to the first application server, a second request message, where the second request message includes the token binding identifier.

According to various embodiments provided in this application, a method for accessing an application and apparatus, an electronic device, and a storage medium are provided.

A method for accessing an application is provided, performed by a server, the method including:.

An apparatus for accessing an application is provided, including:.

A non- transitory storage medium storing computer-readable instructions is provided, the computer-readable instructions, when executed by one or more processors, causing the one or more processors to perform the steps of the application access method.

Details of one or more embodiments of this application are provided in the accompanying drawings and descriptions below. Other features, objectives, and advantages of this application become apparent from the specification, the drawings, and the claims.

To describe the technical solutions in the embodiments of this application more clearly, the following briefly describes the accompanying drawings required for describing the embodiments. Apparently, the accompanying drawings in the following description show merely some embodiments of this application, and a person skilled in the art may still derive other drawings from these accompanying drawings without creative efforts.

The technical solutions in the embodiments of this application are clearly and completely described below with reference to the accompanying drawings in the embodiments of this application. Apparently, the described embodiments are merely some rather than all of the embodiments of this application. All other embodiments obtained by a person skilled in the art based on the embodiments of this application without creative efforts shall fall within the protection scope of this application.

An embodiment of this application provides an application access system, and the application access system may include a terminal and a server. An apparatus for accessing application may be specifically integrated in the server. The server may be an independent physical server, or may be a server cluster including a plurality of physical servers or a distributed system, or may be a cloud server providing basic cloud computing services, such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a network service, cloud communication, a middleware service, a domain name service, a security service, a content delivery network (CDN), big data, and an artificial intelligence (AI) platform. The terminal may be a smartphone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smartwatch, or the like, but is not limited thereto. The terminal and the server may be directly or indirectly connected in a wired or wireless communication manner. This is not limited in this application.

For example, referring to <FIG>, the application access apparatus is integrated on the server, and a user may start an application A of instant messaging. If the user wants to access a third-party application through the application A, for example, access an applet B, the server may obtain an application access request of the user for the application A, where the application access request carries a user identifier and the application that is to be accessed (the applet B). The server may then acquire an encryption key, and encrypt the user identifier by using the encryption key, to obtain an encrypted user identifier, the encryption key carrying first key information and second key information. Next, the server may generate an authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information; transmit the authorization credential to the application that is to be accessed, so that the application that is to be accessed generates an authorization request based on the authorization credential; receive the authorization request returned by the application that is to be accessed; detecting the authorization request; and access, when a detection result satisfies a preset condition, the application that is to be accessed based on the detection result and the second key information.

In this solution, after the user identifier is encrypted, the first key information is used as a part of the authorization credential and transmitted to the application that is to be accessed, so that the application that is to be accessed generates the authorization request based on the authorization credential. The authorization request returned by the application that is to be accessed is then received. The authorization request is detected, and when the detection result satisfies the preset condition, the application that is to be accessed is accessed based on the detection result and the second key information. In other words, whether the third-party application is accessed is determined according to the detection result. In addition, when the third-party application is accessed, the encrypted user identifier needs to be decrypted by using the first key information and the second key information. If the third-party application is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access.

Detailed descriptions are separately provided below. A description order of the following embodiments is not construed as a limitation on a preferred order of the embodiments.

A method for accessing an application is provided, including: obtaining an application access request; acquiring an encryption key, and encrypting the user identifier by using the encryption key, to obtain an encrypted user identifier; generating an authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information; transmitting the authorization credential to a application that is to be accessed, so that the application that is to be accessed generates an authorization request based on the authorization credential; receiving the authorization request returned by the application that is to be accessed; and accessing, when a detection result of the authorization request satisfies a preset condition, the application that is to be accessed based on the detection result and the second key information.

<FIG> is a schematic flowchart of a method for accessing an application according to an embodiment of this application. This embodiment is mainly described using an example in which the method is applied to an electronic device. The electronic device may be specifically a server. A specific process of the method for accessing an application may be as follows:
<NUM>: Obtain an application access request.

The application access request carries a user identifier and an application identifier. An application corresponding to the application identifier is an application that is to be accessed, and the application access request may be triggered by the user. For example, the user clicks on a link, and the link may start a application that is to be accessed. The user identifier may include an account and an avatar of the user, or the like.

<NUM>: Acquire an encryption key for encrypting the user identifier, to obtain an encrypted user identifier.

To ensure the security of user data, the electronic device may encrypt the user identifier. The encryption key carries first key information and second key information. In this embodiment of this application, the application that is to be accessed may be accessed based on an Open Authorization (OAuth) protocol. The OAuth protocol is described herein. The OAuth protocol provides a secure, open, and simple standard for the authorization of a user resource. Different from the conventional authorization method, the authorization of OAuth does not allow a third-party application (a application that is to be accessed) to touch account information (for example, a user name and a password) of the user, that is, the third-party application can request for authorization of the user resource without using the user name of the user and the password. The architecture of the OAuth protocol is shown in <FIG>. A resource owner refers to the user. An authorization server is a server specially used by the service provider to process authorization and store resources generated by the user. The authorization server may be the same as or different from an authentication server. After receiving a method for permission granting, the third-party application obtains an access token from the authorization server according to the permission granting method. The third-party application then obtains a protected resource (for example, the user name of the user) corresponding to the authorization request from the resource server according to the obtained access token. Further, referring to <FIG>, when the user accesses the third-party application through instant messaging software, the third-party application applies to the server to access the user resource, and the authorization server returns an authorization address to the third-party application. When the third-party application receives an authorization code returned by the server, an application identifier and the authorization code of the third-party application are transmitted to the server, so that the server verifies the authorization code and returns the authorization code to the third-party application. The third-party application then accesses user information based on the access token. After the verification of the access token by the server succeeds, the third-party application receives the resource authorized by the user through an external interface. Specifically, to ensure the security of user data, the user identifier may be encrypted by using the encryption key. The first key information and the second key information are different, and the encryption key may be calculated based on an encryption algorithm, the first key information, and the second key information.

In some embodiments, before the step of "acquiring an encryption key", the method may further include:.

For example, the electronic device may obtain an encryption algorithm and <NUM> different key information from a local database; randomly select two pieces of key information from the <NUM> different key information, to obtain the first key information and the second key information; and finally, calculate the encryption key for encryption based on the encryption algorithm, the first key information, and the second key information.

<NUM>: Generate an authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information.

For example, specifically, the electronic device may generate, based on the encrypted user identifier, authorization information used for accessing the application that is to be accessed; and generate the authorization credential corresponding to the application access request by using the authorization information and the first key information.

In some embodiments, the step of "generating an authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information" may further include:.

In this embodiment, the electronic device may add the first key information to the authorization information, to obtain the authorization credential corresponding to the application access request. In other words, even if the application that is to be accessed is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access.

<NUM>: Transmit the authorization credential to the application that is to be accessed, in order to enable the application that is to be accessed generate an authorization request based on the authorization credential.

The electronic device may transmit the authorization credential to a application that is to be accessed based on a transmission protocol, so that the application that is to be accessed generates an authorization request based on the authorization credential. The transmission protocol may include a socket transmission protocol, a world wide web transmission protocol, and a hypertext transmission protocol, depending on the actual situation. In the process of transmitting the authorization credential to the application that is to be accessed, the authorization credential carries the first key information. In addition, the electronic device retains the second key information in a local database. The local database may be an encrypted local database. In other words, even if criminals obtain the first key information through unauthorized means, they cannot decrypt the encrypted user identifier. Moreover, the second key information is stored in the encrypted local database, which further improves the security of user privacy, thereby improving the security of application access.

<NUM>: Receive the authorization request returned by the application that is to be accessed.

<NUM>: Access, when a detection result of the authorization request satisfies a preset condition, the application that is to be accessed based on the detection result and the second key information.

For example, specifically, the electronic device may detect the authorization request, and when a detection result satisfies a preset condition, the electronic device may obtain the first key information from the application that is to be accessed, and then access the application that is to be accessed based on the detection result, the first key information, and the second key information.

In some embodiments, the step of "accessing, when a detection result satisfies a preset condition, the application that is to be accessed based on the detection result and the second key information" may further include:.

For example, specifically, the electronic device may detect a type of the application that is to be accessed based on the authorization request; determine that the detection result satisfies the preset condition when the type of the application that is to be accessed is an authorized application type; and then access the application that is to be accessed based on the detection result and the second key information.

In some embodiments, the step of "accessing, when a detection result satisfies a preset condition, the application that is to be accessed based on the detection result and the second key information" includes:.

For example, specifically, after obtaining the application identifier of the application that is to be accessed, the electronic device may query whether the application identifier has corresponding authentication information in the local database. When the application identifier has corresponding authentication information in the local database, it is determined that the application that is to be accessed is an authorized application, that is, the detection result satisfies the preset condition. In this case, the first key information may be obtained from the application that is to be accessed, and the application that is to be accessed may be accessed based on the second key information and the detection result.

In some embodiments, the step of "accessing the application that is to be accessed according to the detection result, the first key information, and the second key information" includes:.

In this application, the encryption key may be calculated by using the first key information and the second key information. It may be understood that this application uses a symmetric encryption method. In a symmetric encryption algorithm, a data sender processes a plaintext (the user identifier) and the encryption key by using a special encryption algorithm to obtain a complex encrypted ciphertext (the encrypted user identifier) and transmit the encrypted ciphertext. After receiving the ciphertext, to interpret the original text, a recipient (the third-party application) needs to decrypt the ciphertext using the encryption key and an inverse algorithm of the same algorithm, to restore the ciphertext to a readable plaintext. In the symmetric encryption algorithm, only one key is used, and both the sender and the receiver use this key to encrypt and decrypt data, which requires the decryption party to learn of the encryption key in advance. In this application, after the user identifier is encrypted, the encrypted user identifier and the first key information in the encryption process are transmitted to the application that is to be accessed. That is, partial key information of the encryption key is transmitted to the application that is to be accessed. If the application that is to be accessed is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access.

Further, the electronic device may extract the encrypted user identifier and the authorization credential from the detection result, and decrypt the encrypted user identifier according to the encryption key. Specifically, the electronic device may decrypt the encrypted user identifier using the encryption key and the inverse algorithm of the algorithm used during the encryption; and finally, access the application that is to be accessed based on a decryption result and the authorization credential.

In some embodiments, the step of "accessing the application that is to be accessed according to the encryption key and the detection result" may further include:.

The decryption result may be the user identifier. A resource node for authorized data is determined based on the user identifier and the authorization credential, such as a resource node for avatar data, a resource node for nickname data and/or a resource node for mobile phone number data. The resource node verifies the authorization credential based on an authentication algorithm, and verifies whether requested access content matches authorization information in the authorization credential. If the access content matches the authorization information in the authorization credential, the application that is to be accessed is accessed.

The type of the application that is to be accessed is detected based on the authorization request. It is determined that the detection result does not satisfy the preset condition when the type of the application that is to be accessed is not an authorized application type. In this case, the application that is to be accessed is not accessed.

In some embodiments, the application access method provided in this application may further include: skipping accessing the application that is to be accessed when the detection result does not satisfy the preset condition.

According to this embodiment of this application, an application access request is first obtained, the application access request carrying a user identifier and a application that is to be accessed. An encryption key is acquired, and the user identifier is encrypted by using the encryption key, to obtain an encrypted user identifier, the encryption key carrying first key information and second key information. An authorization credential corresponding to the application access request is generated according to the encrypted user identifier and the first key information. The authorization credential is then transmitted to the application that is to be accessed, so that the application that is to be accessed generates an authorization request based on the authorization credential. Next, the authorization request returned by the application that is to be accessed is received. Finally, the authorization request is detected, and when a detection result satisfies a preset condition, the application that is to be accessed is accessed based on the detection result and the second key information. In this solution, after the user identifier is encrypted, the first key information is used as a part of the authorization credential and transmitted to the application that is to be accessed, so that the application that is to be accessed generates the authorization request based on the authorization credential. The authorization request returned by the application that is to be accessed is then received. The authorization request is detected, and when the detection result satisfies the preset condition, the application that is to be accessed is accessed based on the detection result and the second key information. In other words, whether the third-party application is accessed is determined according to the detection result. In addition, when the third-party application is accessed, the encrypted user identifier needs to be decrypted by using the first key information and the second key information. If the third-party application is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access.

According to the method described in the embodiments, the following further provides detailed descriptions by using examples.

In this embodiment, a description is made by taking an example in which the application access apparatus is specifically integrated in a server.

Referring to <FIG>, a specific process of an application access method may be as follows:
<NUM>: A server obtains an application access request.

The application access request carries a user identifier and an application identifier, and the application access request may be triggered by the user. For example, a page of an application A is displayed on a display screen of a terminal. The page includes a control key for jumping to a third-party application (that is, a application that is to be accessed). When the user clicks on the control key, the server may obtain an application access request triggered by the user.

<NUM>: The server acquires an encryption key, and encrypt the user identifier by using the encryption key, to obtain an encrypted user identifier.

The encryption key carries first key information and second key information. Specifically, the server may encrypt the user identifier by using the encryption key, and then perform step <NUM>.

<NUM>: The server generates an authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information.

Specifically, the server generates, based on the encrypted user identifier, authorization information used for accessing the application that is to be accessed; and generates the authorization credential corresponding to the application access request by using the authorization information and the first key information.

In this embodiment, the server may add the first key information to the authorization information, to obtain the authorization credential corresponding to the application access request. In other words, even if the application that is to be accessed is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access. In addition, the first key information may be further used as an access parameter to call a corresponding application interface.

<NUM>: The server transmits the authorization credential to an application that is to be accessed, so that the application that is to be accessed generates an authorization request based on the authorization credential.

<NUM>: The server receives the authorization request returned by the application that is to be accessed.

<NUM>: The server detects the authorization request, and accesses, when a detection result satisfies a preset condition, the application that is to be accessed based on the detection result and the second key information.

For example, specifically, the server may detect a type of the application that is to be accessed based on the authorization request; and determine that the detection result satisfies the preset condition when the type of the application that is to be accessed is an authorized application type. The server then extracts the encrypted user identifier and the authorization credential from the detection result, and decrypts the encrypted user identifier according to the encryption key. Specifically, the server may decrypt the encrypted user identifier using the encryption key and the inverse algorithm of the algorithm used during the encryption; and finally, access the application that is to be accessed based on a decryption result and the authorization credential.

The server according to this embodiment of this application first obtains an application access request, the application access request carrying a user identifier and a application that is to be accessed. The server acquires an encryption key, and encrypts the user identifier by using the encryption key, to obtain an encrypted user identifier. The server generates an authorization credential corresponding to the application access request according to the encrypted user identifier and first key information. The server then transmits the authorization credential to the application that is to be accessed, so that the application that is to be accessed generates an authorization request based on the authorization credential. Next, the server receives the authorization request returned by the application that is to be accessed. Finally, the server detects the authorization request, and accesses, when a detection result satisfies a preset condition, the application that is to be accessed based on the detection result and second key information. In this solution, after the user identifier is encrypted, the first key information is used as a part of the authorization credential and transmitted to the application that is to be accessed, so that the application that is to be accessed generates the authorization request based on the authorization credential. The authorization request returned by the application that is to be accessed is then received. The authorization request is detected, and when the detection result satisfies the preset condition, the application that is to be accessed is accessed based on the detection result and the second key information. In other words, whether the third-party application is accessed is determined according to the detection result. In addition, when the third-party application is accessed, the encrypted user identifier needs to be decrypted by using the first key information and the second key information. If the third-party application is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access.

To facilitate the understanding of the method for accessing an application provided in the embodiments of this application, referring to <FIG>, an example is used in which the user calls the third-party application through an instant messaging application (an application for short below). A server of the application obtains the application access request triggered by the user, and the specific process is as follows:
In a user authorization stage, the server generates first key information a and second key information b. The server calculates the first key information a, the second key information b, and a digest algorithm according to the algorithm to obtain the encryption key. The server then encrypts the user identifier based on the encryption key, and generates the authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information a. The server then transmits the authorization credential to a third-party application, so that the third-party application generates an authorization request based on the authorization credential. In the user authorization stage, since the server transmits the first key information a to the third-party application, and the server saves the second key information b locally, this design avoids the security risks caused by directly handing the authorization credential to the third party, and enhances the storage security. For example, malicious access by internal employees can be avoided. In the stage of accessing the user data by the third-party application, the server needs to verify the application that is to be accessed. When a verification result indicates that the application that is to be accessed is an authorized application, the server provides the second key information b, and calculates the encryption key based on the first key information a and the second key information b. The server then decrypts the encrypted user identifier by using the encryption key and the inverse algorithm of the algorithm used during the encryption. Finally, the server accesses the third-party application based on a decryption result and the authorization credential. The authorization credential and the application identifier of the third-party application flow with the authorization request, and the server determines the resource node to be accessed according to the authorization credential in the authorization request and the user identifier. For example, the user identifier carries the avatar data and the nickname data of the user, and the server may access the resource nodes for the avatar data and the nickname data according to the user identifier. Since the user identifier does not carry the mobile phone number data of the user, the server cannot access the resource node bound with the mobile phone number data according to the user identifier, as shown in <FIG>.

In an access control stage, the server performs authentication and verification on the authorization request, checks whether the data currently accessed is authorized by the user, and rejects the request if unauthorized data access is found. In other words, whether the third-party application is accessed is determined according to the detection result. In addition, when the third-party application is accessed, the encrypted user identifier needs to be decrypted by using the first key information and the second key information. If the third-party application is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access.

Although the steps in the flowcharts of the embodiments are displayed sequentially according to instructions of arrows, these steps are not necessarily performed sequentially according to a sequence instructed by the arrows. Unless otherwise explicitly specified in this specification, execution of the steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps in the foregoing embodiments may include a plurality of sub-steps or a plurality of stages. The sub-steps or the stages are not necessarily performed at the same moment, but may be performed at different moments. The sub-steps or the stages are not necessarily performed in sequence, but may be performed in turn or alternately with another step or at least some of sub-steps or stages of the another step.

To better implement the method for accessing an application provided in the embodiments of this application, an embodiment of this application further provides an application access apparatus (an access apparatus for short) based on the foregoing method for accessing an application. Terms have meanings the same as those in the foregoing method for accessing an application, and for specific implementation details, reference may be made to the description in the method embodiments.

<FIG> is a schematic structural diagram of an application access apparatus according to an embodiment of this application. The application access apparatus includes an obtaining module <NUM>, an acquisition module <NUM>, a generation module <NUM>, a transmission module <NUM>, a receiving module <NUM>, and an access module <NUM>. The modules included in the application access apparatus may all or partially be implemented by software, hardware, or a combination thereof.

The obtaining module <NUM> is configured to obtain an application access request.

The application access request carries a user identifier and an application identifier. The application access request may be triggered by the user. For example, the user clicks on a link, and the link may start a application that is to be accessed. The user identifier may include an account and an avatar of the user, or the like.

The acquisition module <NUM> is configured to acquire an encryption key, and encrypt the user identifier by using the encryption key, to obtain an encrypted user identifier.

To ensure the security of user data, the acquisition module <NUM> may encrypt the user identifier, where the encryption key carries first key information and second key information. The first key information and the second key information are different, and the encryption key may be calculated based on an encryption algorithm, the first key information, and the second key information.

In some embodiments, referring to <FIG>, the access apparatus may further include a construction module <NUM>. The construction module <NUM> is further configured to: obtain an encryption algorithm and a plurality of pieces of key information; select two pieces of key information from the plurality of pieces of key information, to obtain the first key information and the second key information; and construct the encryption key for encryption based on the encryption algorithm, the first key information, and the second key information.

The generation module <NUM> is configured to encrypt the user identifier, and generate an authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information.

For example, specifically, the generation module <NUM> may encrypt the user identifier by using the encryption key. The generation module <NUM> then generates, based on the encrypted user identifier, authorization information used for accessing the application that is to be accessed. Finally, the generation module <NUM> generates the authorization credential corresponding to the application access request by using the authorization information and the first key information.

In some embodiments, the generation module <NUM> may be further configured to: generate, based on the encrypted user identifier, authorization information used for accessing the application that is to be accessed; and generate the authorization credential corresponding to the application access request by using the authorization information and the first key information.

In this embodiment, the first key information may be added to the authorization information, to obtain the authorization credential corresponding to the application access request. In other words, even if the application that is to be accessed is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access.

The transmission module <NUM> is configured to transmit the authorization credential to a application that is to be accessed corresponding to the application identifier, so that the application that is to be accessed generates an authorization request based on the authorization credential.

The receiving module <NUM> is configured to receive the authorization request returned by the application that is to be accessed.

The access module <NUM> is configured to access, when a detection result of the authorization request satisfies a preset condition, the application that is to be accessed based on the detection result and the second key information.

In some embodiments, referring to <FIG>, the access apparatus may further include a detection module <NUM>, configured to detect the authorization request.

For example, specifically, a type to which the application that is to be accessed belongs may be detected based on the authorization request.

In some embodiments, the access module <NUM> may further include: an obtaining unit, configured to obtain the first key information from the application that is to be accessed when the detection result satisfies the preset condition; and an access unit, configured to access the application that is to be accessed according to the detection result, the first key information, and the second key information.

In some embodiments, the access unit may further include: a calculation subunit, configured to calculate, according to the first key information and the second key information, the encryption key used for encrypting the user identifier; and an access subunit, configured to access the application that is to be accessed according to the encryption key and the detection result.

In some embodiments, the access subunit is further configured to: extract the encrypted user identifier and the authorization credential from the detection result; decrypt the encrypted user identifier according to the encryption key; and access the application that is to be accessed based on a decryption result and the authorization credential.

In some embodiments, the obtaining unit is further configured to: extract the application identifier of the application that is to be accessed from the detection result; verify the application that is to be accessed based on the application identifier; and determine that the detection result satisfies the preset condition when a verification result indicates that the application that is to be accessed is an authorized application, and obtain the first key information from the application that is to be accessed.

In some embodiments, the access module is further configured to skip accessing the application that is to be accessed when the detection result does not satisfy the preset condition.

According to this embodiment of this application, the obtaining module <NUM> obtains an application access request, the application access request carrying a user identifier and a application that is to be accessed; the acquisition module <NUM> acquires an encryption key, and encrypts the user identifier by using the encryption key, to obtain an encrypted user identifier, the encryption key carrying first key information and second key information; and the generation module <NUM> encrypts the user identifier, and generates an authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information. The transmission module <NUM> then transmits the authorization credential to the application that is to be accessed, so that the application that is to be accessed generates an authorization request based on the authorization credential. Next, the receiving module <NUM> receives the authorization request returned by the application that is to be accessed. Finally, the detection module <NUM> detects the authorization request, and the access module <NUM> accesses, when a detection result satisfies a preset condition, the application that is to be accessed based on the detection result and the second key information. In this solution, after the user identifier is encrypted, the first key information is used as a part of the authorization credential and transmitted to the application that is to be accessed, so that the application that is to be accessed generates the authorization request based on the authorization credential. The authorization request returned by the application that is to be accessed is then received. The authorization request is detected, and when the detection result satisfies the preset condition, the application that is to be accessed is accessed based on the detection result and the second key information. In other words, whether the third-party application is accessed is determined according to the detection result. In addition, when the third-party application is accessed, the encrypted user identifier needs to be decrypted by using the first key information and the second key information. If the third-party application is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access.

In addition, an embodiment of this application further provides an electronic device. <FIG> is a schematic structural diagram of an electronic device according to an embodiment of this application. Specifically,
the electronic device may include components such as a processor <NUM> with one or more processing cores, a memory <NUM> with one or more computer-readable storage media, a power supply <NUM>, and an input unit <NUM>. A person skilled in the art may understand that the electronic device structure shown in <FIG> does not constitute a limitation to the electronic device. The electronic device may include more or fewer components than those shown in the figure, or some components may be combined, or a different component deployment may be used.

The processor <NUM> is a control center of the electronic device, and connects various parts of the entire electronic device by using various interfaces and lines. By running or executing a software program and/or a module stored in the memory <NUM>, and invoking data stored in the memory <NUM>, the processor performs various functions of the electronic device and processes data, thereby performing overall monitoring on the electronic device. In some embodiments, the processor <NUM> may include one or more processing cores. Preferably, the processor <NUM> may integrate an application processor and a modem. The application processor mainly processes an operating system, a user interface, an application, and the like. The modem mainly processes wireless communication. It may be understood that the foregoing modem processor may alternatively not be integrated into the processor <NUM>.

The memory <NUM> may be configured to store a software program and a module, and the processor <NUM> runs the software program and the module that are stored in the memory <NUM>, to implement various functional applications and data processing. The memory <NUM> may mainly include a program storage area and a data storage area. The program storage area may store an operating system, an application required by at least one function (for example, a sound playback function and an image playback function), or the like. The data storage area may store data created according to use of the electronic device. In addition, the memory <NUM> may include a high speed random access memory, and may further include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory, or another transitory solid-state storage device. Correspondingly, the memory <NUM> may further include a memory controller, to provide access of the processor <NUM> to the memory <NUM>.

The electronic device further includes the power supply <NUM> for supplying power to the components. Preferably, the power supply <NUM> may be logically connected to the processor <NUM> by using a power management system, thereby implementing functions such as charging, discharging, and power consumption management by using the power management system. The power supply <NUM> may further include one or more direct current or alternating current power supplies, a re-charging system, a power failure detection circuit, a power supply converter or inverter, a power supply state indicator, and any other component.

The electronic device may further include the input unit <NUM>. The input unit <NUM> may be configured to receive inputted numeric or character information and generate keyboard, mouse, joystick, optical, or trackball signal input related to user settings and function control.

Although not shown in the figure, the electronic device may further include a display unit, and the like. Specifically, in this embodiment, the processor <NUM> in the electronic device may load executable files corresponding to processes of one or more applications to the memory <NUM> according to the following instructions, and the processor <NUM> runs the application stored in the memory <NUM>, to implement various functions as follows:
obtaining an application access request; acquiring an encryption key, and encrypting the user identifier by using the encryption key, to obtain an encrypted user identifier; generating an authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information; transmitting the authorization credential to a application that is to be accessed, so that the application that is to be accessed generates an authorization request based on the authorization credential; receiving the authorization request returned by the application that is to be accessed; detecting the authorization request; and accessing, when a detection result satisfies a preset condition, the application that is to be accessed based on the detection result and the second key information.

For specific implementation of the foregoing operations, reference may be made to the foregoing embodiments.

According to this embodiment of this application, an application access request is first obtained, the application access request carrying a user identifier and a application that is to be accessed. An encryption key is acquired, and the user identifier is encrypted by using the encryption key, to obtain an encrypted user identifier. An authorization credential corresponding to the application access request is generated according to the encrypted user identifier and first key information. The authorization credential is then transmitted to the application that is to be accessed, so that the application that is to be accessed generates an authorization request based on the authorization credential. Next, the authorization request returned by the application that is to be accessed is received. Finally, the authorization request is detected, and when a detection result satisfies a preset condition, the application that is to be accessed is accessed based on the detection result and second key information. In this solution, after the user identifier is encrypted, the first key information is used as a part of the authorization credential and transmitted to the application that is to be accessed, so that the application that is to be accessed generates the authorization request based on the authorization credential. The authorization request returned by the application that is to be accessed is then received. The authorization request is detected, and when the detection result satisfies the preset condition, the application that is to be accessed is accessed based on the detection result and the second key information. In other words, whether the third-party application is accessed is determined according to the detection result. In addition, when the third-party application is accessed, the encrypted user identifier needs to be decrypted by using the first key information and the second key information. If the third-party application is maliciously attacked by criminals, the criminals can only steal the first key information, but cannot decrypt the encrypted user identifier to steal personal information of the user. Therefore, this solution can improve the security of application access.

A person of ordinary skill in the art may understand that, all or some steps of the methods in the foregoing embodiments may be implemented by using instructions, or implemented through instructions controlling relevant hardware, and the instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

In an embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the computer program, when executed by the processor, causing the processor to perform the steps in the foregoing method embodiments.

In an embodiment, a computer-readable storage medium is provided, storing a computer program, the computer program, when being executed by a processor, causing the processor to perform the steps in the foregoing method embodiments.

In an embodiment, a computer program product or a computer program is provided. The computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, to cause the computer device to perform the steps in the method embodiments.

A person of ordinary skill in the art may understand that all or some of the procedures of the methods in the foregoing embodiments may be implemented by a computer program instructing related hardware. The program may be stored in a non-transitory computer-readable storage medium. When the program runs, the procedures of the foregoing method embodiments may be performed. References to the memory, the storage, the database, or other medium used in the embodiments provided in this application may all include a non-transitory or a transitory memory. The non-transitory memory may include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM) or a flash memory. The transitory memory may include a random access memory (RAM) or an external high-speed cache. By way of description rather than limitation, the RAM may be obtained in a plurality of forms, such as a static RAM (SRAM), a dynamic RAM (DRAM), a synchronous DRAM (SDRAM), a double data rate SDRAM (DDR SDRAM), an enhanced SDRAM (ESDRAM), a synchlink (Synchlink) DRAM (SLDRAM), a rambus (Rambus) direct RAM (RDRAM), a direct rambus dynamic RAM (DRDRAM), and a rambus dynamic RAM (RDRAM).

Technical features of the foregoing embodiments may be randomly combined. To make description concise, not all possible combinations of the technical features in the foregoing embodiments are described. However, the combinations of these technical features shall be considered as falling within the scope recorded by this specification provided that no conflict exists.

Claim 1:
A method for accessing an application, performed by a server, the method comprising:
obtaining (<NUM>) an application access request from a terminal, the application access request carrying a user identifier and an application identifier, the application identifier corresponding to an application that is to be accessed;
acquiring (<NUM>) an encryption key for encrypting the user identifier to obtain an encrypted user identifier, the encryption key carrying first key information and second key information;
generating (<NUM>) an authorization credential corresponding to the application access request according to the encrypted user identifier and the first key information, and storing the second key information;
transmitting (<NUM>) the authorization credential to the application that is to be accessed, in order to enable the application that is to be accessed to generate an authorization request based on the authorization credential, the authorization request including the authorization credential and the encrypted user identifier;
receiving (<NUM>) the authorization request returned by the application that is to be accessed;
detecting a type of the application that is to be accessed based on the authorization request;
determining that a detection result satisfies a preset condition when the type of the application that is to be accessed is an authorized application type, obtaining the first key information from the application that is to be accessed, calculating the encryption key used for encrypting the user identifier according to the first key information and the second key information stored, extracting the encrypted user identifier and the authorization credential from the detection result; decrypting the encrypted user identifier according to the encryption key; and enabling the terminal to access (<NUM>) the application that is to be accessed based on a decryption result and the authorization credential.