Login method for client application and corresponding server

• US 9,544,295 B2
• Filed: 10/13/2014
• Issued: 01/10/2017
• Est. Priority Date: 10/14/2013
• Status: Active Grant

• Current Assignee: Alibaba Group Holding Ltd.
• Original Assignee: Alibaba Group Holding Ltd.
• Inventors: Fang, Tengfei
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US14/512,723
• Publication Number:
  US 20150106905A1
• Time in Patent Office: 820 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

The present disclosure provides a login method for a client application and a corresponding server. The method includes: sending an access token to a browser of a terminal and creating a corresponding relationship between the access token and user information of a user after the user has successfully logged into a web application via the browser of the terminal; receiving a relationship creating request from the browser and creating a corresponding relationship between device information of the terminal and the access token in accordance with the relationship creating request, wherein the relationship creating request includes the device information of the terminal and the access token; receiving a login request of a client application, the login request including the device information of the terminal that operates the client application; determining the access token corresponding to the device information of the terminal that operates the client application based on the created corresponding relationship between the device information and the access token; and determining the user information which corresponds to the access token based on the created corresponding relationship between the access token and the user information, and performing a login operation of the client application program based on the user information. The technical scheme of the present disclosure can achieve login without re-inputting information such as a user name and a password when a client application is to be logged in after a web application in a terminal has successfully been logged in.

Claims

1. A method comprising:

sending an access token to a browser of a terminal and creating a corresponding relationship between the access token and user information of a user after the user has successfully logged into a web application via the browser of the terminal;

receiving a relationship creating request from a client application via the browser and creating a corresponding relationship between device information of the terminal and the access token in accordance with the relationship creating request, the client application being a third-party application different from the web application and the browser, wherein the relationship creating request includes the device information of the terminal and the access token, and wherein the access token is obtainable by the browser and not invokable by the client application;

receiving a login request of the client application, the login request including the device information of the terminal that operates the client application;

determining the access token corresponding to the device information of the terminal that operates the client application based on the created corresponding relationship between the device information and the access token;

determining the user information which corresponds to the access token based at least in part on the created corresponding relationship between the access token and the user information; and

performing a login operation of the client application based at least in part on the user information.

2. The method as recited in claim 1, further comprising obtaining a current IP address, a device type and an operating system type of the terminal after the user has successfully logged into the web application via the browser of the terminal.

3. The method as recited in claim 2, further comprising:

receiving the device type and the operation system type of the terminal from the client application and obtaining the current IP address of the terminal;

querying whether a terminal that is consistent with the device type and the operation system type of the terminal and matches the IP address of the terminal has successfully logged into a particular web application related to the client application within a predetermined period of time; and

in response to a negative result of the querying, notifying the client application to log in using a user name and a password.

4. The method as recited in claim 1, further comprising sending an identification token to the browser after the corresponding relationship between the device information of the terminal and the access token is created in accordance with the relationship creating request.

5. The method as recited in claim 4, wherein the login request further includes the identification token.

6. The method as recited in claim 5, further comprising:

determining whether the identification token included in the received login request is valid after receiving the login request of the client application; and

rejecting the login request of the client application upon determining that the identification token is invalid.

7. The method as recited in claim 1, further comprising deleting the corresponding relationship between the device information of the terminal and the access token after the client application is successfully logged in.

8. The method as recited in claim 1, wherein the device information comprises one of a unique identifier of the terminal and a physical address of the terminal.

9. A server comprising:

one or more processors;

memory;

a sending module stored in the memory and executable by the one or more processors to send an access token to a browser of a terminal when a user has successfully logged into a web application via the browser of the terminal;

a first creation module stored in the memory and executable by the one or more processors to create a corresponding relationship between the access token and user information of the user;

a first receiving module stored in the memory and executable by the one or more processors to receive a relationship creating request from a client application via the browser, the client application being a third-party application different from the web application and the browser, wherein the relationship creating request includes device information of the terminal and the access token, and wherein the access token is obtainable by the browser and not invokable by the client application;

a second creation module stored in the memory and executable by the one or more processors to create a corresponding relationship between the device information of the terminal and the access token in accordance with the creating relationship request;

a second receiving module stored in the memory and executable by the one or more processors to receive a login request of the client application, wherein the login request includes the device information of the terminal that operates the client application;

a first determination module stored in the memory and executable by the one or more processors to determine the access token corresponding to the device information of the terminal that operates the client application based at least in part on the created corresponding relationship between the device information and the access token;

a second determination module stored in the memory and executable by the one or more processors to determine the user information corresponding to the access token based at least in part on the created corresponding relationship between the access token and the user information; and

a login module stored in the memory and executable by the one or more processors to obtain the corresponding user information based on the device information of the terminal included in the login request, and perform a login operation of the client application based on the user information.

10. The server as recited in claim 9, further comprising an acquisition module used for obtaining a current IP address, a device type and an operating system type of the terminal after the user has successfully logged into the web application via the browser of the terminal.

11. The server as recited in claim 10, further comprising:

a third receiving module used for receiving the device type and the operation system type of the terminal from the client application;

an IP address acquisition module used for obtaining the current IP address of the terminal;

a query module used for querying whether a terminal that matches the device type, the operation system type and the IP address of the terminal has successfully logged into a particular web application program related to the client application within a predetermined period of time; and

a notification module used for notifying the client application to log in with a user name and a password when no terminal that matches the device type, the operation system type and the IP address of the terminal has successfully logged into the web application program related to the client application within the predetermined period of time.

12. The server as recited in claim 9, further comprising an identification token sending module used for sending an identification token to the browser after the corresponding relationship between the device information of the terminal and the access token is created in accordance with the relationship creating request.

13. The server as recited in claim 12, wherein the login request further comprises the identification token.

14. The server as recited in claim 13, further comprising:

a determination module used for determining whether the identification token included in the received login request is valid; and

a request rejection module used for rejecting the login request from the client application upon determining that the identification token is invalid.

15. The server as recited in claim 9, further comprising a deletion module used for deleting the corresponding relationship between the device information of the terminal and the access token after the client application is successfully logged in.

16. The server as recited in claim 9, wherein the device information comprises one of:

a unique identifier of the terminal or a physical address of the terminal.

17. A method comprising:

receiving an access token from a server when a browser is used to log into an application service provided by a web application of the server, and storing the access token in a terminal, wherein the access token corresponds to user information for logging into the web application;

obtaining device information of the terminal when a client application in the terminal that is related to the web application is used to log into the application service, the client application being a third-party application different from the web application and the browser;

invoking the browser to send the device information of the terminal and the access token for requesting the server to create a corresponding relationship between the device information of the terminal and the access token, the access token being obtainable by the browser and not invokable by the client application;

initiating a login request using the client application, wherein the login request includes the device information of the terminal, and the login request is used for requesting the server to determine the access token which corresponds to the device information of the terminal based on the created corresponding relationship between the device information of the terminal and the access token; and

determining the user information corresponding to the access token based on the corresponding relationship between the access token and the user information, and performing a login operation using the determined user information.

18. The method as recited in claim 17, further comprising:

sending a device type and an operation system type of the terminal to the server to allow the server to determine whether the client application is permitted to send a relationship creating request to the server; and

receiving notification from the server indicating whether the client application is permitted to send the relationship creating request to the server.

19. The method as recited in claim 17, further comprising obtaining an identification token that is sent by the server from the browser, wherein the identification token is sent to the browser of the terminal from the server when the relationship creating request is received, and wherein the login request that is sent to the server further includes the identification token.

20. The method as recited in claim 17, wherein the device information comprises one of:

a unique identifier of the terminal or a physical address of the terminal.