WO2010075798A1

WO2010075798A1 - Configuration and authentication method for cross-domain authorization, the equipment and system thereof

Info

Publication number: WO2010075798A1
Application number: PCT/CN2009/076318
Authority: WO
Inventors: 孙谦; 胡立新; 谭东晖
Original assignee: 华为技术有限公司
Priority date: 2008-12-31
Filing date: 2009-12-31
Publication date: 2010-07-08
Also published as: CN101771676A; CN101771676B

Abstract

A configuration method for cross-domain authorization is disclosed in the invention, which includes the following steps: receiving a request for accessing the resource information from the user; displaying the first page including the resource information according to the request, in which the first page is provided by the first server in the first domain; displaying the second page including the user’s relation information according to the first page, in which the second page is provided by the second server in the second domain; receiving the relation information corresponding to the resource information selected by the user from the second page; sending the resource information and the relation information selected from the second page to the first server, so that the first server saves the corresponding record between the selected relation information and the resource information, and views the corresponding record as the authorization information when accessing the resource information. The embodiments of the invention also disclose an authentication method, terminal, relative equipment and system for the cross-domain authorization. With the embodiments of the present invention, the resource information of the user in the first domain can be authorized to the relation information in the second domain, so that the user’s experience can be improved.

Description

Setting, authentication method, related device and system for cross-domain authorization The application No. 200810242174.3 filed on December 31, 2008, the invention name is "a cross-domain authorization setting, authentication method, related device" The priority of the Chinese Patent Application, the entire disclosure of which is incorporated herein by reference. TECHNICAL FIELD The present invention relates to the field of computer applications, and in particular, to a cross-domain authorization setting, a signing method, a related device, and a system. Background technique

The SNS (Social Network Site) website, commonly referred to as the social networking server in China, is a virtual social network platform based on the idea of social network relationship system. From Myspace to Facebook, Kaixin and intranet, domestic and international social networking servers have matured and become part of the daily life of more and more people. At the same time, a large number of applications are provided to users in the social networking platform. The application is generally provided by an application server. It is these colorful social applications that truly bring value to users. The application website server is often separated from the social network server and can be operated by different service providers, and the application website server and the social network server are generally located in different domains. The user can have a lot of resource information in the application website server, such as photos, videos, diaries, microblogs, URL collections or location information, and the social network server stores the user's relationship information, such as contacts (also called For friends list, etc.) and groups and other information.

Users want to share their resources on the application website server to certain contacts or designated groups in the social networking site. If the relationship information and resource information are in the same domain, they can be implemented through common permission settings. If the application server is not in the same domain, the application website server cannot access the relationship information of the user on the social networking server without permission, so how to implement the user who authorizes the resource information in the application website server to the relationship information in different domains. That is, cross-domain authorization is a problem that needs to be solved currently. Summary of the invention

The embodiments of the present invention provide a cross-domain authorization setting, a signing method, a related device, and a system, so as to implement the relationship information of the resource information of the user in the first domain to the second domain, thereby improving the user experience.

The embodiment of the invention provides a method for setting an inter-domain authorization, which includes:

Receiving a request for user access to resource information;

Displaying, according to the foregoing request, a first page that includes resource information of the user, where the first page is provided by a first server in a first domain;

And displaying, according to the first page, the second page that includes the relationship information of the user, where the second page is provided by the second server in the second domain;

Receiving, by the user, the relationship information corresponding to the resource information on the second page;

Sending the resource information and the relationship information selected by the user in the second page to the first server, so that the first server stores the corresponding record of the selected relationship information and the resource information, and uses the corresponding record as the access to the resource information. Authorization information.

The embodiment of the invention further provides an authentication method for cross-domain authorization, which includes:

Receiving, by the terminal, a request for accessing resource information in the first server of the first domain by using the terminal; acquiring authorization information corresponding to the resource information, where the authorization information records relationship information of the second server corresponding to the resource information corresponding to the resource information;

Determining whether the user belongs to the above relationship information;

If yes, the user is allowed to access the resource information, otherwise the user is denied access to the resource information.

Receiving a request from a user through the terminal;

Obtaining authorization information of the above user according to the foregoing request;

Obtaining resource information that the user is authorized to access according to the foregoing authorization information; Sending the resource information to the terminal.

The embodiment of the invention further provides a method for setting a cross-domain authorization, which includes:

Receiving a request for accessing resource information sent by the user through the terminal;

Sending, by the foregoing request, the first page that includes the resource information to the terminal, so that the terminal sends the acquisition request of acquiring the relationship information to the second server of the second domain according to the first page, and the terminal acquires the second server. Transmitting the relationship information and displaying the relationship information on the second page; receiving resource information sent by the terminal and selecting, by the user, relationship information corresponding to the resource information on the second page, storing the selected relationship information and resource information Corresponding to the record, and the corresponding record is used as the authorization information for accessing the resource information.

The embodiment of the invention further provides a terminal, which includes:

a request receiving module, configured to receive a request for a user to access resource information;

a display module, configured to display, according to the foregoing request, a first page that includes resource information of the user located in the first domain, where the first page displays a second information that includes relationship information of the user located in the second domain Page

a relationship information receiving module, configured to receive, by the user, relationship information corresponding to the resource information on the second page;

a sending module, configured to send the foregoing resource information and the relationship information selected in the second page to the first server, so that the first server stores the corresponding record of the selected relationship information and the resource information, and uses the corresponding record as the access point Authorization information about resource information.

The embodiment of the invention further provides a server, which includes:

a receiving module, configured to receive a request of the user through the terminal;

An obtaining module, configured to obtain the authorization information of the user according to the foregoing request, and obtain resource information that the user is authorized to access according to the authorization information;

And a sending module, configured to send the foregoing resource information to the terminal.

An embodiment of the present invention further provides a server, including:

a receiving module, configured to receive, by the user, the resource information in the first server in the first domain by using the terminal Request

The obtaining module is configured to obtain the authorization information corresponding to the resource information, where the authorization information records the relationship information of the second server in the second domain corresponding to the resource information;

The processing module is configured to determine whether the user belongs to the relationship information; when the determination is yes, the user is allowed to access the resource information, and when the determination is no, the user is denied access to the resource information.

An embodiment of the present invention further provides a server, including:

a receiving module, configured to receive a request sent by a user through the terminal;

a sending module, configured to send, by using the foregoing request, a first page that includes resource information to the terminal, so that the terminal sends an acquisition request for obtaining the relationship information to the second server of the second domain according to the first page, and the terminal Obtaining relationship information sent by the second server and displaying the relationship information on the second page;

a storage module, configured to receive resource information sent by the terminal, and the user selects relationship information corresponding to the resource information on the second page, and stores a corresponding record of the selected relationship information and resource information, and uses the corresponding record as an access Authorization information of the resource information.

The embodiment of the invention further provides a cross-domain authorization system, which is characterized in that it comprises:

The first server is located in the first domain, and is configured to receive a request sent by the user by using the terminal, and send, by using the foregoing request, the first page that includes the resource information to the terminal, so that the terminal is configured to the second domain according to the first page. The second server sends an acquisition request for acquiring the relationship information, and the terminal acquires the relationship information sent by the second server and displays the relationship information on the second page; the resource information sent by the receiving terminal and the user corresponding to the second page selection And storing the corresponding record of the selected relationship information and the resource information in the relationship information of the resource information, and using the corresponding record as the authorization information for accessing the resource information;

The second server is located in the second domain, and is configured to send the relationship information of the user to the terminal. By using the cross-domain authorization setting, the authentication method, the terminal, the server, and the system provided by the embodiment of the present invention, the resource information of the user in the first domain can be authorized to the relationship information such as the contact located in the other domain of the user. , groups, etc., thereby improving the user experience. Users can directly use the second service The relationship information in the server is associated with the resources in the first server, that is, the user can conveniently share and authorize resources from his own perspective. DRAWINGS

FIG. 1 is a flowchart of a method for setting cross-domain authorization according to an embodiment of the present invention; FIG. 2 is a flowchart of a method for setting cross-domain authorization according to another embodiment of the present invention; A schematic diagram of a method for setting cross-domain authorization according to another embodiment of the present invention; FIG. 4 is a flowchart of a method for setting cross-domain authorization according to another embodiment of the present invention; FIG. A schematic diagram of a browser of a terminal in a method for setting a cross-domain authorization provided by the example;

FIG. 6 is a flowchart of a method for authenticating an inter-domain authorization according to an embodiment of the present invention; FIG. 7 is a flowchart of a method for authenticating an inter-domain authorization according to another embodiment of the present invention; 8 is a flowchart of a method for authenticating an inter-domain authorization according to another embodiment of the present invention; FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of a server according to an embodiment of the present invention;

FIG. 11 is a schematic structural diagram of a server according to another embodiment of the present invention; FIG. 12 is a schematic structural diagram of a server according to another embodiment of the present invention; FIG. 13 is a schematic diagram of a server according to an embodiment of the present invention; Schematic diagram of a cross-domain authorization system. The embodiment of the present invention provides a method for setting a cross-domain authorization. Referring to FIG. 1 , the method includes: 101: receiving a request for a user to access resource information;

102: Display, according to the request, a first page that includes resource information of the user, where the first page is provided by a first server in the first domain;

103: The first page of the foregoing displays a second page that includes the relationship information of the user, where the second page is provided by the second server in the second domain;

104: The receiving user selects relationship information corresponding to the resource information on the second page. 105: Send the foregoing resource information and the relationship information selected in the second page to the first server, so that the first server stores the corresponding record of the selected relationship information and the resource information, and uses the corresponding record as accessing the resource information. Authorization information.

With the foregoing embodiment, the relationship information of the resource information that the user is in the first domain is authorized to the second domain, so that the user experience can be improved.

In another embodiment provided by the present invention, the first server in the first domain stores resource information of the user, such as photos, videos, URL collections, blog logs, etc.; is in a second different from the first domain. A second server in the domain that stores relationship information such as contacts and groups of the user. As shown in FIG. 2, a method for setting cross-domain authorization provided by an embodiment of the present invention mainly includes the following steps:

Step 201: The terminal receives a request for accessing resource information by the user.

The user passes the resource information in the first server of the terminal, and the access mode can adopt OpenID technology, that is, the first server is a relying party of OpenID (open identity), the second server is a provider of OpenID, and the first server receives the user using OpenID. The identity is performed. According to the OpenID protocol, the terminal's browser is forwarded to the second page of the second server to authenticate the user. The user provides a password or other authentication information such as a fingerprint, etc. Then, the first page displayed on the terminal by the first server is returned by the redirect, and the first page includes resource information of the user, such as a photo, a video, a URL collection, a blog log, and the like.

The first server may also set a session cookie on the browser side of the terminal to maintain the current user session, and the subsequent user does not need to perform authentication when accessing the first server. If the browser of the terminal disables the cookie, the session information can be carried directly in the HTTP request and response message to maintain the current user session. These two ways of maintaining the session are common technologies in the Internet business, and will not be described here.

In addition to OpenID technology, other cross-domain identity authentication technologies such as Single Sign On (SSO), including OpenSSO and Microsoft Passport, can be used to simplify the authorization process of user resource information. Browser login once first service In the subsequent authorization of the resource information, the user browser can directly access the second server to obtain the relationship information of the user without performing authentication on the second server again.

Of course, if you do not want to use the additional cross-domain identity authentication technology, you can also allow the user to access the second server after accessing the first server to obtain the user's relationship information, that is, the second server can be used separately.

Step 202: The first server displays the first page, that is, the authorization page of the resource information in the first server, by using a browser of the user terminal, where the resource information is displayed in the first page, and the authorized button or hyperlink is determined. The hypertext code (including the script code) in the first page is generated by the first server and displayed by the first server to the browser end of the user terminal.

Step 203: Display a second page that includes relationship information according to the first page.

The browser of the terminal is also displayed with a second page including the relationship information of the user, and the hypertext code (including the script code) of the second page is generated by the second server. The second page can have multiple display modes, such as displaying an iframe (Inline Frame) in the first page, or popping up a new browser when clicking a button or link on the first page. The browser page displays the user's relationship information such as contacts and groups.

The second page also includes an iframe frame page pointing to the first server, called the third page, which is generally set to a hidden style. Through the iframe frame page pointing to the first server in the second page, the limitation that the cross-domain communication cannot be directly performed in the browser can be broken, so that the first server and the second server can transmit information through the user's browser. communicate with.

Referring to FIG. 3, the second page is displayed in the form of an iframe in the first page, and is visible through a first page from the first server to a second page of the second server, and then to a third page of the first server. Returning to a circular information delivery channel such as the first page of the first server, the cross-domain transfer of the relationship information in the browser is realized, so that the first server can conveniently obtain the relationship information of the user in the second server. To authorize resources in the application.

The second page can be displayed by setting the source address of the second page in the first page, such as the source address of the second page in the iframe format in the javascript script function of the first page. The properties are set, for example as follows:

Iframel .src= "http://snsexample.com/relationship.php" ;

For the second page of the pop-up form, directly use the hyperlink address such as:

<a href="http:〃 snsexample.com/relationship.php" target="_blank">^.-n^^- Groups and Contacts </a>

Or the click event of the button corresponds to the script to open a new page such as:

Window. open ('http://snsexample.com/relationship.php') ; If the user passes the first server of the terminal, the second server performs identity authentication, such as adopting OpenID or single point, that is, the user is in step 101. When the identity of the second server is authenticated, the second server may set a corresponding session _C00 kie item on the browser end of the user terminal, and the data of the cookie item may include session information such as a session identifier, and the user accesses the current session. The second server does not have to be authenticated. That is, the second page first obtains the cookie data of the browser end of the user's terminal, and then carries the cookie data to request the second server to obtain the relationship information of the user, and displays the obtained relationship information on the page.

If the first server and the second server cannot use the OpenID or a single point to enable the user to perform identity authentication only in one server, after the user is on the first server, the second server corresponding to the second page does not have corresponding session information. For example, if the second page displays the relationship information of the user, the user is prompted to perform identity authentication on the second server.

As shown in FIG. 4, the first page contains resource information, such as a photo, and a button for determining authorization. In the first page, the second page may be included in the form of an inline frame, and the relationship information displayed on the second page may include a contact list, and the contacts may be displayed in groups, such as grouping for colleagues, classmates, and family members, etc. A check box is displayed in front of the contact or group name. In addition, some public groups and group members created or participated by the user can be displayed for the user to select. Whether it is a grouping of contacts or a public group, it can be represented by a unique group identifier. The second page can display the name or nickname of the contact, as well as the name of the group, but when the actual information is transmitted, The user ID of the contact is generally used, as well as the group ID.

In addition to the contacts and groups described above, the second server can also detect other users who have recently communicated with the user, such as having sent a message, a message, a record over the phone, and then displaying those users in the second server. In the second page. In the future, the telecommunication network and the Internet are closely integrated. In the second server operated by the telecommunication operator, it is easy to obtain the user's communication records (such as text messages, telephones, etc.), and those who have had communication with the user may not be in contact with the above users. People and groups, but sometimes users want to temporarily share some resources with those who have communicated. The information of these people (which can be called temporary contacts) actually belongs to the user's relationship data.

In addition, since the user may have authorized the current resource information to some relationship information such as a contact or a group, the first page may also request the first server to obtain the existing authorization information of the current resource information of the user, and The authorized contact and group information and the like are passed to the second page as parameters of the second page source address URL (Uniform Resource Locator). Examples are as follows:

Iframel .src= "http:〃 snsexample.com/relationship.php#groups=groupr, ; where the parameter in the bookmark is the above address "#," and the following section indicates that the current resource has been granted to the group group 1.

In addition to using bookmark parameters, you can also include parameters after the query string "?" at the source address, such as:

i frame 1.src= "http://snsexample.com/relationship.php?groups=group 1 " ; Of course, if you need to use the same address and transfer a large amount of information through the URL of the iframe, the bookmark "#" is the best way.

The second page can obtain the above parameters in the current page address when the window loading event (window.onLoad) occurs, and then set the authorized group such as groupl to be selected according to the above parameters when displaying the relationship information of the user. status. This allows the user to know which relationship information, such as a contact or group, has been authorized to access current resource information. Examples of parameters including both groups and contacts are as follows:

Iframe l .src= "http:〃 snsexample.com/relationship.php#groups=groupl& Contacts=usera+userb";

The parameters in the above address indicate that the current resource has been authorized to the group groupl and the contacts usera and userbc group 1 are group identifiers, and usera and userb are user identifiers.

Step 204: The user selects relationship information in the second page, and transmits the relationship information selected by the user to the third page. The second page will be the currently selected relationship information (group or contact) when the user selects or deselects the group or contact event through the terminal (such as the onClick event of the check box corresponding to the contact or group). Passed to the third page, the method of passing can specify the page address of the third page by setting the source address attribute of the third page, and the relationship information selected by the user is included in the address parameter and transmitted to the third page. The source address of the third page set is as follows:

Iframe2. src= " http '.II appexample .com/ auth.php#groups ⁼ group 1 +group2 &contacts=usera+userb+userc";

The parameters in the above address indicate that the current resource is selected for authorization to the groups groupl and group2 and the contacts usera, userb and userc»

Step 205: The third page transmits the relationship information selected by the user sent by the second page to the first page. The third page sets a timer function, which is executed every predetermined time interval, such as 500 milliseconds. The relationship information selected by the user is obtained in the parameters in the current page address, and is transmitted to the first page when there is a change. Since the predetermined time interval is short (generally less than 1 second), the relationship information obtained by the third page can reflect the authorization choice made by the user on the second page in real time, and then exaggerate the relationship information (such as "groups=groupl+giOup2&contacts= Usera+userb+userc,, ) is passed to the corresponding script of the first page. Because the third page and the first page are in the same domain, that is, in the first server, there is no cross-domain communication problem, the relationship information can be normal. For the second page in the form of an inline frame, the example of the processing script in the third page is as follows: function transmit() {

Parent.parent.receive(window.location.hash);

}

Setlnterval(transmit, 500); The above script executes the above transmit() function every 500 milliseconds, and passes the parameter in the source address of the page (that is, the content corresponding to window.location.hash) to the corresponding script of the first page (ie, object parent.parent). The program (that is, the receive function above) is processed.

For the second page in pop-up form, the processing script in the third page is as follows: function transmit() {

Parent.opener.receive(window.location.hash);

}

Setlnterval(transmit, 500);

The first page corresponds to the parent.opener object, which is different from the second page in the inline frame form.

Step 206: After the user determines to authorize the resource information for the selected contact and/or group, the first page submits the relationship information and resource information finally selected by the user to the first server.

The first page includes a button or hyperlink that determines the authorization, which can be named "shared" or "ok". When the button is activated by the user, the first page submits the relationship information and resource information and the like finally selected by the user to the first server server. The first server stores a corresponding record of the relationship information and the resource information selected by the user, and uses the corresponding record as the authorization information for accessing the resource information. In addition, the authorization information may further include an authorization time, that is, a time when the first page submits the relationship information and the corresponding resource information finally selected by the user to the first server.

It can be seen from the above steps that the transmission of the relationship information of the corresponding resource information is completed only between the first server and the second server, and the authorized relationship information is transmitted from the first page of the first server to the The second page of the second server, and the relationship information selected by the user, are transmitted from the second page of the second server to the first page via the third page. It is not necessary to directly transfer any data between the first server and the second server, and the resource authorization of the cross-domain can be completed, which is simple and efficient, and fully utilizes the computing power of the terminal. The first server lacking the relationship information can make full use of the user relationship information in the second server to enhance the social function of the application, and attract more users to visit. ask.

In another method for setting cross-domain authorization provided by another embodiment of the present invention, if the user's terminal browser disables the cookie, in order to ensure the security of cross-domain information transmission, before the information is transmitted, first in the first domain and The second domain exchanges passwords. When you pass the information, you must bring the password. When receiving the transmitted information, you must first verify the password. Please refer to Figure 5, the specific process is as follows: Step 301, the first page obtains the first password. The first password may be generated by the first page using a random function, or may be requested from the first server to obtain the first password. Because some browsers do not use random functions to generate highly secure passwords, it is recommended to use a password from the server. The password can be a random string. The session ID (Session ID) between the first server and the user's browser can be used as the first password because the session IDs are usually an unpredictable random string.

Step 302: The first page passes the first password to the second page. In the window loading event ( window.onLoad ) of the second page, the password parameter set in the source address of the second page of the first page is obtained, for example, the password can be included in the bookmark parameter. The second page will buffer the first password received for subsequent password verification.

Step 303: The second page obtains the second password, and sends the second password to the third page. The second password can also be generated by the second page itself, or requesting the second password from the second server, and passing the second password to the third page, or using the session between the second server and the user browser. The logo (Session ID) is used as the second password.

Step 304: The third page further passes the second password to the first page. The first page caches the second password for subsequent password verification. This completes the cross-domain password exchange between the first server and the second server.

Step 305: When subsequently transmitting the relationship information selected by the user, the first page and the second page respectively carry the password corresponding to the respective domain in the set URL bookmark parameter. For example, when setting the source address attribute of the second page on the first page, the example of carrying the password is as follows:

Iframel .src= "http:〃 snsexample.com/relationship.php#groups=groupl& Password=qw3e45s32328f3nl";

In addition to the relationship information, the bookmark parameter of the above address includes the first password "qw3e45s32328f3nl".

Step 306: The second page verifies the password. In the window loading event of the second page, the password in the bookmark parameter in the address of the window is taken out, such as the above password "qw3e45s32328f3nl", and then the password is compared with the previously cached first password, and the subsequent processing is performed after the verification is passed. If you need to take out the authorized relationship information in the parameters in the subsequent steps.

Step 307: When the second page transmits the relationship information selected by the user to the third page, the second password is also carried.

Step 308: The third page performs password verification. In the window timer function of the third page, the password in the bookmark parameter in the address of the window is taken out, and then the password is compared with the previously cached second password, and the subsequent processing is performed after the verification is passed.

In this way, the request for accessing the address corresponding to the second page or the third page in a place other than the current browser instance does not reveal the user's relationship information or resource authorization information and the like because the above password cannot be obtained.

An authentication method for cross-domain authorization provided by an embodiment of the present invention describes an authentication process when other users access resource information in the first server. For the sake of clarity, the user who has the resource information in the first server is referred to as the first user, and the user who wants to access the resource information of the first user is the second user. It is assumed that the first user has authorized the resource information in the first server, such as album P, to group A, and the member in group A contains the second user. Referring to FIG. 6, the steps of the embodiment are as follows: Step 401: The first server receives a request for the second user to access the resource information of the first user, such as the album P, where the resource information is in the first server in the first domain. The above request may be performed by the second user, such as OpenID, or by other means.

Step 402: The first server queries and obtains the authorization information of the first user for the resource information, where the authorization information records the relationship information of the second server in the second domain corresponding to the resource information.

Step 403: The first server determines whether the second user belongs to the relationship information. Step 404: If yes, the first server allows the second user to access the resource information, otherwise the second user is denied access to the resource information.

Through the method provided by the foregoing embodiment, the first server can share the resource information authorized by another user to the user by verifying the user, thereby improving the user experience.

In order to allow the first server to obtain the user's relationship information as little as possible, such as all the groups to which the second user belongs, and all the groups to which the second user belongs may be many, the second server is not convenient to all deliver to the first server. That is, in the embodiment, the first server only stores the contact information corresponding to the resource information of the first user and the identifier of the group, and does not save the specific contact in the group. For the steps of the authentication method of the cross-domain authorization provided by another embodiment of the present invention, refer to FIG. 7:

Step 501: The first server receives a request for the second user to access the resource information of the first user, such as the album P. The first server of the second user may adopt the method of OpenID, or may adopt other methods.

Step 502: The first server acquires, according to the resource information, the authorization information record of the first user for the resource information, and determines whether the second user is an authorized contact (including a temporary contact), and if yes, allows the second User access, end this process; otherwise, go to step 503.

Step 503: The first server sends the group identifier authorized by the first user to the authorization information record of the resource and the identifier of the second user to the second server, and requests the second server to determine whether the second user is authorized by the foregoing. Member of the group. When the second user is a member of at least one of the authorized groups, the second server returns a positive determination result.

Step 504: The first server receives the determination result returned by the second server. If the determination result is a positive result, the first server allows the second user to access, otherwise the access is prohibited.

In order to display the resources shared by other users that the user has the right to access after the user logs in to the first server, it is convenient for the user to know which resources are available to the user, and the cross-domain authorization is provided by another embodiment of the present invention. Please refer to Figure 8 for the authentication method, which mainly includes the steps: Step 601: The first server receives the access request of the second user, and retrieves, in the stored authorization information, the resource information of the authorized access corresponding to the group to which the second user belongs, and the corresponding user of the second user. Resource information for authorized access. Since there are many resources that can be retrieved, the corresponding authorization time can be used to filter resources, such as only the resources authorized to access for a predetermined period of time (such as the last week), or the latest (most authorized time). Close to the current time) a predetermined number (such as the top 10 most recently authorized) resources, etc.

Step 602: Display the resource information in a page after the second user. Through the above scheme, it can be seen that the user is provided with a personalized homepage, and the resources that the user can access are displayed. Especially those resources that have been recently shared.

The method provided by the embodiment of the present invention enables the user to log in to the first server to display resource information shared by other users that the user has permission to access, thereby improving the user experience.

An embodiment of the present invention provides a terminal 7, as shown in FIG. 9, which includes:

a request receiving module 71, configured to receive a request for a user to access resource information;

The display module 72 is configured to display, according to the request, a first page that includes resource information of the user located in the first domain, and display, according to the first page, a second page that includes relationship information of the user located in the second domain. ;

The relationship information receiving module 73 is configured to receive, by the user, relationship information corresponding to the resource information on the second page;

The sending module 74 is configured to send the resource information and the relationship information selected by the user in the second page to the first server, so that the first server stores the corresponding record of the selected relationship information and the resource information, and the corresponding Record the authorization information as access to the above resource information.

further,

The request receiving module 71 is further configured to receive the existing authorization information that is sent by the first server according to the foregoing request, where the existing authorization information includes a corresponding record of the relationship information and the resource information that the user has selected; the display module 72 is further configured to: The above existing authorization information displays the relationship information selected by the user in the second page. Further, the second page is an inline frame page located in the first page or a new page opened by clicking a hyperlink or a button in the first page.

An embodiment of the present invention provides a server 8, as shown in FIG. 10, which includes:

The receiving module 81 is configured to receive a request of the user to pass the terminal;

The obtaining module 82 is configured to obtain the authorization information of the user according to the foregoing request, and obtain resource information that the user is authorized to access according to the authorization information;

The sending module 83 is configured to send the foregoing resource information to the terminal.

Further, the foregoing obtaining module 82 is specifically configured to: obtain, according to the foregoing authorization information, resource information that is authorized to be accessed by the user at the latest scheduled time or resource information that is a predetermined number of newly authorized accesses; the sending module is specifically configured to: The resource information authorized by the user at the most recent scheduled time or the resource information for the predetermined number of newly authorized accesses is sent to the terminal.

The embodiment of the present invention further provides a server 9, as shown in FIG. 11, which includes:

The receiving module 91 is configured to receive, by the terminal, a request for accessing resource information in the first server in the first domain by using the terminal;

The obtaining module 92 is configured to obtain the authorization information corresponding to the resource information, where the authorization information records the relationship information of the second server in the second domain corresponding to the resource information;

The processing module 93 is configured to determine whether the user belongs to the relationship information; when the determination is yes, the user is allowed to access the resource information, and when the determination is negative, the user is denied access to the resource information.

Further, the foregoing relationship information includes a contact or a group;

The processing module 93 is specifically configured to: determine whether the user belongs to the contact in the relationship information, and if yes, allow the user to access the resource information, and end the process; if not, the group in the relationship information And the identifier of the user is sent to the second server, so that the second server determines whether the user belongs to the group; and receives the determination result sent by the second server, and if the determination result is yes, the user is allowed to access the resource. Information, otherwise the above user is denied access to the resource information.

The embodiment of the present invention further provides a server 10, as shown in FIG. 12, which includes: The receiving module 101 is configured to receive a request sent by the user by using the terminal;

The sending module 102 is configured to send, to the terminal, the first page that includes the resource information according to the foregoing request, so that the terminal sends the acquiring request for acquiring the relationship information to the second server of the second domain according to the first page, and the terminal is Obtaining relationship information sent by the second server and displaying the relationship information on a second page;

The storage module 103 is configured to receive the resource information sent by the terminal, and the user selects the relationship information corresponding to the resource information on the second page, and stores the corresponding record of the selected relationship information and the resource information, and uses the corresponding record as the access Authorization information for resource information.

further,

The sending module 102 is further configured to: send the stored existing authorization information to the terminal according to the request, where the existing authorization information includes a corresponding record of the relationship information and the resource information that the user has selected.

The embodiment of the present invention further provides a cross-domain authorization system 11, as shown in FIG. 13, which includes: a first server 111, located in a first domain, configured to receive a request sent by a user through a terminal; Sending a first page that includes resource information, so that the terminal sends an acquisition request for acquiring the relationship information to the second server 112 of the second domain according to the first page, and the terminal acquires the relationship sent by the second server 112. And displaying the relationship information on the second page; receiving the resource information sent by the terminal, and selecting, by the user, the relationship information corresponding to the resource information on the second page, storing the corresponding record of the selected relationship information and the resource information, and The corresponding record is used as authorization information for accessing the resource information;

The second server 112 is located in the second domain, and is configured to send the relationship information of the user to the terminal. The terminal, the server, and the system provided by the foregoing embodiments can implement the relationship information of the resource information of the user in the first domain to the second domain, thereby improving the user experience.

It will be understood by those skilled in the art that all or part of the steps of implementing the above embodiments may be performed by a program to instruct related hardware, and the program may be stored in a computer readable storage medium at runtime. , performing all or part of the steps in the above embodiment methods. The above-mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like. The spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and the modifications of the invention

Claims

Claim

A method for setting a cross-domain authorization, which is characterized by comprising:

Receiving a request for user access to resource information;

Displaying, according to the request, a first page that includes resource information of the user, where the first page is provided by a first server in a first domain;

Displaying, according to the first page, a second page that includes relationship information of the user, where the second page is provided by a second server in the second domain;

Sending the resource information and the relationship information selected by the user in the second page to the first server, so that the first server stores the corresponding record of the selected relationship information and the resource information, and the corresponding record is recorded As authorization information for accessing the resource information.

2. The method of claim 1, further comprising:

Receiving the existing authorization information sent by the first server according to the request, where the existing authorization information includes a corresponding record of the relationship information and the resource information that the user has selected;

The displaying, by the first page, the second page that includes the relationship information of the user is:

The first page receives the existing authorization information and sends the existing authorization information to the second page;

The second page displays the relationship information that the user has selected in the existing authorization information.

3. The method of claim 2, wherein:

The second page is an inline frame page located in the first page, and the first page sends the existing authorization information to the second page, where the first page is configured to: The attribute specifies a page address of the second page, and the existing authorization information is included in the address parameter and transmitted to the second page; or

The second page is a new page that is opened by clicking a hyperlink or a button in the first page, and the first page sends the existing authorization information to the second page, where the first page is set by the first page. The page address corresponding to the hyperlink or button transmits the existing authorization information to the address parameter and transmits it to the first The second page of the second server.

4. The method of claim 3 wherein:

The second page displays the relationship information that the user has selected in the existing authorization information, where the second page receives the parameter of the existing authorization information in the second page address in the window loading event, and according to the The existing authorization information is displayed, and the relationship information selected by the user is displayed.

The method according to any one of claims 1 to 4, wherein: the second page includes a third page that points to the first page, and the third page is an inline frame page;

The receiving user selects the relationship information corresponding to the resource information on the second page, where the first page receives the second page, and specifies the page address of the third page by setting a source address attribute of the third page. The relationship information selected by the user is included in the address parameter and transmitted to the first page.

6. The method according to claim 5, wherein: the third page detects whether an address parameter in a source address attribute of the third page changes within a predetermined time, and occurs in the address parameter The changed address parameter is sent to the first page when the change occurs.

The method according to claim 6, wherein: the third page sends the relationship information selected by the user to the first page, where the third page is processed by calling a script function of the first page. The parameter in the source address attribute is used to transmit the relationship information selected by the user to the first page.

8. The method of claim 5, further comprising:

The first page and the second page respectively generate respective passwords;

The first page and the second page exchange and save the password of the other party;

When the information is transmitted between the subsequent first page and the second page, the first page or the second page generates a new password and sends it to the other party, and the first page or the second page stores the password and the new password sent by the other party. The verification is performed, and the first page or the second page performs corresponding processing when the new password sent by the other party is successfully verified.

9. The method according to claim 5, wherein: the relationship information or the authorized information selected by the user is sent by a query string parameter or a bookmark parameter set in a page address.

10. An authentication method for cross-domain authorization, which is characterized by:

Receiving, by the terminal, a request for accessing resource information in the first server in the first domain by using the terminal; Acquiring the authorization information corresponding to the resource information, where the authorization information records relationship information of the second server in the second domain corresponding to the resource information;

Determining whether the user belongs to the relationship information;

If so, the user is allowed to access the resource information, otherwise the user is denied access to the resource information.

11. The method of claim 10 wherein:

The relationship information includes a contact or a group;

Determining whether the user belongs to the relationship information; if yes, allowing the user to access the resource information, otherwise the step of denying the user access to the resource information is specifically:

Determining whether the user belongs to a contact in the relationship information, and if yes, allowing the user to access the resource information, and ending the process; if not, performing the following steps:

Sending the group in the relationship information and the identifier of the user to the second server, so that the second server determines whether the user belongs to the group;

Receiving the determination result sent by the second server, if the determination result is yes, the user is allowed to access the resource information, otherwise the user is denied access to the resource information.

12. An authentication method for cross-domain authorization, which is characterized by:

Receiving an access request of the user through the terminal;

Obtaining authorization information corresponding to the user according to the request;

Obtaining, according to the authorization information, resource information that the user is authorized to access;

Sending the resource information to the terminal.

13. The method of claim 12, comprising:

And obtaining, according to the authorization information, the resource information that the user is authorized to access, according to the authorization information, acquiring resource information that is authorized to be accessed by the user at a recent predetermined time or being authorized for a predetermined number of latest Resource information accessed;

The displaying the resource information on the page after the user is specifically:

The resource information of the authorized access of the user at the most recent predetermined time or the resource information for the predetermined number of newly authorized accesses is transmitted to the terminal.

14. A method for setting an inter-domain authorization, comprising:

Sending, by the request, the first page that includes the resource information of the user to the terminal, so that the terminal sends the acquiring request for acquiring the relationship information of the user to the second server of the second domain according to the first page. And acquiring, by the terminal, relationship information of the user sent by the second server, and displaying the relationship information on a second page;

Receiving resource information sent by the terminal, and selecting, by the user, relationship information corresponding to the resource information on the second page, storing a corresponding record of the selected relationship information and resource information, and using the corresponding record as accessing the resource Authorization information for the information.

15. The method of claim 14, further comprising:

The stored existing authorization information is sent to the terminal according to the request, and the existing authorization information includes a corresponding record of the relationship information and the resource information that the user has selected.

16. A terminal, comprising:

a display module, configured to display, according to the request, a first page that includes resource information of the user located in the first domain, and according to the first page, display relationship information of the user that is located in the second domain Second page;

a sending module, configured to send the resource information and the relationship information selected by the user in the second page to the first server, so that the first server stores the corresponding record of the selected relationship information and resource information, and The corresponding record is used as the authorization information for accessing the resource information.

17. The terminal of claim 16 wherein:

The receiving module is further configured to receive the existing authorization information that is sent by the first server according to the request, where the existing authorization information includes a corresponding record of the relationship information and the resource information that the user has selected;

The display module is further configured to: display the relationship information that the user has selected in the second page according to the existing authorization information.

18. The terminal of claim 16 or 17, wherein the second page is an inline frame page located in the first page or a new page opened by clicking a hyperlink or button in the first page.

19. A server, comprising:

a receiving module, configured to receive an access request sent by the user through the terminal;

An obtaining module, configured to acquire authorization information of the user according to the request, and obtain resource information that the user is authorized to access according to the authorization information;

And a sending module, configured to send the resource information to the terminal.

The server according to claim 19, wherein the acquiring module is configured to: acquire, according to the authorization information, resource information that is authorized to be accessed by the user at a recent predetermined time or for a predetermined number of latest ones And the sending module is configured to: send the resource information that the user is authorized to access at the most recent predetermined time or the resource information that is the latest authorized access to the terminal.

21. A server, comprising:

a receiving module, configured to receive, by the terminal, a request for accessing resource information in the first server in the first domain by using the terminal;

An obtaining module, configured to acquire authorization information corresponding to the resource information, where the authorization information records relationship information of the second server in the second domain corresponding to the resource information;

The processing module is configured to determine whether the user belongs to the relationship information; when the determination is yes, the user is allowed to access the resource information, and when the determination is negative, the user is denied access to the resource information.

22. The server according to claim 21, wherein: the relationship information comprises a contact or a group;

The processing module is specifically configured to: determine whether the user belongs to a contact in the relationship information, and if yes, allow the user to access the resource information, and end the process; if not, the relationship is The group in the information and the identifier of the user are sent to the second server, so that the second server determines whether the user belongs to the group; and receives the determination result sent by the second server, if the determination result is Yes, the user is allowed to access the resource information, otherwise the user is denied access to the resource information.

23. A server, comprising:

a sending module, configured to send, to the terminal, the first page that includes the resource information, according to the request, so that the terminal sends the acquiring request for acquiring the relationship information to the second server of the second domain according to the first page, and The terminal acquires relationship information sent by the second server and displays the relationship information on the second page;

a storage module, configured to receive resource information sent by the terminal, and the user selects relationship information corresponding to the resource information on the second page, and stores a corresponding record of the selected relationship information and resource information, and the corresponding record is As authorization information for accessing the resource information.

24. The server of claim 23, wherein:

The sending module is further configured to send the stored existing authorization information to the terminal according to the request, where the existing authorization information includes a corresponding record of the relationship information and the resource information that the user has selected.

25. A cross-domain authorization system, comprising:

a first server, configured to receive, by the first domain, a request for accessing resource information sent by the user by using the terminal; sending, according to the request, a first page that includes resource information of the user, to facilitate the terminal And sending, by the first page, an acquisition request for acquiring the relationship information to the second server located in the second domain, and the terminal acquiring the relationship information sent by the second server and displaying the relationship information on the second page; The resource information sent by the terminal and the user select the relationship information corresponding to the resource information on the second page, store the corresponding record of the selected relationship information and the resource information, and use the corresponding record as the access to the resource information. Authorization information;

The second server is located in the second domain, and is configured to send the relationship information of the user to the terminal.