CN101771676A - Setting and authentication method for cross-domain authorization and relevant device and system - Google Patents

Abstract

The invention discloses a method for setting cross-domain authorization. The method includes the steps of: receiving a user's request for accessing resource information; displaying a first page containing resource information according to the request, and the first page is in the first domain provided by the first server; according to the first page, a second page containing the relationship information of the user is displayed, and the second page is provided by the second server in the second domain; Selecting the relationship information corresponding to the resource information; sending the resource information and the relationship information selected on the second page to the first server, so that the first server stores the correspondence between the selected relationship information and the resource information record, and use the corresponding record as authorization information for accessing the resource information. The embodiment of the present invention also discloses an authentication method, terminal, related device and system for cross-domain authorization. By adopting the embodiment of the present invention, the resource information of the user in the first domain can be authorized to the relationship information of the second domain, Thereby, user experience can be improved.

Description

A cross-domain authorization setting, authentication method, related device and system

technical field

The invention relates to the field of computer applications, in particular to a cross-domain authorization setting, a signing method, a related device and a system.

Background technique

SNS (Social Network Site) website, commonly known as social networking site server in Chinese, is a network virtual social network platform based on the idea of social network relationship system. From Myspace to Facebook, Kaixin.com and Xiaonei.com, social network servers at home and abroad have matured and become a part of daily life for more and more people. At the same time, there are a large number of various applications provided to users in the social networking site platform. The applications are generally provided by the application server. It is these rich and colorful social applications that really bring value to users. The application website server and the social networking website server are often separated and independent, and may be operated by different service providers, and the application website server and the social networking website server are generally located in different domains. Users can have a lot of resource information in the application website server, such as photos, videos, diaries, micro-blogs, URL favorites or location information, etc., while the user's relationship information is stored in the social networking website server, such as contacts (also called information such as friend lists, etc.) and groups.

Users want to share their resources on the application website server with certain contacts or designated groups in social networking sites with restrictions. If the relationship information and resource information are in the same domain, it can be realized through ordinary permission settings. , and if they are not in the same domain, the application website server cannot freely access the user’s relationship information on the social networking website server without permission. In this way, how to authorize the resource information in the application website server to the user of the relationship information in different domains That is, cross-domain authorization is a problem that needs to be solved at present.

Contents of the invention

Embodiments of the present invention provide a cross-domain authorization setting, signing method, related device and system, so as to authorize the user's resource information in the first domain to the relationship information in the second domain, thereby improving user experience.

An embodiment of the present invention provides a method for setting cross-domain authorization, including:

Receive requests from users to access resource information;

displaying a first page containing resource information of the user according to the above request, where the first page is provided by a first server in the first domain;

displaying a second page containing the relationship information of the user according to the first page, the second page being provided by a second server in the second domain;

Receiving the user's selection of relationship information corresponding to the above resource information on the above second page;

Send the resource information and the relationship information selected by the user on the second page to the first server, so that the first server stores the corresponding record of the selected relationship information and resource information, and uses the corresponding record as the resource information for accessing the resource information authorization information.

The embodiment of the present invention also provides an authentication method for cross-domain authorization, which includes:

receiving a request from a user to access resource information in the first server in the first domain through the terminal;

Obtain authorization information corresponding to the resource information, where the authorization information records the relationship information of the second server in the second domain corresponding to the resource information;

Determine whether the above-mentioned user belongs to the above-mentioned relationship information;

If so, allow the user to access the above resource information, otherwise deny the above user to access the above resource information.

The embodiment of the present invention also provides an authentication method for cross-domain authorization, which includes:

Receive the user's request through the terminal;

Obtain the authorization information of the above user according to the above request;

Obtain resource information that the above user is authorized to access according to the above authorization information;

Send the resource information to the terminal.

The embodiment of the present invention also provides a method for setting cross-domain authorization, which includes:

Receive the request for accessing resource information sent by the user through the terminal;

Send a first page containing resource information to the terminal according to the above request, so that the above terminal sends an acquisition request for obtaining relationship information to a second server in the second domain according to the first page, and the above terminal obtains the second server Send the relationship information and display the above relationship information on the second page;

receiving the resource information sent by the terminal and the relationship information corresponding to the above-mentioned resource information selected by the user on the second page, storing the corresponding records of the selected relationship information and resource information, and using the corresponding record as a key to access the above-mentioned resource information authorization information.

The embodiment of the present invention also provides a terminal, which includes:

A request receiving module, configured to receive a user's request for accessing resource information;

A display module, configured to display the first page containing the resource information of the user located in the first domain according to the above request, and display the second page containing the relationship information of the user located in the second domain according to the above first page ;

A relationship information receiving module, configured to receive the relationship information corresponding to the resource information selected by the user on the second page;

A sending module, configured to send the above resource information and the relationship information selected on the second page to the first server, so that the first server stores the corresponding record of the above selected relationship information and resource information, and uses the above corresponding record as the access location Authorization information for the above resource information.

The embodiment of the present invention also provides a server, which is characterized in that it includes:

a receiving module, configured to receive a user's request through the terminal;

An obtaining module, configured to obtain authorization information of the user according to the above request, and obtain resource information that the user is authorized to access according to the authorization information;

A sending module, configured to send the above resource information to the terminal.

The embodiment of the present invention also provides a server, which includes:

A receiving module, configured to receive a request from a user to access resource information in the first server in the first domain through the terminal;

An acquisition module, configured to acquire authorization information corresponding to the resource information, where the authorization information records the relationship information of the second server in the second domain corresponding to the resource information;

A processing module, configured to judge whether the user belongs to the relationship information; if the judgment is yes, allow the user to access the resource information; if the judgment is no, deny the user access to the resource information.

The embodiment of the present invention also provides a server, which includes:

A receiving module, configured to receive a request sent by the user through the terminal;

A sending module, configured to send a first page containing resource information to the terminal according to the above request, so that the above terminal sends an acquisition request for obtaining relationship information to a second server in the second domain according to the first page, and the terminal Obtaining the relationship information sent by the second server and displaying the above relationship information on the second page;

A storage module, configured to receive the resource information sent by the terminal and the relationship information corresponding to the above resource information selected by the user on the second page, store the corresponding record of the selected relationship information and resource information, and use the above corresponding record as an access Authorization information of the resource information.

The embodiment of the present invention also provides a cross-domain authorization system, which is characterized in that it includes:

The first server, located in the first domain, is used to receive the request sent by the user through the terminal; send the first page containing resource information to the terminal according to the above request, so that the above terminal sends the first page to the second domain in the second domain according to the first page. The second server sends an acquisition request for acquiring relationship information, and the terminal acquires the relationship information sent by the second server and displays the relationship information on the second page; the resource information sent by the receiving terminal corresponds to the user's selection on the second page Based on the relationship information of the resource information, store the corresponding records of the selected relationship information and resource information, and use the corresponding records as authorization information for accessing the resource information;

The second server, located in the second domain, is configured to send the relationship information of the above-mentioned user to the above-mentioned terminal.

By adopting the cross-domain authorization setting, authentication method, terminal, server and system provided by the embodiment of the present invention, the resource information of the user in the first domain can be authorized to the relationship information of the user in another domain, such as contacts , groups, etc., thereby improving the user experience. Users can directly use their existing relationship information in the second server to associate and authorize resources in the first server, that is, users can conveniently share and authorize resources from their own perspective.

Description of drawings

FIG. 1 is a flowchart of a method for setting cross-domain authorization provided by an embodiment of the present invention;

FIG. 2 is a flow chart of a method for setting cross-domain authorization provided by another embodiment of the present invention;

FIG. 3 is a schematic diagram of a cross-domain authorization setting method provided by another embodiment of the present invention;

FIG. 4 is a flowchart of a method for setting cross-domain authorization provided by another embodiment of the present invention;

FIG. 5 is a schematic diagram of a terminal browser in a method for setting cross-domain authorization provided by an embodiment of the present invention;

FIG. 6 is a flow chart of an authentication method for cross-domain authorization provided by an embodiment of the present invention;

FIG. 7 is a flow chart of an authentication method for cross-domain authorization provided by another embodiment of the present invention;

FIG. 8 is a flow chart of an authentication method for cross-domain authorization provided by another embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a terminal provided by an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of a server provided by an embodiment of the present invention;

FIG. 11 is a schematic structural diagram of a server provided by another embodiment of the present invention;

FIG. 12 is a schematic structural diagram of a server provided by another embodiment of the present invention;

Fig. 13 is a schematic structural diagram of a cross-domain authorization system provided by an embodiment of the present invention.

Detailed ways

An embodiment of the present invention provides a method for setting cross-domain authorization, as shown in Figure 1, which includes:

101: Receive a request from a user to access resource information;

102: Display the first page containing the resource information of the user according to the above request, where the first page is provided by the first server in the first domain;

103: Display a second page containing the relationship information of the user according to the first page, where the second page is provided by a second server in the second domain;

104: Receive the user's selection of relationship information corresponding to the above resource information on the above second page;

105: Send the above-mentioned resource information and the relationship information selected on the second page to the above-mentioned first server, so that the first server stores the corresponding record of the above-mentioned selected relationship information and resource information, and uses the above-mentioned corresponding record as access to the above-mentioned resource information authorization information.

By adopting the foregoing embodiments, it is possible to authorize the resource information of the user in the first domain to the relationship information of the second domain, thereby improving user experience.

In another embodiment provided by the present invention, the first server in the first domain stores the user's resource information, such as photos, videos, website favorites, blog logs, etc.; The second server in the domain stores relationship information such as contacts and groups of the user. As shown in Figure 2, a method for setting cross-domain authorization provided by an embodiment of the present invention mainly includes the following steps:

Step 201, the terminal receives a user's request to access resource information.

The user passes through the resource information in the first server of the terminal. The access method can use OpenID technology, that is, the first server is the relying party of OpenID (Open ID), the second server is the provider of OpenID, and the first server receives the user's OpenID. According to the OpenID protocol, through redirection, the browser of the terminal will be forwarded to the second page of the second server to authenticate the user. The user provides a password or other authentication information such as fingerprints, etc. After passing the above authentication, Return to the first page displayed on the terminal by the first server through redirection, and the first page contains resource information of the user, such as photos, videos, URL favorites, blog logs, and the like.

The first server can also set a session cookie on the browser side of the terminal to maintain the current user session, so that the user does not need to perform authentication when subsequently accessing the first server. If the browser of the terminal disables cookies, the session information can be directly carried in the HTTP request and response messages to maintain the current user session. These two ways of maintaining sessions are commonly used technologies in Internet services, and will not be repeated here.

In addition to using OpenID technology, other cross-domain authentication technologies such as Single Sign On (SSO, Single Sign On), including OpenSSO and Microsoft Passport, can also be used to simplify the authorization process of user resource information. The browser logs in to the first server once, and the user's browser can directly access the second server to obtain the user's relationship information when authorization of resource information is required later, without the need for authentication on the second server again.

Of course, if you don't want to use additional cross-domain authentication technology, you can also let the user access the second server after accessing the first server to obtain the user's relationship information, that is, just separate the second server again.

Step 202, the first server displays the first page through the browser of the user terminal, that is, the authorization page of resource information in the first server, and the first page displays resource information and a button or hyperlink for confirming authorization. The hypertext codes (including script codes) in the first page are all generated by the first server, and sent by the first server to the browser end of the user terminal for display.

Step 203, displaying a second page containing relationship information according to the first page.

The browser of the terminal also displays a second page including the relationship information of the user, and the hypertext code (including script code) of the second page is generated by the second server. The second page can be displayed in a variety of ways, such as being displayed in the form of an iframe (Inline Frame, inline frame) on the first page, or when a button or link is clicked on the first page, a new browsing page will pop up. The browser page displays the user's relationship information such as contacts and groups.

The second page also includes an iframe frame page pointing to the first server, which is called the third page, and is generally set as a hidden style. Through the iframe frame page pointing to the first server in the above second page, the limitation of direct cross-domain communication in the browser can be broken, so that the first server and the second server can transmit and communicate information through the user's browser.

Please refer to Figure 3, the second page is displayed in the form of iframe in the first page, it can be seen that through a first page from the first server to the second page of the second server, and then to the third page of the first server, Going back to the first page of the first server, such a circular information transmission channel realizes the cross-domain transmission of relationship information in the browser, so that the first server can easily obtain the relationship information of users in the second server, Thereby authorizing the resources in the application.

The second page can be displayed by setting the source address of the second page in the first page. For example, the source address attribute of the second page in iframe form can be set in the javascript script function of the first page, for example as follows:

iframe1.src="http://snsexample.com/relationship.php";

For the second page in the pop-up form, directly use the hyperlink address such as:

<a href="http://snsexample.com/relationship.php"target="_blank">Display groups and contacts</a>

Or the script corresponding to the click event of the button opens a new page, such as:

window.open('http://snsexample.com/relationship.Php');

If the user is authenticated by the second server when passing through the first server of the terminal, such as using OpenID or a single point, that is, when the user passes the identity authentication of the second server in step 101, the second server can browse through the user's terminal. The corresponding session cookie item is set at the server end, and the data of the cookie item may include session information such as a session ID, so that the user does not need to perform authentication when accessing the second server in the current session. That is, the second page first obtains the cookie data of the browser of the user's terminal, and then carries the cookie data to request the second server to obtain the user's relationship information, and displays the obtained relationship information on the page.

If the first server and the second server cannot use OpenID or single point to make the user authenticate in only one server, after the user is on the first server, because the second server corresponding to the second page does not have corresponding session information Such as cookie data, before the second page displays the user's relationship information, the user should be prompted to perform identity authentication on the second server.

As shown in Figure 4, the first page contains resource information, such as photos, and a button to confirm authorization. The first page can contain the second page in the form of an inline frame, and the relationship information displayed on the second page can include a contact list, and the contacts can be displayed in groups, such as colleagues, classmates, and family members. A checkbox is displayed in front of the contact or group name. In addition, some public groups and group members created or joined by the user may also be displayed for the user to select. Whether it is a group of contacts or a public group, it can be represented by a unique group identifier. The second page may display the name or nickname of the contact, and the name of the group, but in actual information transmission, the user ID and group ID of the contact are generally used.

In addition to the above-mentioned contacts and groups, the second server can also detect other users who have recently communicated with the user, such as sending messages, emails, and phone calls in the second server, and then display these users in the second page. In the future, the telecommunications network and the Internet will be closely integrated. In the second server operated by the telecommunications operator, it is easy to obtain the user's communication records (such as text messages, phone calls, etc.), and those who have communicated with the user may not necessarily be in the above-mentioned user's contact. People and groups, but sometimes the user wishes to temporarily share some resources with these people who have communication contacts, and the information of these people (which can be called temporary contacts) actually also belongs to the user's relationship data.

In addition, since the user may have authorized some relationship information such as contacts or groups for the current resource information, the first page may also request to obtain the user's existing authorization information for the current resource information from the first server, and The authorized contact and group information are passed to the second page as parameters of the second page source address URL (Uniform Resource Locator). Examples are as follows:

iframe1.src="http://snsexample.com/relationship.php#groups=group1";

The parameter in the bookmark, that is, the part after the above-mentioned address "#" indicates that the current resource has been authorized to the group group1.

In addition to using bookmark parameters, you can also use parameters included after the query string "?" of the source address, such as:

iframe1.src="http://snsexample.com/relationshipP.Php?groups=group1";

Of course, the bookmark "#" is the best way to use the same address and transmit a large amount of information through the URL of the iframe.

The second page can obtain the above parameters in the current page address when the window loading event (window.onLoad) occurs, and then set the authorized group such as group1 as selected according to the above parameters when displaying the user's relationship information state. In this way, the user can know which relationship information such as contacts or groups has been authorized to access the current resource information. Examples of parameters that include both groups and contacts are as follows:

iframe1.src="http://snsexample.com/relationshipP.Php#groups=group1&

contacts=usera+userb";

The parameters in the above address indicate that the current resource has been authorized to the group group1 and the contacts usera and userb. group1 is the group ID, usera and userb are user IDs.

Step 204, the user selects relationship information on the second page, and transmits the relationship information selected by the user to the third page. On the second page, when the user selects or deselects a group or contact event through the terminal (such as the onClick event of the check box corresponding to the contact or group), the currently selected relationship information (group or contact ) to the third page, the method of delivery can specify the page address of the third page by setting the source address attribute of the third page, and include the relationship information selected by the user in the address parameter and send it to the third page. The source address of the third page set is as follows:

iframe2.src="http://appexample.com/auth.php#groups=group1+group2&

Contacts=usera+userb+userc”;

The parameter in the above address indicates that the current resource is selected and authorized to groups group1 and group2 and contacts usera, userb and userc.

Step 205, the third page transmits the relationship information selected by the user sent by the second page to the first page. The third page sets a timer function, executes once every predetermined time interval such as 500 milliseconds, obtains the relationship information selected by the user in the parameters in the current page address, and passes it to the first page when it changes. Since the predetermined time interval is very short (generally less than 1 second), the relationship information acquired by the third page can reflect the authorization choice made by the user on the second page in real time, and then these relationship information (such as "groups=group1+group2&contacts= usera+userb+userc") to the corresponding script program on the first page for processing. Because the third page and the first page are located in the same domain, that is, both are in the first server, there is no problem of cross-domain communication, and the relationship information can be transmitted normally. For the second page in the form of an inline frame, an example of the processing script in the third page is as follows:

function transmit(){

parent.parent.receive(window.location.hash);

}

setInterval(transmit, 500);

The above script executes the above transmit() function every 500 milliseconds, and passes the parameters in the source address of this page (that is, the content corresponding to window.location.hash) to the corresponding script on the first page (that is, the object parent.parent) The program (ie, the above-mentioned receive function) processes.

For the second page in the pop-up form, the processing script in the third page is as follows:

function transmit(){

parent.opener.receive(window.location.hash);

}

setInterval(transmit, 500);

The first page corresponds to the parent.opener object, which is different from the second page in the form of an inline frame.

Step 206, after the user determines to authorize resource information for the selected contacts and/or groups, the first page submits the relationship information and resource information finally selected by the user to the first server.

The first page includes a button or a hyperlink to confirm authorization, which can be named "Share" or "OK". When the button is activated by the user, the first page submits the relationship information and resource information finally selected by the user to the first server. The first server stores the corresponding record of the relationship information and resource information selected by the user, and uses the corresponding record as authorization information for accessing the resource information. In addition, the authorization information may also include authorization time, that is, the time when the first page submits the relationship information and corresponding resource information finally selected by the user to the first server.

It can be seen from the above steps that the transmission of the relationship information corresponding to the resource information is completed between the first server and the second server only on the browser side of the terminal, such as the authorized relationship information is transmitted from the first page of the first server to the second server. The second page of the second server and the relationship information selected by the user are transmitted from the second page of the second server to the first page via the third page. Cross-domain resource authorization can be completed without directly transmitting any data between the first server and the second server, which is simple and efficient, and fully utilizes the computing capability of the terminal. The first server that lacks relationship information can make full use of the user relationship information in the second server to enhance the social function of its own application and attract more users to visit.

Another embodiment of the present invention provides a method for setting cross-domain authorization. If the user's terminal browser disables cookies, in order to ensure the security of cross-domain information transmission, before the information is transmitted, firstly, between the first domain and the second domain. The passwords are exchanged between the two domains, and the passwords must be carried when transmitting information in the future, and the passwords must be verified when receiving the transmitted information. Please refer to Figure 5, the specific process is as follows:

Step 301, the first page acquires the first password. The first password may be generated by the first page itself using a random function, or the first password may be requested from the first server. Because some browsers themselves cannot use the random function to generate a password with high security, it is recommended to use the method of obtaining the password from the server. The password can be a random string. The session ID (Session ID) between the first server and the user's browser can be used as the first password, because the session ID is usually an unpredictable random character string.

Step 302, the first page transmits the above-mentioned first password to the second page. In the window loading event (window.onLoad) of the second page, the password parameter set in the source address of the second page of the first page is obtained, for example, the password may be included in the bookmark parameter. The second page caches the received first password for subsequent password verification.

Step 303, the second page obtains the second password, and sends the second password to the third page. The second password can also be generated by the second page itself, or request the second password from the second server, and pass the second password to the third page, or use the session identifier between the second server and the user's browser (Session ID) as the second password.

Step 304, the third page transmits the second password to the first page. The first page caches the second password for subsequent password verification. So far, the cross-domain password exchange between the first server and the second server is completed.

Step 305 , when subsequently transmitting the relationship information selected by the user, both the first page and the second page should carry the passwords corresponding to the respective domains in the set URL bookmark parameters. For example, when setting the source address attribute of the second page on the first page, the example of carrying the password is as follows:

iframe1.src="http://snsexample.com/relationship.php#groups=group1&

     password=qw3e45s32328f3nl";

In addition to the relationship information, the bookmark parameter of the above address also includes the first password "qw3e45s32328f3nl".

Step 306, the second page verifies the password. In the window loading event of the second page, take out the password in the bookmark parameter in the address of this window, such as the above-mentioned password "qw3e45s32328f3nl", and then compare and verify the password with the first cached password before, and proceed to subsequent processing after the verification is passed. For example, in the subsequent steps, the authorized relationship information in the parameters needs to be taken out.

Step 307, when the second page transmits the relationship information selected by the user to the third page, it also carries the second password.

Step 308, the third page performs password verification. In the window timer function on the third page, take out the password in the bookmark parameter in the address of this window, and then compare and verify the password with the previously cached second password, and proceed to subsequent processing after the verification is passed.

In this way, the request to access the corresponding address of the second page or the third page in other places other than the current browser instance will not leak the user's relationship information or resource authorization information, etc., because the password cannot be obtained.

An authentication method for cross-domain authorization provided by an embodiment of the present invention describes an authentication process when other users access resource information in the first server. For clarity of description, the user who owns the resource information in the first server is referred to as the first user, and the user who wants to access the resource information of the first user is referred to as the second user. Assume that the first user has authorized resource information in the first server, such as album P, to group A, and the members in group A include the second user. Please refer to Fig. 6, the steps of this embodiment are as follows:

Step 401, the first server receives a request from a second user to access resource information of the first user such as album P, the resource information is located in the above-mentioned first server in the first domain, and the above-mentioned request can be performed by the second user using, for example, OpenID , can also be done in other ways.

Step 402, the first server queries and obtains the authorization information of the first user for the resource information, and the authorization information records the relationship information of the resource information corresponding to the second server in the second domain.

Step 403, the first server judges whether the second user belongs to the above relationship information.

Step 404, if yes, the first server allows the second user to access the above resource information, otherwise denies the second user to access the above resource information.

Through the method provided in the foregoing embodiments, the first server can share resource information authorized by another user with the user through authentication of the user, thereby improving user experience.

In order for the first server to obtain as little user relationship information as possible, such as all groups to which the second user belongs, and there may be many groups to which the second user belongs, it is not convenient for the second server to pass all of them to the first server , that is, in this embodiment, the first server only stores the contact information corresponding to the resource information of the first user and the identifier of the group, but does not store specific contacts in the group. For the steps of the authentication method for cross-domain authorization provided by another embodiment of the present invention, please refer to Figure 7 for details:

Step 501, the first server receives a request from a second user to access the resource information of the first user, such as album P. The above-mentioned first server for the second user may use OpenID or other methods.

Step 502, the first server obtains the authorization information record of the first user for the resource information according to the above resource information, and judges whether the second user is an authorized contact (including a temporary contact), and if so, allows the second user to If the user accesses, end this process; otherwise, go to step 503.

Step 503: The first server sends the group ID authorized by the first user to the resource authorization information record and the ID of the second user to the second server, and requests the second server to determine whether the second user is the above-mentioned authorized user. members of the group. When the second user is a member of at least one of the authorized groups, the second server returns an affirmative determination result.

Step 504, the first server receives the determination result returned by the second server, if the determination result is positive, the first server allows the second user to access, otherwise prohibits the access.

Through the method provided in the foregoing embodiments, the first server can share resource information authorized by another user with the user through authentication of the user, thereby improving user experience.

In order to display the resources shared by other users that the user has the right to access after the user logs in to the first server, so that the user can know which resources he has access to, another embodiment of the present invention provides a cross-domain authorized Please refer to Figure 8 for the authentication method, which mainly includes steps:

Step 601. The first server receives the second user's access request, and retrieves the authorized access resource information corresponding to the group to which the second user belongs, and the authorized access resource information corresponding to the second user itself from the stored authorization information. Authorized access resource information. Since there may be many retrieved resources, the corresponding authorization time can be used to filter the resources, such as only retrieving the resources authorized to access within a predetermined period of time (such as within the last week), or the latest (authorization time is the latest) close to the current time) a predetermined amount (such as the top 10 recently authorized) resources, etc.

Step 602, display the above resource information on the page behind the second user. Through the above solution, it can be seen that a personalized final home page is provided for the user, displaying the resources that the user can access. Especially those resources that have been shared recently.

The method provided by the embodiment of the present invention enables the user to display resource information shared by other users that the user has access to after logging in to the first server, thereby improving user experience.

An embodiment of the present invention provides a terminal 7, as shown in FIG. 9, which includes:

A request receiving module 71, configured to receive a request from a user to access resource information;

The display module 72 is configured to display the first page containing the resource information of the user located in the first domain according to the above request, and display the second page containing the relationship information of the user located in the second domain according to the above-mentioned first page ;

A relationship information receiving module 73, configured to receive the relationship information corresponding to the resource information selected by the user on the second page;

The sending module 74 is configured to send the above-mentioned resource information and the relationship information selected by the user on the second page to the first server, so that the first server stores the corresponding record of the above-mentioned selected relationship information and resource information, and stores the above-mentioned corresponding Record as authorization information for accessing the above resource information.

further,

The request receiving module 71 is also configured to receive the existing authorization information sent by the first server according to the above request, the above existing authorization information includes the corresponding record of the relationship information and resource information selected by the user;

The display module 72 is further configured to: display the relationship information selected by the user on the second page according to the existing authorization information.

Further, the above-mentioned second page is an inline frame page located in the first page or a new page opened by clicking a hyperlink or a button on the first page.

An embodiment of the present invention provides a server 8, as shown in FIG. 10, which includes:

A receiving module 81, configured to receive a user's request through the terminal;

An obtaining module 82, configured to obtain authorization information of the above user according to the above request, and obtain resource information that the above user is authorized to access according to the above authorization information;

The sending module 83 is configured to send the above resource information to the above terminal.

Further, the acquisition module 82 is specifically configured to: obtain the resource information authorized to be accessed by the user at the latest predetermined time or the latest resource information authorized to access a predetermined number according to the authorization information; the sending module is specifically configured to: The resource information that the above user is authorized to access at the latest predetermined time or the latest resource information that is a predetermined number of authorized access is sent to the above terminal.

The embodiment of the present invention also provides a server 9, as shown in FIG. 11, which includes:

The receiving module 91 is configured to receive a user's request for accessing resource information in the first server in the first domain through the terminal;

An acquisition module 92, configured to acquire authorization information corresponding to the resource information, where the authorization information records the relationship information of the second server in the second domain corresponding to the resource information;

The processing module 93 is configured to judge whether the above-mentioned user belongs to the above-mentioned relationship information; if the judgment is yes, the above-mentioned user is allowed to access the above-mentioned resource information, and when the judgment is no, the above-mentioned user is denied to access the above-mentioned resource information.

Further, the above relationship information includes contacts or groups;

The above-mentioned processing module 93 is specifically used to: determine whether the above-mentioned user belongs to the contact person in the above-mentioned relationship information, if yes, then allow the above-mentioned user to access the above-mentioned resource information, and end this process; if not, then delete the group in the above-mentioned relationship information And the identification of the above-mentioned user is sent to the second server, so that the second server can judge whether the user belongs to the above-mentioned group; receive the judgment result sent by the above-mentioned second server, and if the above-mentioned judgment result is yes, then allow the user to access the resource information, otherwise deny the user access to the resource information.

The embodiment of the present invention also provides a server 10, as shown in FIG. 12, which includes:

A receiving module 101, configured to receive a request sent by a user through a terminal;

The sending module 102 is configured to send a first page containing resource information to the terminal according to the above request, so that the above terminal sends an acquisition request for obtaining relationship information to a second server in the second domain according to the first page, and the above terminal Obtaining the relationship information sent by the second server and displaying the relationship information on a second page;

The storage module 103 is configured to receive the resource information sent by the terminal and the relationship information corresponding to the resource information selected by the user on the second page, store the corresponding record between the selected relationship information and the resource information, and use the above corresponding record as an access to the above-mentioned Authorization information for resource information.

further,

The above sending module 102 is further configured to: send stored existing authorization information to the terminal according to the above request, the above existing authorization information includes corresponding records of relationship information and resource information selected by the user.

The embodiment of the present invention also provides a cross-domain authorization system 11, as shown in Figure 13, which includes:

The first server 111, located in the first domain, is configured to receive a request sent by the user through the terminal;

Send the first page containing resource information to the terminal according to the above request, so that the above terminal sends an acquisition request for obtaining relationship information to the second server 112 of the second domain according to the first page, and the above terminal obtains the second The relationship information sent by the server 112 and display the above relationship information on the second page; receiving the resource information sent by the terminal and the relationship information corresponding to the above resource information selected by the user on the second page, and storing the above selected relationship information and resource information. Corresponding records, using the above corresponding records as authorization information for accessing the resource information;

The second server 112, located in the second domain, is configured to send the above-mentioned user relationship information to the terminal.

Through the terminal, server, and system provided in the above embodiments, it is possible to authorize the resource information of the user in the first domain to the relationship information of the second domain, thereby improving user experience.

Those of ordinary skill in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the program can be executed when running , performing all or part of the steps in the methods of the foregoing embodiments. The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, and the like.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (25)

1. the method to set up of a cross-domain authorization is characterized in that, comprising:

Receive the request of user access resources information;

Demonstration comprises first page of described user's resource information according to described request, and described first page is that first server that is in first territory provides;

Show second page of the relation information that comprises described user according to described first page, described second page is that the second server that is in second territory provides;

Receive the user at the relation information of described second page selection corresponding to described resource information;

Send the relation information that described resource information and described user select to described first server in second page, so that the relation information of the described selection of first server stores and the corresponding record of resource information, and with the authorization message of described corresponding record as the described resource information of visit.

2. the method for claim 1 is characterized in that, also comprises:

Receive first server according to the existing authorization message that described request sends, comprise the relation information that the user has selected and the corresponding record of resource information in the described existing authorization message;

Described second page that includes described user's relation information according to described first page demonstration is specially:

Described first page receives described existing authorization message and described existing authorization message is sent to second page;

Second page shows the relation information that the user has selected in the described existing authorization message.

3. method as claimed in claim 2 is characterized in that:

Described second page is the inline frame page that is arranged in first page, described first page sends to second page with described existing authorization message and is specially: described first page is specified the page address of second page by the source address attribute that second page is set, and described existing authorization message is included in sends second page in the address parameter to; Or

The new page that described second page is opened for clickable hyperlinks or button in first page, described first page sends to second page with described existing authorization message and is specially: described first page is included in described existing authorization message second page that sends second server in the address parameter to by described hyperlink or button corresponding page address are set.

4. method as claimed in claim 3 is characterized in that:

Described second page shows that the relation information that the user has selected in the described existing authorization message is specially:

Described second page takes out the parameter that includes existing authorization message in second page address in the window load events, and according to described existing authorization message, the relation information that explicit user has been selected.

5. as the described method of claim 1-4, it is characterized in that: include the 3rd page that points to first page in described second page, described the 3rd page is the inline frame page;

Described reception user selects to be specially corresponding to the relation information of described resource information at described second page: described first page receives second page and specifies the page address of the 3rd page by the source address attribute that described the 3rd page is set, and user-selected relation information is included in sends first page in the address parameter to.

6. method as claimed in claim 5, it is characterized in that: whether the address parameter that described the 3rd page detects in the source address attribute of described the 3rd page within the predetermined time changes, and when described address parameter changes the address parameter that changes is sent to described first page.

7. method as claimed in claim 6, it is characterized in that: described the 3rd page sends to first page with user-selected relation information and is specially: described the 3rd page is handled parameter in the described source address attribute by the script function of calling first page, sends user-selected relation information to first page.

8. method as claimed in claim 5 is characterized in that: also comprise:

First page and second page generate password separately respectively;

First page and the exchange of second page and preservation the other side's password;

When the information of carrying out between follow-up first page and second page transmits, first page or second page generate the password of respectively making a fresh start and send to the other side, first page or second page verify the new password that the password preserved and the other side send over, and just handles accordingly when the new password that the other side is sended over when first page or second page is proved to be successful.

9. method as claimed in claim 5 is characterized in that: relation information that described user selects or existing authorization message are by sending in query string parameter that is arranged on the page address or the bookmark parameter.

10. the method for authenticating of a cross-domain authorization is characterized in that, comprising:

Receive the user is in resource information in first server of first territory by terminal access request;

Obtain the authorization message of described resource information correspondence, described authorization message records the relation information that is in the second territory second server of described resource information correspondence;

Judge whether described user belongs to described relation information;

If then allow the described resource information of described user capture, otherwise refuse the described resource information of described user capture.

11. method as claimed in claim 10 is characterized in that:

Described relation information comprises contact person or group;

Describedly judge whether described user belongs to described relation information; If then allow the described resource information of described user capture, otherwise the step of refusing the described resource information of described user capture is specially:

Judge whether described user belongs to the contact person in the described relation information, if, then allow the described resource information of described user capture, and process ends; If not, then carry out following step:

Group in the described relation information and described user's sign is sent to second server, whether belong to described group so that second server is judged described user;

Receive the judged result that described second server sends, if described judged result for being, then allows the described resource information of user capture, otherwise refuses the described resource information of described user capture.

12. the method for authenticating of a cross-domain authorization is characterized in that, comprising:

Receive the access request of user by terminal;

Obtain authorization message according to described request corresponding to described user;

Obtain described user according to described authorization message and be authorized to accessed resources information;

Described resource information is sent to described terminal.

13. method as claimed in claim 12 is characterized in that, comprising:

Describedly obtain described user according to described authorization message and be authorized to accessed resources information and be specially:

Obtain described user being authorized to accessed resources information or being authorized to accessed resources information for predetermined quantity up-to-date according to described authorization message in nearest scheduled time;

Described described resource information is presented on the page behind the described user is specially:

With described user being authorized to accessed resources information or sending to described terminal in nearest scheduled time for predetermined quantity up-to-date is authorized to accessed resources information.

14. the method to set up of a cross-domain authorization is characterized in that, comprising:

Receive the request of user by the access resources information of terminal transmission;

Send first page of the resource information that includes described user to terminal according to described request, so that described terminal sends the request of obtaining of the relation information that obtains described user according to described first page to the second server in second territory, and described terminal is obtained the described user's that described second server sends relation information and described relation information is presented at second page;

Resource information that receiving terminal sends and user are at the relation information of described second page selection corresponding to described resource information, store the relation information of described selection and the corresponding record of resource information, and with the authorization message of described corresponding record as the described resource information of visit.

15. method as claimed in claim 14 is characterized in that, also comprises:

Send the existing authorization message of storage according to described request to terminal, comprise the relation information that the user has selected and the corresponding record of resource information in the described existing authorization message.

16. a terminal is characterized in that, comprising:

The request receiver module is used to receive the request of user access resources information;

Display module is used for showing according to described request first page of the resource information include the described user who is positioned at first territory, shows second page of the relation information that includes the described user who is positioned at second territory according to described first page;

The relation information receiver module is used to receive the user at the relation information of described second page selection corresponding to described resource information;

Sending module, be used for sending the relation information that described resource information and described user select at second page to first server, so that the relation information of the described selection of first server stores and the corresponding record of resource information, and with the authorization message of described corresponding record as the described resource information of visit.

17. terminal as claimed in claim 16 is characterized in that:

Described receiver module also is used to receive first server according to the existing authorization message that described request sends, and comprises the relation information that the user has selected and the corresponding record of resource information in the described existing authorization message;

Described display module also is used for: show the relation information that described user has selected according to described existing authorization message at second page.

18. as claim 16 or 17 described terminals, described second page is the new page that is arranged in the inline frame page of first page or opens for clickable hyperlinks or button in first page.

19. a server is characterized in that, comprising:

Receiver module is used to receive the access request that the user sends by terminal;

Acquisition module is used for obtaining according to described request described user's authorization message, and obtains described user according to described authorization message and be authorized to accessed resources information;

Sending module is used for described resource information is sent to described terminal.

20. server as claimed in claim 19, it is characterized in that described acquisition module specifically is used for: obtain described user being authorized to accessed resources information or being authorized to accessed resources information for predetermined quantity up-to-date in nearest scheduled time according to described authorization message; Described sending module specifically is used for: with described user being authorized to accessed resources information or sending to described terminal for predetermined quantity up-to-date is authorized to accessed resources information in nearest scheduled time.

21. a server is characterized in that, comprising:

Receiver module is used for receiving the user is in the resource information of first territory, first server by terminal access request;

Acquisition module is used to obtain the authorization message of described resource information correspondence, and described authorization message records the relation information that is in the second territory second server of described resource information correspondence;

Processing module is used to judge whether described user belongs to described relation information; Allow the described resource information of described user capture when being being judged as, when being judged as not, refuse the described resource information of described user capture.

22. server as claimed in claim 21 is characterized in that: described relation information comprises contact person or group;

Described processing module specifically is used for: judge whether described user belongs to the contact person of described relation information, if, then allow the described resource information of described user capture, and process ends; If not, then the sign with group in the described relation information and described user sends to second server, whether belongs to described group so that second server is judged described user; Receive the judged result that described second server sends, if described judged result for being, then allows the described resource information of user capture, otherwise refuses the described resource information of described user capture.

23. a server is characterized in that, comprising:

Receiver module is used to receive the request that the user sends by terminal;

Sending module, be used for sending first page that includes resource information to terminal according to described request, so that described terminal sends the request of obtaining of obtaining relation information according to the second server of described first page to second territory, and described terminal is obtained the relation information of described second server transmission and described relation information is presented at second page;

Memory module, be used for resource information that receiving terminal sends and user and select relation information corresponding to described resource information at described second page, store the relation information of described selection and the corresponding record of resource information, and with the authorization message of described corresponding record as the described resource information of visit.

24. server as claimed in claim 23 is characterized in that,

Sending module also is used for sending the existing authorization message of storage according to described request to terminal, comprises the relation information that the user has selected and the corresponding record of resource information in the described existing authorization message.

25. the system of a cross-domain authorization is characterized in that, comprising:

First server is positioned at first territory, is used to receive the request of user by the access resources information of terminal transmission; Send first page of the resource information that includes described user to terminal according to described request, so that described terminal sends the request of obtaining of obtaining relation information according to described first page to the second server that is positioned at second territory, and described terminal is obtained the relation information of described second server transmission and described relation information is presented at second page; Resource information that receiving terminal sends and user are at the relation information of described second page selection corresponding to described resource information, store the relation information of described selection and the corresponding record of resource information, and with the authorization message of described corresponding record as the described resource information of visit;

Second server is positioned at second territory, is used for sending to described terminal described user's relation information.

Images