CN102724647B - Method and system for access capability authorization - Google Patents

Abstract

The invention discloses a capability access authorization method and system, which manages the authorization of the service capability open platform: (1) when the third-party application accesses the service capability, it needs to obtain the display authorization of the service billing party; (2) the third-party When the application accesses the business capabilities related to the end user's private data, in order to ensure the security and privacy of the end user's data, it needs to obtain the display authorization of the private data owner; (3) it needs to obtain the authorization of the service level agreement system of the capability opening platform; After obtaining multi-party authorization, the authorization system generates the corresponding access token and issues it to the third-party application. The third-party application carries the access token and uses the access token as the capability access authorization credential to directly access the corresponding capability interface, thus ensuring The business capabilities of the business capability open platform are reasonably accessed by legitimate third-party applications.

Description

A capability access authorization method and system

technical field

The invention belongs to the technical field of the Internet, and more specifically relates to a capability access authorization method for a business capability open platform.

Background technique

With the substantial improvement of mobile communication bandwidth and the intelligence of mobile terminals, traditional mobile or Internet services can no longer meet the diverse and personalized needs of mobile terminal users. In order to further promote the prosperity of mobile Internet business, well-known Internet companies and telecom operators at home and abroad have launched their own business capability open platforms, such as Google App, China Telecom's "Tianyi Space Application Factory", etc. This type of business capability open platform encapsulates its own business capabilities into an API interface in a unified format and provides them to third-party application developers (including enterprise developers and individual developers), thus making the development, deployment and promotion of mobile Internet services more convenient. .

The business capabilities provided by the business capability open platform usually include telecommunications capabilities such as SMS, voice, positioning, and mobile payment, Internet capabilities such as search, Weibo, and cloud storage, and the ability to access private data and information of end users.

At present, the capability access authorization method of the business capability open platform is gradually being improved, and there is no comprehensive authorization management method. For example, China Telecom's business capability open platform only provides third-party application developers with authorized billing capability access methods, that is, developers must pre-purchase the corresponding capabilities before third-party applications can access the ordered capability interface, and cannot provide end users with Authorization management functions such as capability access for authorization billing and private data access authorized by users. For the access authorization of user private data, the Internet open platform usually adopts an authorization method based on the OAuth protocol. This method can complete the user's authorization of the third-party application's data access within its own scope without the user exposing its own identity authentication credentials (such as user name/password, etc.) to the third-party application. However, the OAuth authorization protocol is mainly aimed at the situation that end users using third-party applications need to access their own private data, and does not consider the function of other private data owners to provide third-party application authorization access. In addition, the OAuth authorization protocol does not consider functions such as billing authorization and SLA system authorization for capability access.

Contents of the invention

The purpose of the present invention is to overcome the deficiencies of the prior art, provide a comprehensive and comprehensive capability access authorization method for the open business capability platform, and perform authorization management on the business capabilities provided by the third-party application access service capability open platform, thereby ensuring business The business capabilities of the capability exposure platform are reasonably accessed by legitimate third-party applications.

In order to achieve the purpose of the above invention, the capability access authorization method of the present invention is characterized in that it includes the following steps:

Step 1. The third-party application sends a request message to the authorization system of the service capability open platform to apply for a certain capability interface access token. The request message includes at least: the name of the capability interface to apply for access, the billing party for capability access, and the third-party application Identifier, terminal address of the authorized user, terminal MSISDN number of the authorized user, a list of private data requiring user authorization, and a signature containing a third-party application key, etc.;

Step 2. The authorization system of the business capability opening platform receives the request message for applying for an access token, and then performs:

2.1), verify the legitimacy of the access token application request message itself

Verify the legitimacy of the request message itself, including the legitimacy of the third-party application, the legitimacy of the capability interface applying for access, and the legitimacy of the request message parameters;

Among them, the legitimacy of the third-party application is verified based on the third-party application identifier carried in the request message and the signature containing the third-party application key;

The legitimacy of the capability interface requested for access is verified based on the name of the capability interface applied for access carried in the request message;

Verify the legality of request message parameters, such as whether the format and range of all parameters carried in the request message conform to the specification;

If the request message is invalid, the authorization system returns a response message of "access token application is invalid" to the third-party application, and terminates the authorization process. If the request message is legal, proceed to step 2.2;

2.2), billing authorization and verification

If the capability interface applied for access is free, go to step 2.3 directly; otherwise, according to the billing party identified in the request message, the billing party determines the billing party parameters based on the capability access carried in the request message, and sends the Request message for charging authorization;

The billing party receives the billing authorization request message, authorizes the billing for the applied capability access, and returns the authorization information to the authorization system;

The authorization system judges according to the authorization information returned by the billing party. If the billing party does not agree to the authorization, it will return a response message of "no authorization by the billing party" to the third-party application and terminate the authorization process; if the billing party agrees to the authorization, then The billing system of the capability open platform is required to verify whether the billing party is legal according to the billing method. If the billing party is legal, perform step 2.3; Third-party application, terminate the authorization process;

2.3), private data access authorization and verification

If the capability interface to apply for access does not involve private data, then directly perform step 2.4; otherwise, send a request message for private data access authorization to the owner of the private data, if the owner is online, its address is determined by the The terminal address identification of the authorized user, if the owner is offline, its address is identified by the terminal MSISDN number of the authorized user;

The owner of the private data receives the private data access authorization request message, authorizes the access to the applied private data, that is, the data in the list of private data that needs to be authorized by the user carried in the access token request message, and returns the authorization information to to the authorization system;

The authorization system judges according to the authorization information returned by the private data owner. If the private data owner does not agree to the authorization, it will return a response message of "accessing private data error" to the third-party application and terminate the authorization process; if the private data owner agrees to authorize , then the authentication system of the capability openness platform is required to verify the owner of the private data, that is, whether the authorized user is legal. If it is legal, go to step 2.4, otherwise, return a response message of "authorized user is not legal" to the third-party application, and terminate the authorization process;

2.4), SLA (Service Level Agreement) authorization

The authorization system requires the SLA (Service Level Agreement) system of the capability openness platform to authorize the rationality of third-party application access capability interfaces. If the frequency of third-party application access capability interfaces conforms to the pre-signed SLA contract, the SLA system Agree to authorize, otherwise the SLA system refuses to authorize;

According to the authorization status of the SLA system, if the SLA system agrees to the authorization, the authorization system will perform step 3; otherwise, it will return a response message of "request too frequently" to the third-party application, and terminate the authorization process;

Step 3. Access token generation and issuance

The authorization system generates a unique access token covering billing, private data access and SLA authorization according to the third-party application's capability interface access application request and issues it to the third-party application;

Step 4. Capability interface access

The third-party application carries the access token, and uses the access token as the capability access authorization credential to directly access the corresponding capability interface of the business capability open platform. The capability server performs the corresponding capability access and returns the capability access result to the third-party application to complete the capability access.

In addition, the present invention also provides a capability access authorization system, including:

The token application legitimacy verification module is used to verify the legitimacy of the request message of the access token application itself, including the legitimacy of the third-party application, the legitimacy of the capability interface for applying for access, and the legitimacy of the request message parameters;

If the request message is invalid, the authorization system returns a response message of "access token application is invalid" to the third-party application, terminating the authorization process; if the request message is legal, the token application request message is submitted to the billing authorization module for further processing ;

The billing authorization module is used to initiate an authorization request to the billing party and receive an authorization response returned by the billing party:

If the capability interface for applying for access is free, submit the token application request message to the private data access authorization module for further processing; otherwise, the accounting authorization module sends the accounting authorization to the accounting party according to the billing party identified in the request message request message;

The billing party receives the billing authorization request message, authorizes the billing for the applied capability access, and returns the authorization information to the billing authorization module;

The billing authorization module judges according to the authorization information returned by the billing party. If the billing party does not agree to the authorization, it returns a response message of "no billing party authorization" to the third-party application and terminates the authorization process; if the billing party agrees to authorize , the billing system of the capability open platform is required to verify whether the billing party is legal according to the billing method. If the billing party is legal, the token application request message is submitted to the private data access authorization module for further processing, otherwise it returns "the billing party charges Not enough" or "not enough credit" response message to the third-party application, terminating the authorization process;

The private data access authorization module is used to initiate an authorization request to the private data owner and receive the authorization response returned by the resource owner:

If the capability interface for applying for access does not involve private data, submit the token application request message to the SLA authorization module for further processing; otherwise, send a private data access authorization request message to the owner of the private data;

The private data owner receives the private data access authorization request message, authorizes the requested private data access, and returns the authorization information to the private data access authorization module;

The private data access authorization module judges according to the authorization information returned by the private data owner. If the private data owner does not agree to the authorization, otherwise it will return a response message of "error accessing private data" to the third-party application and terminate the authorization process; if the private data owner If the author agrees to the authorization, the authentication system of the capability openness platform is required to verify whether the private data owner is legal. If it is legal, the token application request message is submitted to the SLA authorization module for further processing; otherwise, a response message of "authorized user is not legal" is returned to Third-party applications, terminate the authorization process;

The SLA authorization module is used to request the SLA system of the capability open platform to authorize the rationality of the third-party application access capability interface. If the frequency of the third-party application access capability interface conforms to the pre-signed SLA contract, the SLA system agrees to authorize, otherwise the SLA The system denies authorization;

According to the authorization situation of the SLA system, if the SLA system agrees to the authorization, the SLA authorization module will submit the token application request message to the token issuance module for further processing; otherwise, return the response message of "request too frequently" to the third-party application, and terminate the authorization process ;

The token issuance module is used to generate a unique access token covering billing, private data access and SLA authorization according to the application request of the third-party application's capability interface, and issue it to the third-party application. The third-party application carries the access token. Use the access token as the capability access authorization credential to directly access the corresponding capability interface of the business capability open platform;

The token verification module is used for the third-party application to carry the access token and use the access token as the capability access authorization credential to access the corresponding capability interface of the business capability open platform, receive the access token sent by the capability server, and verify its legitimacy, If the verification is legal, the capability server of the service capability opening platform performs corresponding capability access.

The purpose of the present invention is achieved like this:

The capability access authorization method of the present invention is to manage the authorization of the business capability open platform, and mainly involves the following contents:

(1) When the third-party application accesses the service capability, it needs to obtain the display authorization of the service billing party, such as whether the end user or the application provider allows their own account to be used as the billing account for this capability access;

(2) When third-party applications access business capabilities related to end-user private data (such as obtaining user information, using user resources, etc.), in order to ensure the security and privacy of end-user data, it is necessary to obtain the display of the private data owner Authorization, such as whether to allow third-party applications to obtain the location information of end users, whether to allow third-party applications to send calls or text messages in the name of end users;

(3) Considering the controllability of the capability interface, ensuring the reasonable use of the capability interface and the multi-granularity control of data access rights, third-party applications need to obtain the service level agreement (Service Level Agreement) of the capability open platform when accessing business capabilities. Agreement, SLA) system authorization;

After obtaining multi-party authorization, the authorization system generates the corresponding access token and issues it to the third-party application. The third-party application carries the access token and uses the access token as the capability access authorization credential to directly access the corresponding capability interface, thus ensuring The business capabilities of the business capability open platform are reasonably accessed by legitimate third-party applications.

Description of drawings

Fig. 1 is a flow chart of the capability access authorization method of the present invention;

Fig. 2 is a deployment diagram of each system in the capability access authorization method of the present invention;

Fig. 3 is a flow chart of a specific embodiment of the capability access authorization method of the present invention;

Fig. 4 is a flow chart of a specific embodiment of a method for judging the legitimacy of an access token application request in the capability access authorization method of the present invention;

Fig. 5 is a flow chart of a specific implementation of capability access using an access token as a capability access authorization credential in the capability access authorization method of the present invention;

Fig. 6 is a functional block diagram of the authorization system in the capability access authorization method of the present invention.

Detailed ways

Specific embodiments of the present invention will be described below in conjunction with the accompanying drawings, so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when detailed descriptions of known functions and designs may dilute the main content of the present invention, these descriptions will be omitted here.

Fig. 1 is a flow chart of the capability access authorization method of the present invention.

As shown in Figure 1, the capability access authorization method of the present invention includes:

Step 1: The third-party application sends a request message to apply for an access token;

Step 2: The authorization system of the business capability opening platform receives the request message for applying for an access token, and then performs request message verification and authorization of capability access:

Step 2.1 Verify the legitimacy of the application request message;

Step 2.2 performs billing authorization and verification;

Step 2.3: Perform private data access authorization and verification;

Step 2.4: SLA Authorization

Step 3: Generate an access token and issue it to the third-party application. The third-party application uses this as an authorization credential to access the corresponding capability interface.

Fig. 2 is a deployment diagram of various systems in the capability access authorization method of the present invention.

Each system is implemented inside the business capability open platform, and its deployment diagram is shown in Figure 2.

First, the roles and their functions involved in the present invention will be described. The roles involved in the present invention include: third-party application, terminal user, billing party, private data owner, authorization system, authentication system, billing system, SLA system, and capability server. Among them, the third-party application is a program and software developed based on the capability interface provided by the open platform. The third-party application can be an application with a background server or a desktop application without a background server; the end user is using the third-party application person; the billing party pays for this ability access, which can be either the end user using the third-party application or the provider of the third-party application. The latter is mainly for the background server application; the private data owner is both It can be an end user who is using a third-party application or other open platform users; the authorization system completes the authorization management function of the third-party application access capability interface; the authentication system completes the authentication function for open platform users; The billing function of platform users; the SLA system judges whether the frequency of third-party application access capability interface conforms to the pre-signed SLA contract; the capability server provides capability access services such as SMS, voice, location, Weibo, and cloud storage through the capability interface.

Fig. 3 is a flow chart of a specific embodiment of the capability access authorization method of the present invention.

In this embodiment, as shown in FIG. 3 , the specific steps of the capability access authorization method of the present invention are as follows:

Step 101: The third-party application sends a request message to the authorization system of the capability opening platform to apply for a certain capability interface access token. The request message includes: the name of the capability interface to apply for access, the billing party for capability access, and the third-party application Identifier, terminal address of authorized user, terminal MSISDN number of authorized user, user authorization list, and signature containing third-party application key.

Step 102: The authorization system receives the request message, and verifies the legitimacy of the access token application request itself, including the legitimacy of the third-party application, the legitimacy of the application access capability interface, and the legitimacy of the request message parameters; if the request message is legal, then Execute step 104, otherwise execute step 103;

Step 103: the authorization system returns a response message of "the application for the access token is invalid" to the third-party application, and terminates the authorization process;

Step 104: The authorization system judges whether the capability interface for which access is applied for is free, and if it is free, directly executes Step 114, otherwise executes Step 105;

Step 105: The authorization system sends a request message for charging authorization to the billing party according to the billing party identified in the request message. In the embodiment, the billing party can be a provider of a third-party application or use a third-party application. end users of the application;

Step 106: The billing party receives the billing authorization request message, and the billing party authorizes the billing for this capability access, and returns the authorization information to the authorization system;

Step 107: The authorization system judges whether the billing party agrees to the billing authorization, if yes, then executes step 109, otherwise executes step 108;

Step 108: The authorization system returns a response message of "no billing party authorization" to the third-party application, terminating the authorization process;

Step 109: The authorization system requests the billing system of the capability opening platform to verify whether the billing authorization is legal;

Step 110: The billing system verifies the legitimacy of the billing authorization according to the billing method adopted by the billing party: In this embodiment, the billing methods are divided into two types: pre-paid and post-paid. If it is a pre-paid, Determine whether the billing party has a balance to support this visit; if it is a post-payment method, determine whether there is a problem with the credit of the billing party;

Step 111: the billing system returns the verification result of the billing authorization to the authorization system;

Step 112: According to the verification result, the authorization system executes Step 114 if the charging authorization is legal, otherwise executes Step 113;

Step 113: The authorization system returns a response message of "the billing party's tariff is not enough" or "the credit is not enough" to the third-party application, terminating the authorization process;

Step 114: The authorization system judges whether the capability interface requested for access involves the private data of the end user, and if so, executes step 115, otherwise directly executes step 124;

Step 115: The authorization system sends a data access authorization request message to the owner of the private data, in this embodiment, the end user who accesses the private data, and the request message carries a list of private data that needs to be authorized by the user for this capability access;

Step 116: The private data owner authorizes the private data requested for access, and returns his authentication credentials and authorization information to the authorization system;

Step 117: The authorization system judges whether the owner of the private data agrees to the authorization, if yes, then executes Step 119, otherwise executes Step 118;

Step 118: The authorization system returns a response message of "error in accessing private data" to the third-party application, terminating the authorization process;

Step 119: The authorization system requests the authentication system of the capability opening platform to verify whether the private data owner, that is, the authorized user is legal;

Step 120: the authentication system verifies the legitimacy of the authentication credential submitted by the authorized user;

Step 121: the authentication system returns the verification result of the legality of the authorized user to the authorization system;

Step 122: According to the verification result, the authorization system executes Step 124 if the authorized user is legal, otherwise executes Step 123;

Step 123: the authorization system returns a response message of "authorized user is invalid" to the third-party application, and terminates the authorization process;

Step 124: The authorization system requests the SLA system of the capability opening platform to authorize the rationality of the third-party application access capability interface;

Step 125: The SLA system judges whether the frequency of the third-party application access capability interface complies with the pre-signed SLA contract. If so, the SLA system agrees to authorize, otherwise the SLA system refuses to authorize;

Step 126: the SLA system returns the SLA authorization result to the authorization system;

Step 127: The authorization system executes step 129 if the SLA system agrees to authorize according to the authorization situation of the SLA system, otherwise executes step 128;

Step 128: The authorization system returns a response message of "request too frequently" to the third-party application, terminating the authorization process;

Step 129: The authorization system generates a unique access token, generates a unique access token covering billing, private data access, and SLA authorization, and issues it to the third-party application. The third-party application carries the access token, and the access token is used as The capability access authorization certificate can directly access the corresponding capability interface of the business capability exposure platform.

FIG. 4 is a flow chart of a specific embodiment of a method for judging the legitimacy of an access token application request in the capability access authorization method of the present invention.

In this embodiment, as shown in FIG. 4 , the steps for judging the legitimacy of the access token application request itself are as follows:

Step 201: The authorization system judges whether the third-party application applying for the token is legal, including whether the status of the developer is normal, whether the status of the third-party application is normal, and whether the third-party application is consistent with the third-party application identifier carried in the request; if legal, Then execute step 203; otherwise execute step 202;

Step 202: return a response message of "access token application is invalid" to the third-party application, and terminate the authorization process;

Step 203: The authorization system judges whether the capability interface requested for access is legal, that is, judges whether the capability interface applied for access is within the range of interfaces allowed by the third-party application; if it is legal, execute step 204; otherwise, execute step 202;

Step 204: the authorization system judges whether the parameters carried in the request message are legal, and if so, completes the legality check of the access token request itself; otherwise, executes step 202.

Fig. 5 is a flow chart of a specific implementation of capability access using an access token as a capability access authorization credential in the capability access authorization method of the present invention.

In this embodiment, as shown in FIG. 5, the capability access method using the access token as the capability access authorization credential includes the following steps:

Step 301: The third-party application receives the capability interface access token returned by the authorization system, and then sends a request message for capability interface access to the capability server of the service capability open platform. The request message includes the name of the capability interface to be accessed, attribute parameters and corresponding the access token for the interface;

Step 302: The capability server receives the access request, checks the validity of the attribute parameters, and if the parameters are not legal, executes step 303, otherwise executes step 304;

Step 303: The capability server returns a response message of "the attribute parameter is invalid" to the third-party application, and terminates the capability access process;

Step 304: the capability server requests the authorization system of the service capability open platform to verify the received access token;

Step 305: the authorization system verifies the validity of the access token;

Step 306: The authorization system returns the verification result of the validity of the access token to the capability server;

Step 307: The capability server receives the verification result, and if the access token is valid, execute step 309; otherwise, execute step 308;

Step 308: The capability server returns a response message of "access token invalidation" to the third-party application, and terminates the capability access process;

Step 309: The corresponding capability interface of the capability server performs capability access;

Step 310: The capability server returns the capability access result to the third-party application to complete the capability access.

Fig. 6 is a functional block diagram of the authorization system in the capability access authorization method of the present invention.

In this embodiment, as shown in Figure 6, the capability access authorization system includes a token application legality verification module 401, a billing authorization module 402, a private data access authorization module 403, an SLA authorization module 404, and an access token issuance module 405 , access token verification module 406 .

The token application legitimacy verification module 401 is used to verify the legitimacy of the request message itself, including verifying the legitimacy of the third-party application, the legitimacy of the application access capability interface, and the legitimacy of the request message parameters. If the request message is legal, submit the token request message to the billing authorization module for further processing; otherwise, the request message is invalid, and the token application legitimacy verification module directly returns a response message of "access token request is not legal" to the third party Apply, terminating the authorization process.

The billing authorization module 402 is used to complete the billing authorization function of capability access, mainly including: firstly analyze whether the capability interface for access is free, if it is free, then directly execute the subsequent private data access authorization process; otherwise, according to the token The parameters carried in the request message analyze the billing party for this capability access, initiate an authorization request to the billing party, and receive the authorization response returned by the billing party: if the billing party does not agree to the authorization, the billing authorization module returns "No billing Authorization by the billing party” response message to the third-party application, terminating the authorization process; if the billing party agrees to the authorization, the billing authorization module requests the billing system of the capability open platform to verify whether the billing authorization is legal. If the billing authorization is legal , then continue to execute the subsequent private data access authorization process; if the billing authorization is illegal, return a response message of "the billing party's tariff is not enough" or "not enough credit" to the third-party application, and terminate the authorization process.

The private data access authorization module 403 is used to complete the authorization function of private data access, mainly including: first analyzing whether the capability interface for applying for access involves the end user's private data, if not, then directly execute the subsequent SLA authorization process; otherwise, send the data The request message for access authorization is sent to the owner of the private data. If the owner of the private data does not agree to the authorization, a response message of "error accessing the private data" is returned to the third-party application, and the authorization process is terminated; if the authorization is agreed, the capability opening platform is required The authentication system verifies whether the authorized user is legal. If it is legal, the subsequent SLA authorization process is continued; otherwise, a response message of "authorized user is not valid" is returned to the third-party application, and the authorization process is terminated.

The SLA authorization module 404 is configured to request the SLA system of the capability opening platform to authorize whether the frequency of the third-party application accessing the capability interface complies with the pre-signed SLA contract, and receive an authorization response returned by the SLA system.

The token issuing module 405 is configured to generate a new globally unique access token and send it to a third-party application when the application is legal and authorized by all parties.

The access token verification module 406 is used for the third-party application to carry the access token and use the access token as the capability access authorization credential to access the corresponding capability interface of the service capability open platform, receive the access token sent by the capability server, and verify its legitimacy , if the verification is legal, the capability server of the service capability opening platform performs corresponding capability access.

example

The present invention provides a specific location service (Location Based Service, LBS) capability access instance.

It is assumed that a third-party application needs to access the LBS capability provided by the capability opening platform to obtain the current geographic location information of the terminal user. It is assumed that the LBS capability is purchased by a third-party application and serves as the billing party for each capability access. In addition, obtaining the geographical location information of the terminal user belongs to the private data of the terminal user, so it is necessary to authorize access to private data to the terminal user. In summary, before the authorization system of the capability openness platform issues LBS capability access authorization certificates to third-party applications, it must first complete three processes: payer authorization, user private data access authorization, and SLA authorization. The specific implementation steps are as follows:

Step 501: The third-party application sends a request message to the authorization system of the capability open platform to apply for an LBS capability interface access token. The request includes the following parameters: the name of the capability interface to apply for access (api_name), and the billing party for capability access (pay_account) , the third-party application identifier (app_key), the IP address of the end user (ip_client), the MSISDN number of the end user (msisdn), the list of geographical location information (list), and the signature (md5) containing the third-party application key. In this embodiment, the specific parameters are described in the parameter description carried in the access token request message shown in Table 1.

Step 502: The authorization system receives the application request message, and verifies the legitimacy of the access token application request message itself, specifically including the legitimacy of the third-party application, the legitimacy of the application access capability interface, and the legitimacy of the request message parameters; if the request If the message is legal, execute step 503; otherwise, the authorization system returns a response message of "access token application is invalid" to the third-party application, and terminates the authorization process;

Step 503: The authorization system judges that the capability interface LBS_BY_MSISDN applying for access is a third-party application as the billing party, so it initiates a billing authorization request to the third-party application;

Step 504: The third-party application authorizes the charging of this capability access (provide the APP_KEY and APP_SECRET of this application, and the information of agreeing to the charging authorization), and returns the authorization information to the authorization system;

Step 505: The authorization system judges whether the third-party application agrees to the billing authorization, and if yes, requests the billing system of the capability openness platform to verify whether the billing authorization is legal; otherwise, the authorization system returns a response message of "no billing party authorization" to Third-party applications, terminate the authorization process;

Step 506: The billing system verifies the legitimacy of the billing authorization according to the billing method signed when the third-party application ordered the capability. Assuming that the billing method in this embodiment is a prepaid Sufficient balance to support this visit, and return the verification result of this billing authorization to the authorization system;

Step 507: According to the verification result, the authorization system executes step 508 if the charging authorization is legal; otherwise, returns a response message of "the charge of the billing party is not enough" to the third-party application, and terminates the authorization process;

Step 508: The authorization system judges the LBS_BY_MSISDN capability interface that is applying for access, and requires the end user to authorize its private data access, so it sends an authorization request message for private data access to the user terminal (online authorization can be performed through IP_CLIENT information, or through the MSISDN number SMS authorization), the request message carries the list list that needs to be authorized by the user for this capability access;

Step 509: The terminal user authorizes this LBS capability access (that is, allows a third-party application to find the geographic location information corresponding to the terminal through the MSISDN number), and returns its own authentication credentials and authorization information to the authorization system;

Step 510: The authorization system judges whether the end user agrees to the authorization, and if yes, then executes step 511, otherwise the authorization system returns a response message of "error in accessing private data" to the third-party application, and terminates the authorization process;

Step 511: the authorization system requests the authentication system of the capability opening platform to verify whether the authorized terminal user is legal;

Step 512: the authentication system verifies the legitimacy of the credential submitted by the authorized user;

Step 513: the authentication system returns the verification result of the legality of the authorized user to the authorization system;

Step 514: According to the verification result, the authorization system executes step 515 if the authorized user is legal; otherwise, the authorization system returns a response message of "the authorized user is not legal" to the third-party application, and terminates the authorization process;

Step 515: The authorization system requests the SLA system of the capability opening platform to authorize the rationality of the third-party application access capability interface;

Step 516: The SLA system judges whether the frequency of the third-party application's access capability interface complies with the pre-signed SLA contract. If so, the SLA system agrees to authorize, otherwise the SLA system refuses to authorize;

Step 517: the SLA system returns the SLA authorization result to the authorization system;

Step 518: According to the authorization status of the SLA system, if the SLA system agrees to the authorization, the authorization system executes step 519, otherwise the authorization system returns a response message of "too frequent requests" to the third-party application, and terminates the authorization process;

Step 519: The authorization system generates a unique access token and sends it to the third-party application to complete the authorization of this LBS capability access.

Although the illustrative specific embodiments of the present invention have been described above, so that those skilled in the art can understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, As long as various changes are within the spirit and scope of the present invention defined and determined by the appended claims, these changes are obvious, and all inventions and creations using the concept of the present invention are included in the protection list.

Claims (3)

1. A capability access authorization method, comprising the following steps: Step 1. The third-party application sends a request message to the authorization system of the service capability open platform to apply for a certain capability interface access token. The request message includes at least: the name of the capability interface to apply for access, the billing party for capability access, and the third-party application Identifier, authorized user's terminal address, authorized user's terminal MSISDN number, a list of private data to be authorized by the user, and a signature containing a third-party application key; Step 2. The authorization system of the business capability opening platform receives the request message for applying for an access token, and then performs: 2.1), verify the legitimacy of the access token application request message itself Verify the legitimacy of the request message itself, including the legitimacy of the third-party application, the legitimacy of the capability interface applying for access, and the legitimacy of the request message parameters; Among them, the legitimacy of the third-party application is verified based on the third-party application identifier carried in the request message and the signature containing the third-party application key; The legitimacy of the capability interface requested for access is verified based on the name of the capability interface applied for access carried in the request message; The legality verification of request message parameters includes whether the format and range of all parameters carried in the request message conform to the specification; If the request message is invalid, the authorization system returns a response message of "access token application is invalid" to the third-party application, and terminates the authorization process. If the request message is legal, proceed to step 2.2; 2.2), billing authorization and verification If the capability interface applied for access is free, go to step 2.3 directly; otherwise, according to the billing party identified in the request message, the billing party determines the billing party parameters based on the capability access carried in the request message, and sends the Request message for charging authorization; The billing party receives the billing authorization request message, authorizes the billing for the applied capability access, and returns the authorization information to the authorization system; The authorization system judges according to the authorization information returned by the billing party. If the billing party does not agree to the authorization, it will return a response message of "no authorization by the billing party" to the third-party application and terminate the authorization process; if the billing party agrees to the authorization, then The billing system of the capability open platform is required to verify whether the billing party is legal according to the billing method. If the billing party is legal, perform step 2.3; Third-party application, terminate the authorization process; 2.3), private data access authorization and verification If the capability interface to apply for access does not involve private data, then directly perform step 2.4; otherwise, send a request message for private data access authorization to the owner of the private data, if the owner is online, its address is determined by the The terminal address identification of the authorized user, if the owner is offline, its address is identified by the terminal MSISDN number of the authorized user; The owner of the private data receives the private data access authorization request message, authorizes the access to the applied private data, that is, the data in the list of private data that needs to be authorized by the user carried in the access token request message, and returns the authorization information to to the authorization system; The authorization system judges according to the authorization information returned by the private data owner. If the private data owner does not agree to the authorization, the authorization system returns a response message of "accessing private data error" to the third-party application and terminates the authorization process; if the private data owner If the authorization is agreed, the authentication system of the capability openness platform is required to verify the owner of the private data, that is, whether the authorized user is legal. If it is legal, go to step 2.4; otherwise, return a response message of "authorized user is not legal" to the third-party application, and terminate the authorization process ; 2.4), SLA (Service Level Agreement) authorization The authorization system requires the SLA (Service Level Agreement) system of the capability openness platform to authorize the rationality of third-party application access capability interfaces. If the frequency of third-party application access capability interfaces conforms to the pre-signed SLA contract, the SLA system Agree to authorize, otherwise the SLA system refuses to authorize; According to the authorization status of the SLA system, if the SLA system agrees to the authorization, the authorization system will perform step 3; otherwise, it will return a response message of "request too frequently" to the third-party application, and terminate the authorization process; Step 3. Access token generation and issuance The authorization system generates a unique access token covering billing, private data access and SLA authorization according to the third-party application's capability interface access application request and issues it to the third-party application; Step 4. Capability interface access The third-party application carries the access token, and uses the access token as the capability access authorization credential to directly access the corresponding capability interface of the business capability open platform, and the capability server performs the corresponding capability access, and returns the capability access result to the third-party application to complete the capability access . 2. The capability access authorization method according to claim 1, wherein the capability interface access is: 4.1), the third-party application receives the capability interface access token returned by the authorization system, and then sends a request message for capability interface access to the capability server of the business capability open platform. The request message includes the name of the capability interface to be accessed, attribute parameters and corresponding the access token for the interface; 4.2), the capability server receives the access request, checks the validity of the attribute parameters, if the parameters are not legal, execute step 4.3, otherwise execute step 4.4; 4.3), the capability server returns a response message of "invalid attribute parameters" to the third-party application, and terminates the capability access process; 4.4), the capability server requests the authorization system of the business capability open platform to verify the received access token; 4.5), the authorization system verifies the validity of the access token; 4.6), the authorization system returns the verification result of the validity of the access token to the capability server; 4.7), the capability server receives the verification result, if the access token is valid, execute step 4.9; otherwise, execute step 4.8; 4.8), the capability server returns a response message of "access token invalidation" to the third-party application, and terminates the capability access process; 4.9), the corresponding capability interface of the capability server performs capability access; 4.10), the capability server returns the capability access result to the third-party application to complete the capability access. 3. A capability access authorization system, comprising: The token application legitimacy verification module is used to verify the legitimacy of the request message of the access token application itself, including the legitimacy of the third-party application, the legitimacy of the capability interface for applying for access, and the legitimacy of the request message parameters; If the request message is invalid, the authorization system returns a response message of "access token application is invalid" to the third-party application, terminating the authorization process; if the request message is legal, the token application request message is submitted to the billing authorization module for further processing ; The billing authorization module is used to initiate an authorization request to the billing party and receive an authorization response returned by the billing party: If the capability interface for applying for access is free, submit the token application request message to the private data access authorization module for further processing; otherwise, the accounting authorization module sends the accounting authorization to the accounting party according to the billing party identified in the request message request message; The billing party receives the billing authorization request message, authorizes the billing for the applied capability access, and returns the authorization information to the billing authorization module; The billing authorization module judges according to the authorization information returned by the billing party. If the billing party does not agree to the authorization, it returns a response message of "no billing party authorization" to the third-party application and terminates the authorization process; if the billing party agrees to authorize , the billing system of the capability open platform is required to verify whether the billing party is legal according to the billing method. If the billing party is legal, the token application request message is submitted to the private data access authorization module for further processing, otherwise it returns "the billing party charges Not enough" or "not enough credit" response message to the third-party application, terminating the authorization process; The private data access authorization module is used to initiate an authorization request to the private data owner and receive the authorization response returned by the private data owner: If the capability interface for applying for access does not involve private data, submit the token application request message to the SLA authorization module for further processing; otherwise, send a private data access authorization request message to the owner of the private data; The private data owner receives the private data access authorization request message, authorizes the requested private data access, and returns the authorization information to the private data access authorization module; The private data access authorization module judges according to the authorization information returned by the private data owner. If the private data owner does not agree to the authorization, otherwise it will return a response message of "error accessing private data" to the third-party application and terminate the authorization process; if the private data owner If the author agrees to the authorization, the authentication system of the capability openness platform is required to verify whether the private data owner is legal. If it is legal, the token application request message is submitted to the SLA authorization module for further processing; otherwise, a response message of "authorized user is not legal" is returned to Third-party applications, terminate the authorization process; The SLA authorization module is used to request the SLA system of the capability open platform to authorize the rationality of the third-party application access capability interface. If the frequency of the third-party application access capability interface conforms to the pre-signed SLA contract, the SLA system agrees to authorize, otherwise the SLA The system denies authorization; According to the authorization situation of the SLA system, if the SLA system agrees to the authorization, the SLA authorization module will submit the token application request message to the token issuance module for further processing; otherwise, return the response message of "request too frequently" to the third-party application, and terminate the authorization process ; The token issuance module is used to generate a unique access token covering billing, private data access and SLA authorization according to the application request of the third-party application's capability interface, and issue it to the third-party application. The third-party application carries the access token. Use the access token as the capability access authorization credential to directly access the corresponding capability interface of the business capability open platform; The token verification module is used for the third-party application to carry the access token and use the access token as the capability access authorization credential to access the corresponding capability interface of the business capability open platform, receive the access token sent by the capability server, and verify its legitimacy, If the verification is legal, the capability server of the service capability opening platform performs corresponding capability access.