CN107251506B - Terminal data opening control method and system - Google Patents

Abstract

A terminal data opening control method and system, network equipment, a third-party application server and a terminal are used for safely opening privacy data of the terminal for the third-party application server through an MBB network. The method comprises the following steps: the terminal accesses a third-party application server, the third-party application server sends a first message to the network equipment, and the first message is used for requesting the terminal to allow the third-party application server to acquire the data of the terminal; the network equipment determines that the terminal allows a third-party application server to acquire the data of the terminal; the network equipment determines verification information for the third-party application server to acquire the data of the terminal and sends the verification information to the third-party application server.

Description

Terminal data open control method and system

technical field

The present invention relates to the field of wireless communication, and in particular, to a method and system for controlling terminal data opening.

Background technique

With the rapid development of mobile broadband (Mobile Broadband, MBB) network services, the MBB network opens up network capabilities to cultivate more partners and increase the operating income of the MBB network service.

The open network capability of MBB network includes the private data of MBB network open terminal for a third-party application server (The ^3rd party AppServer). The terminal is connected to the MBB network, and when the terminal accesses the third-party application server, the third-party application server expects to obtain the private data of the terminal, such as the location information of the terminal, the identification of the terminal, and so on.

Before the MBB network opens the terminal's private data for the third-party application server, the third-party application server directly interacts with the terminal's private data, and the MBB network only acts as a network conduit to transmit the terminal's private data between the third-party application server and the terminal. . After the MBB network opens the terminal's private data to the third-party application server, the MBB network can open the terminal's private data to the third-party application server by collecting the terminal's private data. However, considering the privacy of data, the MBB network needs the permission of the terminal to open the private data of the terminal to the third-party application server.

To sum up, in order to meet the needs of the MBB network to open the network capability and ensure the safe use of the terminal's private data, it is urgent to design a control scheme for the openness of the terminal's private data, so that the MBB network can safely open the terminal to the third-party application server. privacy data.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a terminal data opening control method and system, a network device, a third-party application server, and a terminal, so as to implement the MBB network to securely open the terminal's private data for the third-party application server.

In a first aspect, a terminal data opening control method provided by an embodiment of the present invention includes:

The network device receives a first message sent by a third-party application server, where the first message is used to request the terminal to allow the third-party application server to acquire data of the terminal;

The network device determines that the terminal allows the third-party application server to obtain data of the terminal;

The network device determines verification information for the third-party application server to acquire data of the terminal, and sends the verification information to the third-party application server.

With reference to the first aspect, in a first possible implementation manner, the network device determines the verification information for the third-party application server to acquire the data of the terminal, including:

The network device is configured for the third-party application server to obtain the verification information of the data of the terminal; or

The network device receives the verification information sent by the terminal for the third-party application server to acquire the data of the terminal.

With reference to the first aspect or the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, after the network device sends the verification information to the third-party application server, Also includes:

receiving, by the network device, a second message sent by the third-party application server, where the second message carries the verification information;

The network device sends the data of the terminal to the third-party application server.

With reference to the first aspect and any possible implementation manners of the first to second aspects of the first aspect, in a third possible implementation manner of the first aspect, the network device determines that the terminal allows the third party After the application server acquires the data of the terminal, it further includes:

determining, by the network device, the length of time that the terminal allows the third-party application server to obtain data of the terminal;

Taking the time when the network device determines that the terminal allows the third-party application server to obtain the data of the terminal as the starting time, when the duration exceeds the time length, the network device determines that the verification information is invalid; as well as

A notification message indicating that the verification information is invalid is sent to the third-party application server.

With reference to the first aspect and any possible implementation manners of the first to second aspects of the first aspect, in a fourth possible implementation manner of the first aspect, the network device determines that the terminal allows the third party After the application server acquires the data of the terminal, it further includes:

When the network device determines that the terminal does not allow the third-party application server to obtain the data of the terminal, the network device determines that the verification information is invalid; and

A notification message indicating that the verification information is invalid is sent to the third-party application server.

With reference to the first aspect and any of the first to fourth possible implementation manners of the first aspect, in a fifth possible implementation manner of the first aspect, the data of the terminal includes private data of the terminal.

In a second aspect, a terminal data opening control method provided by an embodiment of the present invention includes:

The third-party application server sends a first message to the network device, where the first message is used to request the terminal to allow the third-party application server to acquire data of the terminal;

The third-party application server receives the verification information sent by the network device, and the verification information is used for the third-party application server to acquire data of the terminal.

With reference to the second aspect, in a first possible implementation manner, before the third-party application server sends the first message to the network device, the method further includes:

The third-party application server accesses the third-party application server through the terminal, and determines that the third-party application server needs to acquire data of the terminal.

With reference to the second aspect or the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, after receiving the verification information sent by the network device, the third-party application server further includes: :

sending, by the third-party application server, a second message to the network device, where the second message carries the verification information;

The third-party application server receives the data of the terminal sent by the network device.

With reference to the second aspect and any possible implementation manners of the first to second aspects of the second aspect, in a third possible implementation manner of the second aspect, the third-party application server receives the data sent by the network device. After verifying the information, it also includes:

The third-party application server receives a notification message sent by the network device and used to indicate that the verification information is invalid.

With reference to the second aspect and any of the first to third possible implementation manners of the second aspect, in a fourth possible implementation manner of the second aspect, the data of the terminal includes private data of the terminal.

In a third aspect, a method for controlling terminal data opening provided by an embodiment of the present invention includes:

The terminal determines to allow the third-party application server to obtain the data of the terminal;

The terminal sends a notification message to the network device for instructing the terminal to allow the third-party server to acquire data of the terminal.

With reference to the third aspect, in a first possible implementation manner, after the terminal determines that the third-party application server is allowed to obtain the data of the terminal, the method further includes:

The terminal sends, to the network device, verification information for the third-party application server to acquire data of the terminal.

With reference to the third aspect or the first possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect, after the terminal determines that the third-party application server is allowed to obtain the data of the terminal, the method further includes:

The terminal sends, to the network device, the length of time during which the terminal allows the third-party application server to acquire data of the terminal.

With reference to the third aspect and any possible implementation manners of the first to the second aspect of the third aspect, in a third possible implementation manner of the third aspect, the terminal sends a message indicating the terminal to the network device After allowing the third-party server to obtain the notification message of the data of the terminal, it further includes:

The terminal sends, to the network device, a notification message indicating that the terminal does not allow the third-party application server to acquire data of the terminal.

With reference to the third aspect and any of the first to third possible implementation manners of the third aspect, in a fourth possible implementation manner of the third aspect, the data of the terminal includes private data of the terminal.

In a fourth aspect, a network device provided by an embodiment of the present invention includes:

a receiving unit, configured to receive a first message sent by a third-party application server, where the first message is used to request the terminal to allow the third-party application server to acquire data of the terminal;

a processing unit, configured to determine that the terminal allows the third-party application server to acquire the data of the terminal; determine the verification information for the third-party application server to acquire the data of the terminal;

A sending unit, configured to send the verification information determined by the processing unit to the third-party application server.

With reference to the fourth aspect, in a first possible implementation manner, when the processing unit determines the verification information for the third-party application server to acquire the data of the terminal, it is specifically used for:

Configure verification information for the third-party application server to obtain the data of the terminal; or

The receiving unit is further configured to: receive the verification information sent by the terminal for the third-party application server to acquire the data of the terminal;

When the processing unit determines the verification information for the third-party application server to obtain the data of the terminal, it is specifically used for:

The verification information received by the receiving unit is determined as verification information for the third-party application server to acquire data of the terminal.

With reference to the fourth aspect or the first possible implementation manner of the fourth aspect, in a second possible implementation manner of the fourth aspect, the receiving unit is further configured to:

receiving a second message sent by the third-party application server, where the second message carries the verification information;

The sending unit is also used for:

Send the data of the terminal to the third-party application server.

With reference to the fourth aspect and any possible implementation manners of the first to second aspect of the fourth aspect, in a third possible implementation manner of the fourth aspect, the processing unit determines that the terminal allows the third party After the application server obtains the data of the terminal, it is also used for:

determining the length of time that the terminal allows the third-party application server to obtain the data of the terminal;

Taking the time when the processing unit determines that the terminal allows the third-party application server to obtain the data of the terminal as the starting time, when the duration exceeds the time length, it is determined that the verification information is invalid;

The sending unit is also used for:

A notification message indicating that the verification information is invalid is sent to the third-party application server.

With reference to the fourth aspect and any possible implementation manners of the first to second aspects of the fourth aspect, in a fourth possible implementation manner of the fourth aspect, the processing unit determines that the terminal allows the third party After the application server obtains the data of the terminal, it is also used for:

When it is determined that the terminal does not allow the third-party application server to obtain the data of the terminal, determine that the verification information is invalid;

The sending unit is also used for:

A notification message indicating that the verification information is invalid is sent to the third-party application server.

With reference to the fourth aspect and any of the first to fourth possible implementation manners of the fourth aspect, in a fifth possible implementation manner of the fourth aspect, the data of the terminal includes private data of the terminal.

In a fifth aspect, a third-party application server provided by an embodiment of the present invention includes:

a sending unit, configured to send a first message to a network device, where the first message is used to request the terminal to allow the third-party application server to acquire data of the terminal;

A receiving unit, configured to receive verification information sent by the network device, where the verification information is used by the third-party application server to acquire data of the terminal.

With reference to the fifth aspect, in the first possible implementation manner, it also includes:

A processing unit, configured to access the third-party application server through the terminal before the sending unit sends the first message to the network device, and determine that the third-party application server needs to acquire the data of the terminal.

With reference to the fifth aspect or the first possible implementation manner of the fifth aspect, in the second possible implementation manner of the fifth aspect, the sending unit is further configured to:

After receiving the verification information sent by the network device, the receiving unit sends a second message to the network device, where the second message carries the verification information;

The receiving unit is also used for:

Receive the data of the terminal sent by the network device.

With reference to the fifth aspect and any possible implementation manners of the first to the second aspect of the fifth aspect, in a third possible implementation manner of the fifth aspect, the receiving unit is further configured to:

After receiving the verification information sent by the network device, receive a notification message sent by the network device to indicate that the verification information is invalid.

With reference to the fifth aspect and any of the first to third possible implementation manners of the fifth aspect, in a fourth possible implementation manner of the fifth aspect, the data of the terminal includes private data of the terminal.

In a sixth aspect, a terminal provided by an embodiment of the present invention includes:

a processing unit, configured to determine that the terminal allows a third-party application server to obtain data of the terminal;

A sending unit, configured to send a notification message for instructing the terminal to allow the third-party server to acquire data of the terminal to a network device.

With reference to the sixth aspect, in a first possible implementation manner, the sending unit is further configured to:

Sending verification information for the third-party application server to acquire the data of the terminal to the network device.

With reference to the sixth aspect or the first possible implementation manner of the sixth aspect, in the second possible implementation manner of the sixth aspect, the sending unit is further configured to:

Sending the time length during which the terminal allows the third-party application server to obtain the data of the terminal to the network device.

With reference to the sixth aspect and any possible implementation manners of the first to second aspects of the sixth aspect, in a third possible implementation manner of the sixth aspect, the sending unit is further configured to:

After sending a notification message to the network device for instructing the terminal to allow the third-party server to acquire the data of the terminal, sending a notification message to the network device to instruct the terminal to not allow the third-party application server to acquire the data of the terminal The notification message of the data of the terminal.

With reference to the sixth aspect and any of the first to third possible implementation manners of the sixth aspect, in a fourth possible implementation manner of the sixth aspect, the data of the terminal includes private data of the terminal.

In a seventh aspect, a terminal data open control system provided by an embodiment of the present invention includes a network device, a third-party application server, and a terminal, wherein,

The network device includes the network device described in any one of the fourth aspect and the first to fifth possible implementation manners of the fourth aspect;

The third-party application server includes the third-party application server described in any one of the fifth aspect and the first to fourth possible implementation manners of the fifth aspect;

The terminal includes the terminal described in any one of the sixth aspect and the first to fourth possible implementation manners of the sixth aspect.

In the embodiment of the present invention, when the third-party application server needs to obtain the private data of the terminal, the network device provides the third-party application server with the private data of the terminal after obtaining the permission of the terminal, thereby realizing that the MBB network can securely open the terminal's private data for the third-party application server. Privacy Data.

Description of drawings

1 is a schematic diagram of a system architecture provided by an embodiment of the present invention;

2 is a schematic flowchart of a method for controlling terminal data opening provided by an embodiment of the present invention;

3 is a schematic flowchart of a method for controlling terminal data opening provided by an embodiment of the present invention;

4 is a schematic flowchart of a method for controlling terminal data opening provided by an embodiment of the present invention;

5 is a schematic flowchart of a method for controlling terminal data opening provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a network device according to an embodiment of the present invention;

7 is a schematic structural diagram of a third-party application server according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a terminal according to an embodiment of the present invention;

9 is a schematic structural diagram of a terminal data opening control system provided by an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of a network device according to an embodiment of the present invention;

11 is a schematic structural diagram of a third-party application server according to an embodiment of the present invention;

FIG. 12 is a schematic structural diagram of a terminal according to an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Embodiments of the present invention provide a terminal data opening control method and system, a network device, a third-party application server, and a terminal, so as to implement the MBB network to securely open the terminal's private data for the third-party application server. Among them, the method and the device are based on the same inventive concept. Since the principles of the method and the device for solving the problem are similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated.

The technical solutions provided by the embodiments of the present invention are applicable to Mobile Broadband (MBB) networks, and the MBB networks open up network capabilities to cultivate more partners and increase the operating income of MBB network services. The MBB network open network capability includes the MBB network to open the private data of the terminal for the third-party application server.

Taking the system architecture shown in Figure 1 as an example, Figure 1 includes a network device, a third-party application server, and a terminal. After the terminal is connected to the network device, the terminal accesses the third-party application server, and the third-party application server determines whether the Obtain the private data of the terminal. The technical solutions provided by the embodiments of the present invention relate to the situation that a third-party application server needs to obtain the private data of the terminal. The network device provides the third-party application server with the private data of the terminal after obtaining the permission of the terminal. The private data of the terminal includes the location information of the terminal, Terminal identification, etc.

The network equipment refers to the equipment in the MBB network. The MBB network includes the radio access network (Radio Access Network, RAN) and the Evolved Packet Core (Evolved Packet Core, EPC) logical unit, or includes the Evolved Radio Access Network (Evolved Radio Access Network) , eRAN) and EPC logic unit. Optionally, in order to open the network capability of the MBB network, a Unified Capability Center (UCC) device is introduced into the MBB network, and the UCC device can be used to collect MBB network data, including the private data of the terminal, with the permission of the terminal. The UCC device provides the private data of the terminal to the third-party application server through an application programming interface (Application Programming Interface, API). It should be noted that the equipment in the MBB network used to collect the private data of the terminal and provide the private data of the terminal to the third-party application server can be not only the UCC equipment, but also other equipment. The UCC equipment introduced into the MBB network is only one. Example.

It should be noted that, in the content provided in the following embodiments, before the terminal accesses the third-party application server, the terminal has been connected to the MBB network where the network device is located.

A method for controlling terminal data opening provided by an embodiment of the present invention is described below with reference to the flowchart shown in FIG. 2 .

As shown in FIG. 2 , in a terminal data opening control method provided by an embodiment of the present invention, an interaction process among a network device, a third-party application server, and a terminal is as follows:

S201, the terminal accesses a third-party application server.

Optionally, the terminal accesses the third-party application server through a browser, or a third-party application is installed on the terminal, and the terminal accesses the third-party application server through the installed third-party application.

S202. The third-party application server determines that the third-party application server needs to obtain data of the terminal.

S203. The third-party application server sends a first message to the network device, where the first message is used to request the terminal to allow the third-party application server to acquire data of the terminal.

S204: The network device sends a request message to the terminal for requesting to indicate whether the terminal allows a third-party application server to acquire data of the terminal.

S205: The terminal sends a notification message to the network device for instructing the terminal to allow the third-party server to acquire data of the terminal.

Optionally, the notification message further includes the length of time that the terminal allows the third-party application server to acquire the data of the terminal.

S206: The network device determines verification information for the third-party application server to acquire data of the terminal.

For example, the verification information may be in the form of a key or the like, and the form of the verification information is not limited in this embodiment of the present invention.

Optionally, the network device is configured with verification information for a third-party application server to acquire data of the terminal; or, the network device receives verification information sent by the terminal for the third-party application server to acquire data of the terminal. The verification information may be carried in the notification message sent by the terminal to the network device in S205. For example, when a software development kit (Software Development Kit, SDK) of a network device is installed on the terminal, for example, the SDK of UCC is installed on the terminal, the terminal has the function of generating verification information. Send the authentication information to the network device.

After determining the verification information used by the third-party application server to obtain the data of the terminal, the network device saves the association information between the identifier of the terminal, the identifier of the third-party application server, and the verification information used by the third-party application server to obtain the data of the terminal, The associated information may be referred to as authorization information, and the subsequent network device determines according to the stored authorization information that the terminal allows the third-party application server to acquire data of the terminal.

S207: The network device sends the verification information used by the third-party application server to obtain the data of the terminal to the third-party application server.

Optionally, after receiving the verification information for the third-party application server to acquire data of the terminal, the third-party application server saves the association information between the identifier of the terminal and the verification information, and the association information may also be called authorization information. Subsequent third-party application servers may use the authorization information stored by themselves to request the network device to acquire terminal data.

Optionally, after the third-party application server acquires the verification information for the third-party application server to acquire the data of the terminal, the verification information may be used to acquire the data of the terminal from the network device. Specifically, it includes the following S208 to S209:

S208: The third-party application server sends a second message to the network device, where the second message carries verification information for the third-party application server to acquire data of the terminal.

Optionally, the second message includes the identifier of the terminal and the identifier of the third-party application server. The second message is used to instruct the requesting network device to send data of the terminal to the third-party application server.

S209, the network device sends data of the terminal to the third-party application server.

After receiving the second message, the network device matches the authentication information carried in the second message with the authorization information stored by itself. When the matching is successful, the network device determines that the terminal allows the third-party application server to obtain the data of the terminal, and then sends the data of the terminal to the third-party application server.

Optionally, the method shown in FIG. 2 further includes a method for determining that the verification information is invalid, and the verification information refers to the verification information used by the third-party application server to obtain the data of the terminal. After it is determined that the verification information is invalid, the third-party application server will not be able to obtain the terminal data from the network device through the invalid verification information. The method for determining that the verification information is invalid in the embodiment of the present invention includes the following method 1 and method 2:

Method 1: If the notification message sent by the terminal to the network device in S205 further includes: the length of time that the terminal allows the third-party application server to obtain the data of the terminal, the method for determining that the verification information is invalid includes the following S210 to S211:

S210. Take the time when the network device determines that the terminal allows the third-party application server to obtain the data of the terminal as the starting time, and when the duration exceeds the time length, the network device determines that the verification information is invalid.

For example, by setting a timer, the network device determines whether the verification information is invalid based on the time when the network device determines that the terminal allows the third-party application server to obtain the terminal's data as the starting time, and whether the duration exceeds the time length.

Optionally, the network device deletes the authorization information stored by itself and includes the invalid verification information, and the authorization information includes the identification of the terminal, the identification of the third-party application server, and the verification information used by the third-party application server to obtain the data of the terminal. related information.

S211. The network device sends a notification message to a third-party application server to indicate that the verification information is invalid.

Optionally, after the third-party application server receives the notification message sent by the network device in S211, the third-party application server deletes the authorization information stored by itself and includes the invalid verification information, and the authorization information includes the identifier of the terminal and the authorization information used for the third-party application server. The third-party application server obtains the association information between the verification information of the data of the terminal.

Method 2: The method for determining that the verification information is invalid includes the following S212 to S214:

S212. The terminal sends a notification message to the network device to instruct the terminal not to allow the third-party application server to acquire data of the terminal.

S213, the network device determines that the verification information is invalid.

After the network device determines that the verification information is invalid, the operations performed are the same as the operations performed by the network device after the network device determines that the verification information is invalid in method 1 S210, namely:

Optionally, the network device deletes the authorization information stored by itself and includes the invalid verification information, and the authorization information includes the identification of the terminal, the identification of the third-party application server, and the verification information used by the third-party application server to obtain the data of the terminal. related information.

S214: The network device sends a notification message to the third-party application server for indicating that the verification information is invalid.

Optionally, after the third-party application server receives the notification message sent by the network device in S211, the third-party application server deletes the authorization information stored by itself and includes the invalid verification information, and the authorization information includes the identifier of the terminal and the authorization information used for the third-party application server. The third-party application server obtains the association information between the verification information of the data of the terminal.

The following describes a terminal data opening control method provided by an embodiment of the present invention by using an example.

Example 1: The terminal accesses the third-party application server through the browser, and the interaction between the third-party application server and the network device needs to be realized through the redirection mechanism of the browser. As shown in FIG. 3 , a terminal data opening control method provided by an embodiment of the present invention is as follows:

S301. The terminal accesses a third-party application server through a browser.

S302. The third-party application server determines that the third-party application server needs to obtain data of the terminal.

S303. The third-party application server sends a first message to the network device through the redirection mechanism of the browser, where the first message is used to request the terminal to allow the third-party application server to acquire data of the terminal.

In the application scenario in which the terminal accesses the third-party application server through the browser, the browser can communicate directly with the third-party application server, and the browser can also communicate directly with the network device, while the third-party application server and the network device do not save the relationship between each other. The address information of the terminal cannot be communicated directly between the third-party application server and the network device. The redirection mechanism of the browser means that when any one end of the third-party application server and the network device sends a message to the opposite end, the browser needs to forward the message to realize the communication.

S304: The network device sends a request message to the terminal for requesting to indicate whether the terminal allows a third-party application server to acquire data of the terminal.

S305: The terminal sends a notification message to the network device for instructing the terminal to allow the third-party server to acquire data of the terminal.

Optionally, the notification message further includes the length of time that the terminal allows the third-party application server to acquire the data of the terminal.

S306: The network device determines verification information for the third-party application server to acquire data of the terminal.

In the application scenario where the terminal accesses the third-party application server through the browser, the network device is configured for the third-party application server to obtain the authentication information of the terminal's data.

S307 , the network device sends the verification information used by the third-party application server to obtain the data of the terminal to the third-party application server through the redirection mechanism of the browser.

Optionally, after the third-party application server acquires the verification information for the third-party application server to acquire the data of the terminal, the verification information may be used to acquire the data of the terminal from the network device. Specifically, it includes the following S308 to S309:

S308: The third-party application server sends a second message to the network device through the redirection mechanism of the browser, where the second message carries verification information for the third-party application server to acquire data of the terminal.

S309, the network device sends the data of the terminal to the third-party application server through the redirection mechanism of the browser.

Optionally, the method shown in FIG. 3 further includes a method for determining that the verification information is invalid, and the verification information refers to the verification information used by the third-party application server to obtain the data of the terminal. After it is determined that the verification information is invalid, the third-party application server will not be able to obtain the terminal data from the network device through the invalid verification information. The method for determining that the authentication information is invalid in FIG. 3 is similar to the method for determining that the authentication information is invalid in FIG. 2 , except that the communication between the third-party application server and the network-side device in FIG. 3 needs to be implemented through a browser redirection mechanism. No further description is given in FIG. 3 .

For example, the methods for determining that the verification information is invalid in the first example include the following methods 1 and 2:

Method 1: If the notification message sent by the terminal to the network device in S305 further includes: the length of time that the terminal allows the third-party application server to obtain the data of the terminal, the method for determining that the verification information is invalid includes the following:

Taking the time when the network device determines that the terminal allows the third-party application server to obtain the data of the terminal as the starting time, when the duration exceeds the time length, the network device determines that the verification information is invalid.

Optionally, the network device deletes the authorization information stored by itself and includes the invalid verification information, and the authorization information includes the identification of the terminal, the identification of the third-party application server, and the verification information used by the third-party application server to obtain the data of the terminal. related information.

The network device sends a notification message indicating that the authentication information is invalid to the third-party application server through the redirection mechanism of the browser.

Optionally, after the third-party application server receives a notification message sent by the network device indicating that the verification information is invalid, the third-party application server deletes the authorization information stored by itself and includes the invalid verification information, and the authorization information includes the identification of the terminal and the authorization information. Correlation information between verification information used by the third-party application server to obtain data of the terminal.

Method 2: The terminal sends a notification message to the network device for instructing the terminal not to allow the third-party application server to acquire data of the terminal.

Optionally, after the network device determines that the verification information is invalid, it deletes the authorization information stored by itself and includes the invalid verification information, and the authorization information includes the identifier of the terminal, the identifier of the third-party application server, and the identifier used by the third-party application server to obtain the terminal. The association information between the verification information of the data.

After the network device determines that the verification information is invalid, the network device sends a notification message for indicating that the verification information is invalid to the third-party application server through the redirection mechanism of the browser.

Optionally, after the third-party application server receives the notification message sent by the network device to indicate that the verification information is invalid, the third-party application server deletes the authorization information stored by itself and includes the invalid verification information, and the authorization information includes the terminal's authorization information. The association information between the identifier and the verification information used by the third-party application server to obtain the terminal's data.

Example 2: A third-party application is installed on the terminal, the terminal accesses the third-party application server through the installed third-party application, and the SDK of the network device is installed on the terminal. In this application scenario, the terminal generates verification information for a third-party application server to acquire data of the terminal, and the terminal sends the verification information to the network device. As shown in FIG. 4 , a terminal data opening control method provided by an embodiment of the present invention is as follows:

S401. The terminal accesses a third-party application server through an installed third-party application.

S402. The third-party application server determines that the third-party application server needs to obtain data of the terminal.

S403. The third-party application server sends a first message to the network device, where the first message is used to request the terminal to allow the third-party application server to acquire data of the terminal.

S404: The network device sends a request message to the terminal for requesting to indicate whether the terminal allows a third-party application server to acquire data of the terminal.

S405: The terminal sends a notification message to the network device for instructing the terminal to allow the third-party server to acquire data of the terminal, where the notification message carries verification information for the third-party application server to acquire the data of the terminal.

Optionally, the notification message further includes the length of time that the terminal allows the third-party application server to acquire the data of the terminal.

S406, the network device saves the verification information for the third-party application server to obtain the data of the terminal.

S407: The network device sends the verification information used by the third-party application server to obtain the data of the terminal to the third-party application server.

Optionally, after the third-party application server acquires the verification information for the third-party application server to acquire the data of the terminal, the verification information may be used to acquire the data of the terminal from the network device. Specifically, it includes the following S408 to S409:

S408: The third-party application server sends a second message to the network device, where the second message carries verification information for the third-party application server to acquire data of the terminal.

S409, the network device sends data of the terminal to the third-party application server.

Optionally, the method shown in FIG. 4 further includes a method for determining that the verification information is invalid. The method for determining that the verification information is invalid in FIG. 4 is the same as the method for determining that the verification information is invalid in FIG. 2 , and details are not repeated here.

Example 3: A third-party application is installed on the terminal, and the terminal accesses the third-party application server through the installed third-party application, but the SDK of the network device is not installed on the terminal. In this application scenario, the verification information for the third-party application server to obtain the terminal data is generated by the network device. As shown in FIG. 5 , a terminal data opening control method provided by an embodiment of the present invention is as follows:

S501. The terminal accesses a third-party application server through an installed third-party application.

S502. The third-party application server determines that the third-party application server needs to obtain data of the terminal.

S503. The third-party application server sends a first message to the network device, where the first message is used to request the terminal to allow the third-party application server to acquire data of the terminal.

S504: The network device sends a request message to the terminal for requesting to indicate whether the terminal allows a third-party application server to acquire data of the terminal.

S505. The terminal sends a notification message to the network device for instructing the terminal to allow the third-party server to acquire data of the terminal.

Optionally, the notification message further includes the length of time that the terminal allows the third-party application server to acquire the data of the terminal.

S506. The network device generates verification information for the third-party application server to acquire data of the terminal.

S507: The network device sends the verification information used by the third-party application server to obtain the terminal data to the third-party application server.

Optionally, after the third-party application server acquires the verification information for the third-party application server to acquire the data of the terminal, the verification information may be used to acquire the data of the terminal from the network device. Specifically, it includes the following S508 to S509:

S508: The third-party application server sends a second message to the network device, where the second message carries verification information for the third-party application server to acquire data of the terminal.

S509, the network device sends data of the terminal to the third-party application server.

Optionally, the method shown in FIG. 5 further includes a method for determining that the verification information is invalid. The method for determining that the verification information is invalid in FIG. 5 is the same as the method for determining that the verification information is invalid in FIG. 2 , and details are not repeated here.

In the technical solution provided in the embodiment of the present invention, when the third-party application server needs to obtain the private data of the terminal, the network device provides the private data of the terminal for the third-party application server after obtaining the permission of the terminal, thereby realizing the MBB network security for the third-party application server. The application server opens the private data of the terminal. At the same time, when the third-party application server needs to obtain the private data of the terminal, the third-party application server needs to obtain the permission of the network device and the permission of the terminal respectively. The technical solution provided in the embodiment of the present invention can reduce the network device being the third-party application server. The complexity of the process when providing the terminal's private data.

Based on the above embodiments, an embodiment of the present invention further provides a network device, which can adopt the method corresponding to the network device provided in the embodiment corresponding to FIG. 2 . Referring to FIG. 6 , the network device 600 includes: a receiving unit 601 , a processing unit 602 and a sending unit 603 .

A receiving unit 601, configured to receive a first message sent by a third-party application server, where the first message is used to request the terminal to allow the third-party application server to obtain data of the terminal;

A processing unit 602, configured to determine that the terminal allows a third-party application server to acquire data of the terminal; determine verification information for the third-party application server to acquire data of the terminal;

The sending unit 603 is configured to send the verification information determined by the processing unit 602 to a third-party application server.

Optionally, when the processing unit 602 determines the verification information for the third-party application server to obtain the data of the terminal, it is specifically used for:

Configure the authentication information used by the third-party application server to obtain the terminal's data; or

The receiving unit 601 is further configured to: receive the verification information sent by the terminal and used for the third-party application server to obtain the data of the terminal;

When the processing unit 602 determines the verification information for the third-party application server to obtain the data of the terminal, it is specifically used for:

The verification information received by the receiving unit 601 is determined as verification information for the third-party application server to acquire data of the terminal.

Optionally, the receiving unit 601 is also used for:

receiving a second message sent by a third-party application server, where the second message carries verification information;

The sending unit 603 is also used for:

Send terminal data to a third-party application server.

Optionally, after the processing unit 602 determines that the terminal allows the third-party application server to obtain the data of the terminal, the processing unit 602 is further used for:

Determine the length of time that the terminal allows the third-party application server to obtain the data of the terminal;

Taking the time when the processing unit 602 determines that the terminal allows the third-party application server to obtain the data of the terminal as the starting time, when the duration exceeds the time length, it is determined that the verification information is invalid;

The sending unit 603 is also used for:

Send a notification message to the third-party application server to indicate that the authentication information is invalid.

Optionally, after the processing unit 602 determines that the terminal allows the third-party application server to obtain the data of the terminal, the processing unit 602 is further used for:

When it is determined that the terminal does not allow the third-party application server to obtain the data of the terminal, it is determined that the verification information is invalid;

The sending unit 603 is also used for:

Send a notification message to the third-party application server to indicate that the authentication information is invalid.

Optionally, the data of the terminal includes private data of the terminal.

Based on the above embodiments, an embodiment of the present invention further provides a third-party application server, which may adopt the method corresponding to the third-party application server provided in the embodiment corresponding to FIG. 2 . Referring to FIG. 7 , the third-party application server The third-party application server 700 includes: a sending unit 701 , a receiving unit 702 and a processing unit 703 .

A sending unit 701, configured to send a first message to a network device, where the first message is used to request the terminal to allow a third-party application server to obtain data of the terminal;

The receiving unit 702 is configured to receive verification information sent by the network device, where the verification information is used by a third-party application server to obtain data of the terminal.

Optionally, also include:

The processing unit 703 is configured to access the third-party application server through the terminal before the sending unit 701 sends the first message to the network device, and determine that the third-party application server needs to obtain the data of the terminal.

Optionally, the sending unit 701 is further configured to:

After receiving the verification information sent by the network device, the receiving unit 702 sends a second message to the network device, where the second message carries the verification information;

The receiving unit 702 is also used for:

Receive terminal data sent by network equipment.

Optionally, the receiving unit 702 is further configured to:

After receiving the verification information sent by the network device, receive a notification message sent by the network device to indicate that the verification information is invalid.

Optionally, the data of the terminal includes private data of the terminal.

Based on the above embodiments, an embodiment of the present invention further provides a terminal, which can adopt the method corresponding to the terminal provided in the embodiment corresponding to FIG. 2 . Referring to FIG. 8 , the terminal 800 includes: a processing unit 801 and a sending unit 802.

A processing unit 801, configured to determine that the terminal allows a third-party application server to obtain data of the terminal;

The sending unit 802 is configured to send a notification message for instructing the terminal to allow a third-party server to acquire data of the terminal to the network device.

Optionally, the sending unit 802 is further configured to:

Send the verification information for the third-party application server to obtain the terminal's data to the network device.

Optionally, the sending unit 802 is further configured to:

Send the length of time that the terminal allows the third-party application server to obtain the data of the terminal to the network device.

Optionally, the sending unit 802 is further configured to:

After sending a notification message for instructing the terminal to allow the third-party server to acquire data of the terminal to the network device, a notification message for instructing the terminal to not allow the third-party application server to acquire the data of the terminal is sent to the network device.

Optionally, the data of the terminal includes private data of the terminal.

Based on the above embodiments, an embodiment of the present invention further provides a terminal data opening control system. Referring to FIG. 9 , the terminal data opening control system 900 includes: a network device 901 , a third-party application server 902 and a terminal 903 . The network device 901 may be the same device as the network device shown in FIG. 6 , the third-party application server 902 may be the same device as the third-party application server shown in FIG. 7 , and the terminal 903 may be the same device as the third-party application server shown in FIG. 8 . Terminal the same device.

It should be noted that, the division of units in the embodiment of the present invention is schematic, and is only a logical function division, and there may be other division manners in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented as a software functional unit and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (processor) to execute all or part of the steps of the methods in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

Based on the above embodiments, an embodiment of the present invention further provides a network device, which may adopt the method corresponding to the network device in the embodiment corresponding to FIG. 2 , and may be the same device as the network device shown in FIG. 6 . Referring to FIG. 10, the network device 1000 includes: a receiver 1001, a processor 1002, a transmitter 1003, a bus 1004, and a memory 1005, wherein:

The receiver 1001 corresponds to the receiving unit 601 in FIG. 6 , the processor 1002 corresponds to the processing unit 602 in FIG. 6 , and the transmitter 1003 corresponds to the sending unit 603 in FIG. 6 . The network device 1000 further includes a memory 1005 for storing programs and the like. Specifically, the program may include program code, the program code including computer operation instructions. The memory 1005 may include random access memory (RAM), and may also include non-volatile memory (non-volatile memory), such as at least one disk storage. The processor 1002 executes the application program stored in the memory 1005 to implement the above terminal data opening control method.

The receiver 1001, the processor 1002, the transmitter 1003 and the memory 1005 are connected to each other through a bus 1004; the bus 1004 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (extended industry standard architecture, referred to as EISA) bus and so on. The bus can be divided into address bus, data bus, control bus and so on. For ease of presentation, only one thick line is used in FIG. 10, but it does not mean that there is only one bus or one type of bus.

Based on the above embodiments, an embodiment of the present invention further provides a third-party application server, and the third-party application server may adopt the method corresponding to the third-party application server in the embodiment corresponding to FIG. The same device as the third-party application server. 11, the third-party application server 1100 includes: a transmitter 1101, a receiver 1102, a processor 1103, a bus 1104, and a memory 1105, wherein:

The transmitter 1101 corresponds to the sending unit 701 in FIG. 7 , the receiver 1102 corresponds to the receiving unit 702 in FIG. 7 , and the processor 1103 corresponds to the processing unit 703 in FIG. 7 . The third-party application server 1100 further includes a memory 1105 for storing programs and the like. Specifically, the program may include program code, the program code including computer operation instructions. Memory 1105 may include RAM and may also include non-volatile memory, such as at least one disk storage. The processor 1103 executes the application program stored in the memory 1105 to implement the above terminal data opening control method.

The transmitter 1101, the receiver 1102, the processor 1103 and the memory 1105 are connected to each other through a bus 1104; the bus 1104 may be a PCI bus or an EISA bus or the like. The bus can be divided into address bus, data bus, control bus and so on. For ease of presentation, only one thick line is used in FIG. 11, but it does not mean that there is only one bus or one type of bus.

Based on the above embodiments, an embodiment of the present invention further provides a terminal, which may adopt the method corresponding to the terminal in the embodiment corresponding to FIG. 2 , and may be the same device as the terminal shown in FIG. 8 . Referring to FIG. 12, the terminal 1200 includes: a processor 1201, a transmitter 1202, a receiver 1203, a bus 1204, and a memory 1205, wherein:

The processor 1201 corresponds to the processing unit 801 in FIG. 8 , and the transmitter 1202 corresponds to the sending unit 802 in FIG. 8 . The terminal 1200 further includes a receiver 1203 for receiving messages sent to the terminal 1200 by other devices. The terminal 1200 also includes a memory 1205 for storing programs and the like. Specifically, the program may include program code, the program code including computer operation instructions. Memory 1205 may include RAM and may also include non-volatile memory, such as at least one disk storage. The processor 1201 executes the application program stored in the memory 1205 to implement the above terminal data opening control method.

The processor 1201, the transmitter 1202, the receiver 1203 and the memory 1205 are connected to each other through a bus 1204; the bus 1204 may be a PCI bus or an EISA bus or the like. The bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is shown in FIG. 12, but it does not mean that there is only one bus or one type of bus.

Although preferred embodiments of the present invention have been described, additional changes and modifications to these embodiments may occur to those skilled in the art once the basic inventive concepts are known. Therefore, the appended claims are intended to be construed to include the preferred embodiment and all changes and modifications that fall within the scope of the present invention.

Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, provided that these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include such modifications and variations.

Claims (29)

1. A terminal data opening control method is characterized by comprising the following steps:

the method comprises the steps that network equipment receives a first message sent by a third-party application server, wherein the first message is used for requesting a terminal to allow the third-party application server to acquire data of the terminal;

the network equipment determines that the terminal allows the third-party application server to acquire the data of the terminal;

the network equipment is configured to be used for the third-party application server to acquire verification information of the data of the terminal, or the network equipment receives the verification information sent by the terminal and used for the third-party application server to acquire the data of the terminal, and sends the verification information to the third-party application server.

2. The method of claim 1, wherein after the network device sends the authentication information to the third-party application server, further comprising:

the network equipment receives a second message sent by the third-party application server, wherein the second message carries the verification information;

and the network equipment sends the data of the terminal to the third-party application server.

3. The method of claim 1 or 2, wherein after the network device determines that the terminal allows the third-party application server to obtain the data of the terminal, the method further comprises:

the network equipment determines the time length of the terminal for allowing the third-party application server to acquire the data of the terminal;

the time when the network equipment determines that the terminal allows the third-party application server to acquire the data of the terminal is taken as an initial time, and when the duration time exceeds the time length, the network equipment determines that the verification information is invalid; and

sending a notification message to the third party application server indicating that the verification information is invalid.

4. The method of claim 1, wherein after the network device determines that the terminal allows the third-party application server to obtain the data of the terminal, the method further comprises:

when the network equipment determines that the terminal does not allow the third-party application server to acquire the data of the terminal, the network equipment determines that the verification information is invalid; and

sending a notification message to the third party application server indicating that the verification information is invalid.

5. The method of claim 1, wherein the data of the terminal comprises privacy data of the terminal.

6. A terminal data opening control method is characterized by comprising the following steps:

a third-party application server sends a first message to network equipment, wherein the first message is used for requesting a terminal to allow the third-party application server to acquire data of the terminal;

and the third-party application server receives verification information sent by the network equipment, wherein the verification information is configured by the network equipment or received by the network equipment from the terminal, and the verification information is used for the third-party application server to acquire the data of the terminal.

7. The method of claim 6, wherein prior to the third party application server sending the first message to the network device, further comprising:

and the third-party application server accesses the third-party application server through the terminal and determines that the third-party application server needs to acquire the data of the terminal.

8. The method of claim 6 or 7, wherein after the third party application server receives the authentication information sent by the network device, the method further comprises:

the third-party application server sends a second message to the network equipment, wherein the second message carries the verification information;

and the third-party application server receives the data of the terminal sent by the network equipment.

9. The method of claim 6, wherein after the third party application server receives the authentication information sent by the network device, further comprising:

and the third-party application server receives a notification message which is sent by the network equipment and used for indicating that the verification information is invalid.

10. The method of claim 6, wherein the data of the terminal comprises privacy data of the terminal.

11. A terminal data opening control method is characterized by comprising the following steps:

the terminal determines that a third-party application server is allowed to acquire the data of the terminal;

the terminal sends a notification message for indicating that the terminal allows the third-party server to acquire the data of the terminal to network equipment;

and the terminal sends verification information for the third-party application server to acquire the data of the terminal to the network equipment.

12. The method of claim 11, wherein after the terminal determines that the third party application server is allowed to obtain the data of the terminal, further comprising:

and the terminal sends the time length of the terminal allowing the third-party application server to acquire the data of the terminal to the network equipment.

13. The method according to claim 11 or 12, wherein after the terminal sends a notification message to a network device for instructing the terminal to allow the third-party server to acquire the data of the terminal, the method further comprises:

and the terminal sends a notification message for indicating that the terminal does not allow the third-party application server to acquire the data of the terminal to the network equipment.

14. The method of claim 11, wherein the data of the terminal comprises privacy data of the terminal.

15. A network device, comprising:

the device comprises a receiving unit, a sending unit and a receiving unit, wherein the receiving unit is used for receiving a first message sent by a third-party application server, and the first message is used for requesting a terminal to allow the third-party application server to acquire data of the terminal;

the processing unit is used for determining that the terminal allows the third-party application server to acquire the data of the terminal; determining verification information for the third-party application server to acquire the data of the terminal;

when the processing unit determines that the third-party application server obtains the verification information of the data of the terminal, the processing unit is specifically configured to:

configuring verification information for the third-party application server to acquire the data of the terminal; or

The receiving unit is further configured to: receiving verification information which is sent by the terminal and used for the third-party application server to acquire the data of the terminal;

when the processing unit determines that the third-party application server obtains the verification information of the data of the terminal, the processing unit is specifically configured to:

determining the verification information received by the receiving unit as verification information for the third-party application server to acquire the data of the terminal;

and the sending unit is used for sending the verification information determined by the processing unit to the third-party application server.

16. The network device of claim 15, wherein the receiving unit is further to:

receiving a second message sent by the third-party application server, wherein the second message carries the verification information;

the sending unit is further configured to:

and sending the data of the terminal to the third-party application server.

17. The network device according to claim 15 or 16, wherein after the processing unit determines that the terminal allows the third-party application server to obtain the data of the terminal, the processing unit is further configured to:

determining the time length of the terminal for allowing the third-party application server to acquire the data of the terminal;

the time when the processing unit determines that the terminal allows the third-party application server to acquire the data of the terminal is taken as an initial time, and when the duration time exceeds the time length, the verification information is determined to be invalid;

the sending unit is further configured to:

sending a notification message to the third party application server indicating that the verification information is invalid.

18. The network device of claim 15, wherein after the processing unit determines that the terminal allows the third-party application server to obtain the data of the terminal, the processing unit is further configured to:

when the terminal is determined not to allow the third-party application server to acquire the data of the terminal, determining that the verification information is invalid;

the sending unit is further configured to:

sending a notification message to the third party application server indicating that the verification information is invalid.

19. The network device of claim 15, wherein the data for the terminal comprises privacy data for the terminal.

20. A third party application server, comprising:

a sending unit, configured to send a first message to a network device, where the first message is used to request a terminal to allow the third-party application server to obtain data of the terminal;

a receiving unit, configured to receive verification information sent by the network device, where the verification information is configured by the network device or received by the network device from the terminal, and the verification information is used by the third-party application server to obtain data of the terminal.

21. The third party application server of claim 20, further comprising:

and the processing unit is used for accessing the third-party application server through the terminal and determining that the third-party application server needs to acquire the data of the terminal before the sending unit sends the first message to the network equipment.

22. A third party application server according to claim 20 or 21, wherein the sending unit is further configured to:

after the receiving unit receives the verification information sent by the network equipment, sending a second message to the network equipment, wherein the second message carries the verification information;

the receiving unit is further configured to:

and receiving the data of the terminal sent by the network equipment.

23. The third-party application server of claim 20, wherein the receiving unit is further configured to:

after receiving the verification information sent by the network equipment, receiving a notification message sent by the network equipment and used for indicating that the verification information is invalid.

24. A third party application server according to claim 20, wherein the data of the terminal comprises privacy data of the terminal.

25. A terminal, comprising:

the processing unit is used for determining that the terminal allows a third-party application server to acquire the data of the terminal;

a sending unit, configured to send, to a network device, a notification message for instructing the terminal to allow the third-party server to acquire data of the terminal;

the sending unit is further configured to send verification information used for the third-party application server to obtain the data of the terminal to the network device.

26. The terminal of claim 25, wherein the sending unit is further configured to:

and sending the time length of the terminal allowing the third-party application server to acquire the data of the terminal to the network equipment.

27. The terminal according to claim 25 or 26, wherein the sending unit is further configured to:

after sending a notification message for indicating that the terminal allows the third-party server to acquire the data of the terminal to a network device, sending a notification message for indicating that the terminal does not allow the third-party application server to acquire the data of the terminal to the network device.

28. The terminal of claim 25, wherein the data of the terminal comprises privacy data of the terminal.

29. A terminal data open control system is characterized by comprising network equipment, a third-party application server and a terminal, wherein,

the network device comprises the network device of any of claims 15 to 19;

the third party application server comprising the third party application server of any of claims 20 to 24;

the terminal comprising a terminal according to any of claims 25 to 28.

Images