Application program authorization method, terminal, and server

1. A method, comprising:

sending, by a terminal, after a first application on the terminal is logged into successfully, a first request message to a first application server by using the first application, wherein the first request message is used for requesting to negotiate a token binding identifier of the first application;

receiving, by the terminal, a first response message from the first application server, wherein the first response message comprises generation information of the token binding identifier;

generating, by the terminal, the token binding identifier based on the generation information of the token binding identifier;

sending, by the terminal, the token binding identifier to the first application server; and

sending, by the terminal, a second request message to the first application server, requesting access to the first application server by at least one second application on the terminal using the token binding identifier of the first application, the at least one second application different than the first application and configured to log in by using the first application, wherein the second request message is used for obtaining resource access permission of the first application server for the at least one second application, and the second request message comprises the token binding identifier; and

wherein the sending the second request message to the first application server comprises:

receiving, by the terminal, user-input personal identification information;

determining, by the terminal, that the user-input personal identification information is consistent with personal identification information stored in the terminal; and

sending, by the at least one second application on the terminal, the second request message to the first application server; and

wherein the method further comprises:

after the generating the token binding identifier:

receiving, by the terminal, user-preentered personal identification information, wherein the user-preentered personal identification information is the personal identification information stored in the terminal; and

binding, by the terminal, the user-preentered personal identification information to the token binding identifier, wherein the user-preentered personal identification information is used for accessing the token binding identifier.

2. The method according to claim 1 , wherein the generation information of the token binding identifier comprises an asymmetric encryption algorithm list supported by the first application server, wherein the terminal comprises security hardware, and wherein the generating the token binding identifier comprises:

determining, by the terminal based on the asymmetric encryption algorithm list, an asymmetric encryption algorithm for generating the token binding identifier, wherein the security hardware supports the asymmetric encryption algorithm; and

generating, by the terminal, a public key and a private key based on the asymmetric encryption algorithm, wherein the public key comprises the token binding identifier.

3. The method according to claim 2 , wherein the generating the token binding identifier comprises:

determining, by the terminal, a validity period of the token binding identifier; and

protecting, by the terminal, the private key by using the security hardware.

4. The method according to claim 1 , wherein the personal identification information is at least one of a fingerprint, an iris, voice, a personal identification number PIN code, or an unlocking pattern.

5. The method according to claim 1 , wherein the first request message comprises at least one of:

a device certificate of the terminal and login status information of the first application, or

a service certificate of the first application and the login status information of the first application.

6. The method according to claim 1 , wherein the second request message comprises identification information of the at least one second application.

7. A method, comprising:

receiving, by a first application server, a first request message from a terminal, wherein the first request message is used for requesting to negotiate a token binding identifier of a first application;

sending, by the first application server, a first response message to the terminal, wherein the first response message comprises generation information of the token binding identifier;

receiving, by the first application server, the token binding identifier from the terminal; and

receiving, by the first application server, a second request message from the terminal, requesting access to the first application server by at least one second application on the terminal using the token binding identifier of the first application, the at least one second application different than the first application, wherein the second request message is used for obtaining resource access permission of the first application server, and the second request message comprises the token binding identifier; and

wherein the generation information of the token binding identifier comprises an asymmetric encryption algorithm list supported by the first application server, and the token binding identifier comprises a public key in a key pair generated by the terminal;

wherein the first request message comprises at least one of:

a device certificate of the terminal and login status information of the first application, or

a service certificate of the first application and the login status information of the first application; and

wherein the second request message comprises identification information of the at least one second application.

8. A terminal, comprising:

a processor; and

a non-transitory computer-readable storage medium storing a program to be executed by the processor, the program including instructions to:

send a first request message to a first application server by using a first application on the terminal, after the first application on the terminal is logged into successfully, wherein the first request message is used for requesting to negotiate a token binding identifier of the first application;

receive a first response message from the first application server, wherein the first response message comprises generation information of the token binding identifier;

generate the token binding identifier based on the generation information of the token binding identifier;

send the token binding identifier to the first application server; and

send a second request message to the first application server, requesting access to the first application server by at least one second application on the terminal using the token binding identifier of the first application, the at least one second application different than the first application and configured to log in by using the first application, wherein the second request message is used for obtaining resource access permission of the first application server for the at least one second application, and the second request message comprises the token binding identifier; and

wherein the program further includes instructions to:

receive user-input personal identification information;

determine that the user-input personal identification information is consistent with personal identification information stored in the terminal; and

send the second request message to the first application server by the at least one second application on the terminal; and

wherein the program further includes instructions to:

after the generating the token binding identifier:

receive user-preentered personal identification information, wherein the user-preentered personal identification information is the personal identification information stored in the terminal; and

bind the user-preentered personal identification information to the token binding identifier, wherein the user-preentered personal identification information is used for accessing the token binding identifier.

9. The terminal according to claim 8 , wherein the generation information of the token binding identifier comprises an asymmetric encryption algorithm list supported by the first application server, wherein the terminal further comprises security hardware, and wherein the program further includes instructions to:

determine an asymmetric encryption algorithm for generating the token binding identifier, based on the asymmetric encryption algorithm list, wherein the security hardware supports the asymmetric encryption algorithm; and

generate a public key and a private key based on the asymmetric encryption algorithm, wherein the public key comprises the token binding identifier.

10. The terminal according to claim 9 , wherein the program further includes instructions to:

determine a validity period of the token binding identifier; and

protect the private key by using the security hardware.

11. The terminal according to claim 8 , wherein the personal identification information is at least one of a fingerprint, an iris, voice, a personal identification number PIN code, or an unlocking pattern.

12. The terminal according to claim 8 , wherein the first request message comprises at least one of:

a device certificate of the terminal and login status information of the first application, or

a service certificate of the first application and the login status information of the first application.

13. The terminal according to claim 8 , wherein the second request message comprises identification information of the at least one second application.