Generation method, generation device, authentication method and authentication system for authorization token

Abstract

The invention provides a generation method, a generation device, an authentication method and an authentication system for an authorization token. The generation method for the authorization token comprises the steps of matching an identify label, token generation time and token survival time of a third-party application to generate a related information string of the authorization token; according to the related information string of the authorization token, generating a signature key; according to the signature key and a preset signature algorithm, generating signature information corresponding to the related information string of the authorization token; and according to the related information string of the authorization token and the signature information, generating a character string of the authorization token. According to the generation method, the authorization token can be used immediately when generated, the safety is high, no storage space is required, the maintenance cost can be effectively reduced, the character string of the authorization token is a plaintext, the expandability is high, and the user experience is good.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a method for generating an authorization token, a generating device, an authentication method and an authentication system. Background technique [0002] With the continuous development of open platforms and cloud computing technologies, more and more Internet service providers (such as Facebook, Google, Baidu, Tencent, Taobao, Sina Weibo, etc.) Provide Open API (Open Application Programming Interface, open application programming interface), through which services or data can be opened to third-party applications. [0003] In order to ensure the security of the external Open API, prevent platform services or data from being used by unauthorized third-party applications, and prevent third-party applications from using services or data that have not been authorized by the platform or users, most Internet service providers provide All platforms require that third-party applic...

AI Technical Summary

Problems solved by technology

[0005] In the process of realizing the present invention, the inventors found that the prior art has at least the following problems: the authorization token generated by the random algorithm has no encryption function and is easy to be counterfeited or tampered with; There are security holes and low security; and the authorization token itself occupies a large amount of storage space in the database, which is not conducive to management and high maintenance costs

The authorization token generated by the symmetric encryption algorithm does not have any readability due to encryption, which is not conducive to service debugging, problem location, statistics, etc., and the authentication process must be decrypted first, and the encryption and decryption process must use the preset Assuming that the algorithm and key are fixed, it is easy to be leaked, and there is a great security risk

Images