Authorization method, server, system and storage medium

Abstract

The present disclosure provides an authorization method, which is applied to the field of financial technology, including: the authorization server generates an authentication token in response to a received authorization request, the authentication token includes the user information, and the user information in the authentication token is cached in a preset storage space; the authorization server sends an authentication request to the authentication server, the authentication request carries the authentication token; the authentication server performs authentication based on the authentication token to obtain an authentication result; the authentication server returns the authentication result to the authorization server, and the authentication server deletes the user information from the preset storage space. The present disclosure also provides an authorization method, an authorization server, an authentication server, an authorization system, a computer system, and a readable storage medium.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and more specifically, to an authorization method, an authorization server, an authentication server, an authorization system, a computer system, and a readable storage medium. Background Art

[0002] With the popularity of Internet applications, openness and sharing have become the main characteristics of today's Internet. Integrating different services provided by Internet service providers has become an inevitable trend in the development of the Internet. Based on the Oauth2.0 protocol, user information can be opened under the premise of user authorization.

[0003] In the process of implementing the concept of the present disclosure, the inventors found that there are at least the following problems in the related technology: the user authenticates by providing login information, and after successful authentication, the authorization server directly authorizes and then successfully logs in, which has low security. Summary of the invention

[0004] In view of this, the present disclosure provides an authorization method, an authorization server, an authentication server, an authorization system, a computer system and a readable storage medium.

[0005] One aspect of the present disclosure provides an authorization method, which is applied to an authorization server and includes:

[0006] In response to the received authorization request, generating an authentication token, the authentication token including the user information, the user information in the authentication token being cached in a preset storage space;

[0007] An authentication request is sent to an authentication server, wherein the authentication request carries the authentication token, so that the authentication server performs authentication based on the authentication token, obtains an authentication result, returns the authentication result to the authorization server, and deletes the user information from the preset storage space.

[0008] In one embodiment, the authentication token further includes first timestamp information, and the first timestamp information indicates a generation time or a sending time of the authentication token.

[0009] In one embodiment, the authorization request carries an identifier of a sender of the authorization request, and the authentication token further includes the identifier of the sender.

[0010] In one embodiment, it further includes:

[0011] Get the login information entered by the user;

[0012] Verify that the login information is correct;

[0013] If the login information is correct, an authorization confirmation prompt message is returned to the resource client;

[0014] The authorization confirmation information returned by the authorization client based on the authorization confirmation prompt information is received, and the operation of obtaining the user information from the preset storage space in response to the received authorization request is executed.

[0015] In one embodiment, wherein:

[0016] When the authentication result is that the authentication is passed, receiving the user information returned by the authentication server;

[0017] The user information is sent to the login client that calls the resource client for login, so as to successfully log in the login client.

[0018] In one embodiment, before sending the authentication request to the authentication server, the process includes:

[0019] The authentication token is encrypted and signed.

[0020] Another aspect of the present disclosure provides an authorization method, applied to an authentication server, comprising:

[0021] In response to a received authentication request carrying an authentication token, performing authentication based on the authentication token to obtain an authentication result, wherein the authentication token is generated by an authorization server, the authentication token includes the user information, and the user information in the authentication token is cached in a preset storage space;

[0022] Returning the authentication result to the authorization server;

[0023] The user information is deleted from the preset storage space.

[0024] In one embodiment, the authentication token further includes first timestamp information, the first timestamp information indicates a generation time or a sending time of the authentication token, and the authentication based on the authentication token to obtain an authentication result includes:

[0025] Parsing the authentication token to obtain first timestamp information;

[0026] Get the current timestamp;

[0027] Calculating a difference between the current timestamp and the first timestamp;

[0028] Determining whether the difference satisfies a preset condition;

[0029] If the difference does not meet the preset condition, the authentication result is authentication failure;

[0030] If the difference satisfies the preset condition, the authentication result is authentication passed.

[0031] In one embodiment, the authorization request carries an identifier of a sender of the authorization request, the authentication token also includes the identifier of the sender, and the authentication is performed based on the authentication token to obtain an authentication result including:

[0032] Searching for the sender's identifier in a preset identifier library, wherein the identifier library stores all valid sender identifiers;

[0033] If the sender's identifier is not found, the authentication result is authentication failure;

[0034] If the sender's identifier is found, the authentication result is authentication passed.

[0035] In one embodiment, when the authentication result is authentication passed, returning the authentication result to the authorization server includes:

[0036] The user information is sent to the authorization server, so that the authorization server sends the user information to the login client that calls the resource client for login, so as to successfully log in the login client.

[0037] In one embodiment, the authentication based on the authentication token, before obtaining the authentication result, includes:

[0038] Decrypting and verifying the authentication token;

[0039] If the decryption and signature verification process is successful, then the operation of performing authentication based on the authentication token to obtain an authentication result is performed;

[0040] If the decryption and / or signature verification process fails, a prompt message indicating the decryption and / or signature verification process failure is sent to the authorization server.

[0041] Another aspect of the present disclosure provides an authorization server, comprising:

[0042] An authentication token generation module, configured to generate an authentication token in response to a received authorization request, wherein the authentication token includes the user information, and the user information in the authentication token is cached in a preset storage space;

[0043] A request sending module is used to send an authentication request to an authentication server, wherein the authentication request carries the authentication token, so that the authentication server performs authentication based on the authentication token, obtains an authentication result, returns the authentication result to the authorization server, and deletes the user information from the preset storage space.

[0044] In one embodiment, the authentication token further includes first timestamp information, and the first timestamp information indicates a generation time or a sending time of the authentication token.

[0045] In one embodiment, the authorization request carries an identifier of a sender of the authorization request, and the authentication token further includes the identifier of the sender.

[0046] In one embodiment, it further includes:

[0047] A login information acquisition module is used to obtain the login information input by the user;

[0048] A login information verification module, used to verify whether the login information is correct;

[0049] A confirmation information return module is used to return authorization confirmation prompt information to the resource client if the login information is correct;

[0050] The confirmation information receiving module is used to receive the authorization confirmation information returned by the authorization client based on the authorization confirmation prompt information, and execute the operation of obtaining user information from the preset storage space in response to the received authorization request.

[0051] In one embodiment, the user information receiving module is used to receive the user information returned by the authentication server when the authentication result is authentication passed;

[0052] The user information sending module is used to send the user information to the login client that calls the resource client for login, so as to successfully log in to the login client.

[0053] In one embodiment, it further includes:

[0054] A processing module is used to encrypt and sign the authentication token.

[0055] Another aspect of the present disclosure provides an authentication server, comprising:

[0056] An authentication module, configured to respond to a received authentication request carrying an authentication token, perform authentication based on the authentication token, and obtain an authentication result, wherein the authentication token is generated by an authorization server, the authentication token includes the user information, and the user information in the authentication token is cached in a preset storage space;

[0057] An authentication result returning module, used for returning the authentication result to the authorization server;

[0058] The user information deleting module is used to delete the user information from the preset storage space.

[0059] In one embodiment, the authentication token further includes first timestamp information, the first timestamp information indicates a generation time or a sending time of the authentication token, and the authentication module includes:

[0060] A parsing submodule, used for parsing the authentication token to obtain first timestamp information;

[0061] Timestamp acquisition submodule, used to obtain the current timestamp;

[0062] A calculation submodule, configured to calculate a difference between the current timestamp and the first timestamp;

[0063] A judging submodule, used to judge whether the difference satisfies a preset condition;

[0064] A first determination submodule, configured to determine that if the difference does not satisfy the preset condition, the authentication result is an authentication failure;

[0065] The second determination submodule is used to determine that the authentication result is authentication passed if the difference satisfies the preset condition.

[0066] In one embodiment, the authorization request carries an identifier of a sender of the authorization request, the authentication token also includes the identifier of the sender, and the authentication module includes:

[0067] A search submodule, used for searching the identifier of the sender in a preset identifier library, wherein the identifier library stores all valid identifiers of senders;

[0068] The first determination submodule is further configured to determine that if the identifier of the sender is not found, the authentication result is authentication failure;

[0069] The second determination submodule is further configured to determine that if the identifier of the sender is found, the authentication result is authentication passed.

[0070] In one embodiment, when the authentication result is authentication passed, the authentication result returning module specifically sends the user information to the authorization server, so that the authorization server sends the user information to the login client that calls the resource client for login, so as to successfully log in to the login client.

[0071] In one embodiment, it further includes:

[0072] A decryption processing module, used to decrypt and verify the authentication token;

[0073] The authentication module is further configured to perform the operation of performing authentication based on the authentication token and obtaining an authentication result if the decryption and signature verification process is successful;

[0074] The information sending module is used to send a prompt message of the failure of decryption and / or signature verification to the authorization server if the decryption and / or signature verification fails.

[0075] Another aspect of the present disclosure provides an authorization system, comprising: the authorization server as described above, and the authentication server as described above.

[0076] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0077] Another aspect of the present disclosure provides a computer program, which includes computer executable instructions, and the instructions are used to implement the method described above when executed.

[0078] According to the embodiment of the present disclosure, after receiving the authorization request, the resource client is not directly granted the authority, but in response to the received authorization request, an authentication token is generated, the authentication token includes the user information, the user information in the authentication token is cached in a preset storage space, and an authentication request is sent to the authentication server, the authentication request carries the authentication token, so that the authentication server performs authentication based on the authentication token, obtains the authentication result, returns the authentication result to the authorization server, and deletes the user information from the preset storage space. The user information is effectively checked for security by the authentication server, and the user information cached in the preset storage space is deleted to prevent the authentication request from being replayed. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0080] Figure 1 An exemplary system architecture to which the authorization method can be applied according to an embodiment of the present disclosure is schematically shown;

[0081] Figure 2 The flowchart of the authorization method according to the embodiment of the present disclosure is schematically shown;

[0082] Figure 3 The flowchart of the authorization method according to the embodiment of the present disclosure is schematically shown;

[0083] Figure 4 The flowchart of the authorization method according to the embodiment of the present disclosure is schematically shown;

[0084] Figure 5 The flowchart of operation S401 in the authorization method according to the embodiment of the present disclosure is schematically shown;

[0085] Figure 6The flowchart of operation S401 in the authorization method according to the embodiment of the present disclosure is schematically shown;

[0086] Figure 7 A block diagram of an authorization server according to an embodiment of the present disclosure is schematically shown;

[0087] Figure 8 A block diagram of an authentication server according to an embodiment of the present disclosure is schematically shown;

[0088] Fig. 9 The block diagram of a computer system according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0089] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0090] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "include", "comprising", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0091] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0092] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0093] It should be noted that the authorization method, authorization server, authentication server, authorization system, computer system, and storage medium disclosed herein can be used for Internet applications in the financial field, and can also be used in any field other than the financial field. The application field of the authorization method, authorization server, authentication server, authorization system, computer system, and storage medium disclosed herein is not limited.

[0094] In the technical solution disclosed in the present invention, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and do not violate public order and good morals.

[0095] The embodiment of the present disclosure provides an authorization method. The method includes an authorization server generating an authentication token in response to a received authorization request, the authentication token including the user information, and the user information in the authentication token being cached in a preset storage space; the authorization server sending an authentication request to an authentication server, the authentication request carrying the authentication token; the authentication server performing authentication based on the authentication token to obtain an authentication result; the authentication server returning the authentication result to the authorization server, and the authentication server deleting the user information from the preset storage space.

[0096] Figure 1 The exemplary system architecture 100 to which the authorization method can be applied according to an embodiment of the present disclosure is schematically shown. It should be noted that: Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0097] like Figure 1 As shown, the system architecture 100 according to this embodiment may include a terminal device 101, a network 102, an authorization server 103, and an authentication server 104. The network 102 is used to provide a medium for a communication link between the terminal device 101, the authorization server 103, and the authentication server 104. The network 102 may include various connection types, such as wired and / or wireless communication links, etc.

[0098] The user can use the terminal device 101 to interact with the authorization server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as financial applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients and / or social platform software, etc. (only for example).

[0099] The terminal device 101 can be any electronic device with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, etc. The terminal device 101 can be loaded with a resource client and a login client. The resource client and the login client can be provided by the same service provider, or by different service providers but the different service providers comply with the Oauth2.0 protocol. The user can log in through the login client using the login information of the resource client. For example, the user opens the login client and chooses to log in through the resource client. The login client wakes up the resource client. The user enters the corresponding login information in the resource client for authentication. After the authentication is passed, the user can log in to the login client.

[0100] The authorization server 103 may be used to authenticate the received user's login information and return the authentication result to the resource client of the terminal device 101. In the present disclosure, the authorization server 103 may also be used to send an authentication request to the authentication server 104 after the user's login information is authenticated, and after the authentication is passed, the user is allowed to log in to the login client in the terminal device 101.

[0101] The authentication server 104 may be used to perform authentication after receiving the authentication request, and return the authentication result to the authorization server 103. Specifically, if the authentication is successful, the user is allowed to log in to the login client in the terminal device 101.

[0102] It should be noted that the authorization method provided in the embodiment of the present disclosure can generally be executed by the authorization server 103 and the authentication server 104. It can also be executed by other servers having the corresponding functions executed by the authorization server 103 and the authentication server 104 in the present disclosure. In addition, the authorization server 103 and the authentication server 104 are also considered as a server, or a server cluster.

[0103] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0104] Figure 2 The flowchart of the authorization method according to the embodiment of the present disclosure is schematically shown.

[0105] like Figure 2 As shown, the method includes operations S201 to S203, which are applied to the authorization server.

[0106] In operation S201, in response to a received authorization request, an authentication token is generated, the authentication token includes the user information, and the user information in the authentication token is cached in a preset storage space.

[0107] In operation S202, an authentication request is sent to an authentication server, the authentication request carries the authentication token, so that the authentication server performs authentication based on the authentication token, obtains an authentication result, returns the authentication result to the authorization server, and deletes the user information from the preset storage space.

[0108] In the present disclosure, user information corresponds to the authorization request. For example, after a user enters login information in a resource client, the resource client requests authorization from an authorization server. The user information obtained by the authorization server from a preset storage space is the user information corresponding to the login information. The login information may include a user name and password, a mobile phone number and a verification code, etc.

[0109] In the present disclosure, the preset storage space may be located in an authorization server, an authentication server, or a database, and the present disclosure does not limit this. The user information may be stored in the preset storage space in the form of a table or a key-value pair, and the present disclosure does not limit this.

[0110] In the present disclosure, the user information can be deleted from the preset storage space after the authentication token is generated, or after the authentication request is sent to the authentication server, or during the authentication process of the authentication server, or from the preset storage space, and the present disclosure does not limit this. Furthermore, the user information can be deleted from the preset storage space by the authorization server, the authentication server, or any other server or terminal, and the present disclosure does not limit this.

[0111] In one embodiment of the present disclosure, the authentication token further includes first timestamp information, and the first timestamp information indicates the generation time or sending time of the authentication token. Then, authentication is performed based on the authentication token, and the authentication result obtained can be specifically: parsing the authentication token, obtaining the first timestamp information, obtaining the current timestamp, calculating the difference between the current timestamp and the first timestamp, and judging whether the difference meets the preset condition. If the difference does not meet the preset condition, the authentication result is authentication failure, and if the difference meets the preset condition, the authentication result is authentication pass.

[0112] In an embodiment of the present disclosure, the authorization request carries the identifier of the sender of the authorization request, and the authentication token also includes the identifier of the sender. Then, authentication is performed based on the authentication token, and the authentication result obtained can be specifically: searching for the identifier of the sender in a preset identifier library, and the identifier library stores all legal identifiers of senders. If the identifier of the sender is not found, the authentication result is that the authentication fails, and if the identifier of the sender is found, the authentication result is that the authentication passes.

[0113] In one embodiment of the present disclosure, before sending the authentication request to the authentication server, the method further includes:

[0114] The authentication token is encrypted and signed. In the present disclosure, the encryption and signing can be performed in an existing manner, and the present disclosure does not limit this.

[0115] According to the embodiment of the present disclosure, after receiving the authorization request, the resource client is not directly granted the authority, but in response to the received authorization request, an authentication token is generated, the authentication token includes the user information, the user information in the authentication token is cached in a preset storage space, and an authentication request is sent to the authentication server, the authentication request carries the authentication token, so that the authentication server performs authentication based on the authentication token, obtains the authentication result, returns the authentication result to the authorization server, and deletes the user information from the preset storage space. The user information is effectively checked for security by the authentication server, and the user information cached in the preset storage space is deleted to prevent the authentication request from being replayed.

[0116] Figure 3 The flowchart of the authorization method according to the embodiment of the present disclosure is schematically shown.

[0117] like Figure 3 As shown, the method includes operations S301 to S303, which are applied to the authorization server.

[0118] In operation S301, login information input by a user is obtained.

[0119] In operation S302, it is verified whether the login information is correct.

[0120] In operation S303, if the login information is correct, authorization confirmation prompt information is returned to the resource client.

[0121] In operation S304, authorization confirmation information returned by the authorization client based on the authorization confirmation prompt information is received.

[0122] In operation S201, in response to a received authorization request, an authentication token is generated, the authentication token includes the user information, and the user information in the authentication token is cached in a preset storage space.

[0123] In operation S202, an authentication request is sent to an authentication server, the authentication request carries the authentication token, so that the authentication server performs authentication based on the authentication token, obtains an authentication result, returns the authentication result to the authorization server, and deletes the user information from the preset storage space.

[0124] In one embodiment of the present disclosure, when the authentication result is authentication passed, the authorization server receives the user information returned by the authentication server; the authorization server sends the user information to the login client that calls the resource client for login, so as to successfully log in the login client.

[0125] In the present disclosure, the login information input by the user can be a user name and password, a mobile phone number and a verification code, etc., and the present disclosure does not limit this. The login information input by the user corresponds to the user information, and both are globally unique.

[0126] In the present disclosure, if the login information is incorrect, a prompt message indicating that the authentication failed is directly returned to the resource client. Specifically, when the authentication failure is due to an incorrect password input, the user can be prompted that the password input is incorrect. When the authentication failure is due to the non-existence of the username, the user can be prompted that the username does not exist.

[0127] Figure 4 The flowchart of the authorization method according to the embodiment of the present disclosure is schematically shown.

[0128] like Figure 4 As shown, the method includes operations S301 to S303, which are applied to an authentication server.

[0129] In operation S401, in response to a received authentication request carrying an authentication token, authentication is performed based on the authentication token to obtain an authentication result, the authentication token is generated by an authorization server, the authentication token includes the user information, and the user information in the authentication token is cached in a preset storage space;

[0130] In operation S402, the authentication result is returned to the authorization server;

[0131] In operation S403, the user information is deleted from the preset storage space.

[0132] According to the embodiment of the present disclosure, the authentication server effectively performs security check on user information and deletes the user information cached in the preset storage space to prevent the authentication request from being replayed.

[0133] In one embodiment of the present disclosure, the authentication token further includes first timestamp information, and the first timestamp information indicates the generation time or sending time of the authentication token, such as Figure 5As shown, operation S401 includes operations S501~S506: in operation S501, the authentication token is parsed to obtain the first timestamp information; in operation S502, the current timestamp is obtained; in operation S503, the difference between the current timestamp and the first timestamp is calculated; in operation S504, it is determined whether the difference meets the preset condition; in operation S505, if the difference does not meet the preset condition, the authentication result is authentication failure; in operation S506, if the difference meets the preset condition, the authentication result is authentication pass.

[0134] In the present disclosure, whether the difference satisfies the preset condition may be whether the difference is less than a preset threshold, or whether the difference is within a preset range, and the preset threshold may be 1 minute, 2 minutes, 5 minutes, etc. The preset range may be within 30 seconds, within 1 minute, etc., and the present disclosure does not limit this.

[0135] In one embodiment of the present disclosure, the authorization request carries the identifier of the sender of the authorization request, and the authentication token also includes the identifier of the sender, such as Figure 6 As shown, operation S401 includes operations S601~S603: in operation S601, the sender's identifier is searched in a preset identifier library, and the identifier library stores all legitimate sender identifiers; in operation S602, if the sender's identifier is not found, the authentication result is authentication failure; in operation S603, if the sender's identifier is found, the authentication result is authentication passed.

[0136] In the present disclosure, it is also possible to simultaneously use Figure 5 and Figure 6 The method shown in the figure determines whether the authentication result is passed. Specifically, if Figure 5 The method shown and Figure 6 If any of the authentication results in the manner shown is an authentication failure, the authentication result of operation S401 is an authentication failure. Figure 5 The method shown and Figure 6 The authentication results of the methods shown are all successful authentication, and the authentication result of operation S401 is successful authentication.

[0137] In one embodiment of the present disclosure, when the authentication result is authentication passed, operation S402 includes: sending the user information to the authorization server, so that the authorization server sends the user information to the login client that calls the resource client for login, so as to successfully log in the login client.

[0138] In one embodiment of the present disclosure, before operation S402, the authentication token needs to be decrypted and verified; if the decryption and signature verification are successful, the authentication based on the authentication token is executed to obtain the authentication result; if the decryption and / or signature verification fails, a prompt message indicating the failure of the decryption and / or signature verification is sent to the authorization server.

[0139] Figure 7 A block diagram of an authorization server according to an embodiment of the present disclosure is schematically shown.

[0140] like Figure 7 As shown, the authorization server 700 includes an authentication token generation module 710 and a request sending module 720 .

[0141] The authentication token generation module 710 is used to generate an authentication token in response to the received authorization request, where the authentication token includes the user information, and the user information in the authentication token is cached in a preset storage space.

[0142] The request sending module 720 is used to send an authentication request to the authentication server, where the authentication request carries the authentication token, so that the authentication server performs authentication based on the authentication token, obtains an authentication result, returns the authentication result to the authorization server, and deletes the user information from the preset storage space.

[0143] The authentication token also includes first timestamp information, where the first timestamp information indicates a generation time or a sending time of the authentication token.

[0144] In one embodiment of the present disclosure, the authorization request carries an identifier of a sender of the authorization request, and the authentication token also includes the identifier of the sender.

[0145] In one embodiment of the present disclosure, it also includes:

[0146] A login information acquisition module is used to obtain the login information input by the user;

[0147] A login information verification module is used to verify whether the login information is correct;

[0148] The confirmation information return module is used to return the authorization confirmation prompt information to the resource client if the login information is correct;

[0149] The confirmation information receiving module is used to receive the authorization confirmation information returned by the authorization client based on the authorization confirmation prompt information, and execute the operation of obtaining the user information from the preset storage space in response to the received authorization request.

[0150] In one embodiment of the present disclosure, it also includes:

[0151] A user information receiving module, used for receiving the user information returned by the authentication server when the authentication result is authentication passed;

[0152] The user information sending module is used to send the user information to the login client that calls the resource client for login, so as to successfully log in to the login client.

[0153] In one embodiment of the present disclosure, it also includes: a processing module, which is used to encrypt and sign the authentication token.

[0154] Figure 8 A block diagram of an authentication server according to an embodiment of the present disclosure is schematically shown.

[0155] like Figure 8 As shown, the authentication server 800 includes an authentication module 810 , an authentication result returning module 820 and a user information deleting module 830 .

[0156] An authentication module 810 is used to respond to a received authentication request carrying an authentication token, perform authentication based on the authentication token, and obtain an authentication result, wherein the authentication token is generated by an authorization server and includes the user information, and the user information in the authentication token is cached in a preset storage space;

[0157] An authentication result returning module 820 is used to return the authentication result to the authorization server;

[0158] The user information deleting module 830 is used to delete the user information from the preset storage space.

[0159] In one embodiment of the present disclosure, the authentication token further includes first timestamp information, and the first timestamp information indicates the generation time or sending time of the authentication token. The authentication module 810 includes:

[0160] A parsing submodule, used for parsing the authentication token to obtain first timestamp information;

[0161] Timestamp acquisition submodule, used to obtain the current timestamp;

[0162] A calculation submodule, used for calculating the difference between the current timestamp and the first timestamp;

[0163] A judgment submodule is used to judge whether the difference meets a preset condition;

[0164] A first determination submodule, configured to determine that if the difference does not satisfy the preset condition, the authentication result is an authentication failure;

[0165] The second determination submodule is used to determine that if the difference satisfies the preset condition, the authentication result is authentication passed.

[0166] In one embodiment of the present disclosure, the authorization request carries the identifier of the sender of the authorization request, the authentication token also includes the identifier of the sender, and the authentication module 810 includes:

[0167] A search submodule is used to search for the sender's identifier in a preset identifier library, which stores all valid sender identifiers;

[0168] The first determination submodule is further configured to determine that if the sender's identifier is not found, the authentication result is authentication failure;

[0169] The second determination submodule is further configured to determine that if the sender's identifier is found, the authentication result is authentication passed.

[0170] In one embodiment of the present disclosure, when the authentication result is authentication passed, the authentication result returning module specifically sends the user information to the authorization server, so that the authorization server sends the user information to the login client that calls the resource client for login, so as to successfully log in to the login client.

[0171] In one embodiment of the present disclosure, it also includes:

[0172] A decryption processing module is used to decrypt and verify the authentication token;

[0173] The authentication module is further configured to perform the operation of performing authentication based on the authentication token and obtaining an authentication result if the decryption and signature verification process is successful;

[0174] The information sending module is used to send a prompt message of the failure of the decryption and / or signature verification process to the authorization server if the decryption and / or signature verification process fails.

[0175] The embodiment of the present disclosure also provides an authorization system, including the above-mentioned authorization server and authentication server.

[0176] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging circuits, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0177] For example, any multiple of the authentication token generation module 710 and the request sending module 720 can be combined in one module / unit / sub-unit for implementation, or any one of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of these modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the authentication token generation module 710 and the request sending module 720 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the authentication token generation module 710 and the request sending module 720 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0178] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0179] Fig. 9 A block diagram of a computer system suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. Fig. 9The computer system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0180] like Fig. 9 As shown, the computer system 900 according to the embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 902 or the program loaded from the storage part 908 to the random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an on-board memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0181] In RAM 903, various programs and data required for the operation of system 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other through bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0182] According to an embodiment of the present disclosure, the system 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The system 900 may further include one or more of the following components connected to the I / O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage section 908 as needed.

[0183] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0184] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0185] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0186] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 902 and / or the RAM 903 described above and / or one or more memories other than the ROM 902 and the RAM 903 .

[0187] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0188] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0189] The embodiments of the present disclosure are described above. However, these embodiments are only for the purpose of illustration and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An authorization method, applied to an authorization server, comprising: Get the login information entered by the user; Verify that the login information is correct; If the login information is correct, an authorization confirmation prompt message is returned to the resource client; Receiving authorization confirmation information returned by the authorization client based on the authorization confirmation prompt information; In response to the received authorization request, generating an authentication token, the authentication token including user information, the user information in the authentication token being cached in a preset storage space; Sending an authentication request to an authentication server, wherein the authentication request carries the authentication token, so that the authentication server performs authentication based on the authentication token, obtains an authentication result, returns the authentication result to the authorization server, and deletes the user information from the preset storage space; When the authentication result is that the authentication is passed, receiving the user information returned by the authentication server; The user information is sent to the login client that calls the resource client for login, so as to successfully log in the login client. 2 . The method according to claim 1 , wherein the authentication token further comprises first timestamp information, wherein the first timestamp information indicates a generation time or a sending time of the authentication token.

3. According to the method of claim 1, the authorization request carries the identifier of the sender of the authorization request, and the authentication token also includes the identifier of the sender.

4. The method according to any one of claims 1 to 3, before sending the authentication request to the authentication server, comprising: The authentication token is encrypted and signed.

5. An authorization method, applied to an authentication server, comprising: In response to a received authentication request carrying an authentication token, performing authentication based on the authentication token to obtain an authentication result, wherein the authentication token is generated by an authorization server, the authentication token includes user information, and the user information in the authentication token is cached in a preset storage space; Returning the authentication result to the authorization server; Deleting the user information from the preset storage space; When the authentication result is that the authentication is passed, returning the authentication result to the authorization server includes: The user information is sent to the authorization server, so that the authorization server sends the user information to the login client that calls the resource client for login, so as to successfully log in the login client.

6. The method according to claim 5, wherein the authentication token further comprises first timestamp information, wherein the first timestamp information indicates a generation time or a sending time of the authentication token, and the performing authentication based on the authentication token to obtain an authentication result comprises: Parsing the authentication token to obtain first timestamp information; Get the current timestamp; Calculating a difference between the current timestamp and the first timestamp; Determining whether the difference satisfies a preset condition; If the difference does not meet the preset condition, the authentication result is authentication failure; If the difference satisfies the preset condition, the authentication result is authentication passed.

7. The method according to claim 5, wherein the authentication token further includes an identifier of the sender, and the authentication based on the authentication token to obtain an authentication result comprises: Searching for the sender's identifier in a preset identifier library, wherein the identifier library stores all valid sender identifiers; If the sender's identifier is not found, the authentication result is authentication failure; If the sender's identifier is found, the authentication result is authentication passed.

8. The method according to any one of claims 5 to 7, wherein before performing authentication based on the authentication token and obtaining the authentication result, the method comprises: Decrypting and verifying the authentication token; If the decryption and signature verification process is successful, then the operation of performing authentication based on the authentication token to obtain an authentication result is performed; If the decryption and / or signature verification process fails, a prompt message indicating the decryption and / or signature verification process failure is sent to the authorization server.

9. An authorization server, comprising: A login information acquisition module is used to obtain the login information input by the user; A login information verification module, used to verify whether the login information is correct; A confirmation information return module is used to return authorization confirmation prompt information to the resource client if the login information is correct; A confirmation information receiving module, used to receive the authorization confirmation information returned by the authorization client based on the authorization confirmation prompt information, and execute an operation of obtaining user information from a preset storage space in response to the received authorization request; An authentication token generation module, configured to generate an authentication token in response to a received authorization request, wherein the authentication token includes the user information, and the user information in the authentication token is cached in a preset storage space; A request sending module, configured to send an authentication request to an authentication server, wherein the authentication request carries the authentication token, so that the authentication server performs authentication based on the authentication token, obtains an authentication result, returns the authentication result to the authorization server, and deletes the user information from the preset storage space; A user information receiving module, used for receiving the user information returned by the authentication server when the authentication result is authentication passed; The user information sending module is used to send the user information to the login client that calls the resource client for login, so as to successfully log in to the login client.

10. The authorization server according to claim 9, wherein the authentication token further comprises first timestamp information, and the first timestamp information indicates a generation time or a sending time of the authentication token.

11. The authorization server according to claim 9, wherein the authorization request carries an identifier of a sender of the authorization request, and the authentication token further comprises the identifier of the sender.

12. The authorization server according to any one of claims 9 to 11, further comprising: A processing module is used to encrypt and sign the authentication token.

13. An authentication server, comprising: An authentication module, configured to respond to a received authentication request carrying an authentication token, perform authentication based on the authentication token, and obtain an authentication result, wherein the authentication token is generated by an authorization server, the authentication token includes user information, and the user information in the authentication token is cached in a preset storage space; An authentication result returning module is used to return the authentication result to the authorization server. When the authentication result is authentication passed, the authentication result returning module specifically sends the user information to the authorization server, so that the authorization server sends the user information to the login client that calls the resource client for login, so as to successfully log in the login client; The user information deleting module is used to delete the user information from the preset storage space.

14. The authentication server according to claim 13, wherein the authentication token further comprises first timestamp information, wherein the first timestamp information indicates a generation time or a sending time of the authentication token, and the authentication module comprises: A parsing submodule, used to parse the authentication token to obtain the first timestamp information ； Timestamp acquisition submodule, used to obtain the current timestamp; A calculation submodule, configured to calculate a difference between the current timestamp and the first timestamp; A judging submodule, used to judge whether the difference satisfies a preset condition; A first determination submodule, configured to determine that if the difference does not satisfy the preset condition, the authentication result is an authentication failure; The second determination submodule is used to determine that the authentication result is authentication passed if the difference satisfies the preset condition.

15. The authentication server according to claim 13, wherein the authentication token further comprises an identifier of the sender, and the authentication module comprises: A search submodule, used for searching the identifier of the sender in a preset identifier library, wherein the identifier library stores all the identifiers of the legitimate senders; The first determination submodule is further configured to determine that if the identifier of the sender is not found, the authentication result is authentication failure; The second determination submodule is further configured to determine that if the identifier of the sender is found, the authentication result is authentication passed.

16. The authentication server according to any one of claims 13 to 15, further comprising: A decryption processing module, used to decrypt and verify the authentication token; The authentication module is further configured to perform the operation of performing authentication based on the authentication token and obtaining an authentication result if the decryption and signature verification process is successful; The information sending module is used to send a prompt message of the failure of decryption and / or signature verification to the authorization server if the decryption and / or signature verification fails.

17. An authorization system comprising: An authorization server as claimed in any one of claims 9 to 12, and an authentication server as claimed in any one of claims 13 to 16.

18. A computer system comprising: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method of any one of claims 1 to 4, or implement the method of any one of claims 5 to 8.

19. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the method of any one of claims 1 to 4, or the method of any one of claims 5 to 8.

Images