Methods, apparatus, devices and computer-readable media for interface authentication

Abstract

The present invention discloses a method, device, equipment and computer-readable medium for interface authentication, and relates to the field of computer technology. A specific implementation of the method includes: in a remote procedure call framework, a client that needs to call an interface sends a call request for calling a service interface to a server, the call request includes a client token, and the client token is assigned to the client by an authentication server; the server obtains the authorized client token of the interface from the authentication server according to a configuration identifier; the server authenticates the call request based on the client token in the call request and the authorized client token, and feeds back the authentication result to the client. This implementation can distinguish different access terminals, thereby ensuring the security of the service.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and computer-readable medium for interface authentication. Background Art

[0002] Many services of a product, such as membership service, coupon service, order service, personal information management service, etc., are all in one application. If any service is changed, the entire application needs to be redeployed.

[0003] Microservices are the process of splitting these different services into independent applications. Each independent application can evolve independently, and the updates and deployments will not affect each other. Moreover, the applications are reusable and can provide services to more clients.

[0004] In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art: in microservices, clients can call services based on call requests, but different clients cannot be distinguished, resulting in any client being able to call the service, making it difficult to ensure the security of the service. Summary of the invention

[0005] In view of this, the embodiments of the present invention provide a method, apparatus, device and computer-readable medium for interface authentication, which can distinguish different access terminals and thus ensure the security of services.

[0006] To achieve the above object, according to one aspect of an embodiment of the present invention, a method for interface authentication is provided, comprising:

[0007] In the remote procedure call framework, a client that needs to call an interface sends a call request to the server to call the service interface, and the call request includes a client token, which is assigned to the client by the authentication server;

[0008] The server obtains the authorized client token of the interface from the authentication server according to the configuration identifier;

[0009] The server authenticates the call request based on the client token in the call request and the authorized client token, and feeds back the authentication result to the client.

[0010] The server obtains the authorized client token of the interface from the authentication server according to the configuration identifier, including:

[0011] The service end obtains the authorized client token of the interface from the authentication server through the authentication server filter based on the configuration identifier and the service token.

[0012] The authentication server filter is one of a plurality of filters that are executed sequentially.

[0013] The step of obtaining an authorized client token of the interface from the authentication server comprises:

[0014] Obtain an authorized client token for a predefined method of the interface from the authentication server.

[0015] The service token is obtained by the service provider of the interface after registering on the authentication server.

[0016] The method further comprises:

[0017] The service provider of the interface registers the interface service on the authentication server and obtains the configuration identifier;

[0018] The client applies to the service provider for calling the interface through the authentication server;

[0019] After the service provider authorizes the client to call the interface, the authentication server allocates the client token to the client.

[0020] According to a second aspect of an embodiment of the present invention, there is provided a device for interface authentication, including:

[0021] A sending module, used for sending a call request for calling a service interface to a server in a remote procedure call framework, wherein the call request includes a client token, and the client token is allocated to the client by an authentication server;

[0022] An acquisition module, used to control the server to acquire the authorized client token of the interface from the authentication server according to the configuration identifier;

[0023] The authentication module is used to control the server to authenticate the call request according to the client token in the call request and the authorized client token, and feed back the authentication result to the client.

[0024] According to a third aspect of an embodiment of the present invention, a method for interface authentication is provided, including:

[0025] Receive an authentication request sent by a server of an interface authentication, wherein the authentication request includes a configuration identifier and a service token;

[0026] If the interface authentication server is determined to have passed the authentication based on the service token, the authorized client token of the interface corresponding to the configuration identifier is fed back to the interface authentication server.

[0027] The receiving the authentication request sent by the interface authentication server includes:

[0028] The authentication request sent by the interface authentication server is received through the authentication server filter.

[0029] The method further comprises:

[0030] receiving a registration of a service provider of an interface, and sending the configuration identifier to the service provider of the interface;

[0031] A service application from a service provider of an interface is received, and the service token is sent to the service provider of the interface.

[0032] The method further comprises:

[0033] Receive service requests from clients that need to call the interface, and send approval messages to the service provider of the interface;

[0034] Receive the approval message sent by the service provider of the interface, and feedback the client token of the interface corresponding to the configuration identifier to the client that needs to call the interface, where the client token belongs to the authorized client token.

[0035] According to a fourth aspect of an embodiment of the present invention, there is provided an interface authentication device, comprising:

[0036] A receiving module, used to receive an authentication request sent by the interface authentication server, wherein the authentication request includes a configuration identifier and a service token;

[0037] The authentication module is used to determine that the interface authentication server has passed the authentication based on the service token, and then feedback the authorized customer token of the interface corresponding to the configuration identifier to the interface authentication server.

[0038] According to a fifth aspect of an embodiment of the present invention, an electronic device for interface authentication is provided, including:

[0039] one or more processors;

[0040] a storage device for storing one or more programs,

[0041] When the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0042] According to a sixth aspect of an embodiment of the present invention, there is provided a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, the method as described above is implemented.

[0043] One embodiment of the above invention has the following advantages or beneficial effects: in the remote procedure call framework, a client that needs to call an interface sends a call request for calling a service interface to a server, and the call request includes a client token, which is assigned to the client by an authentication server; the server obtains the authorized client token of the interface from the authentication server according to the configuration identifier; the server authenticates the call request based on the client token and the authorized client token in the call request, and feeds back the authentication result to the client. Since different access terminals can be distinguished based on the client token, the security of the service is guaranteed.

[0044] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0046] Figure 1 is a schematic diagram of the main process of the method for interface authentication according to an embodiment of the present invention;

[0047] Figure 2 is a schematic diagram of a remote procedure call framework according to an embodiment of the present invention;

[0048] Figure 3 is an interaction diagram of an authentication server according to an embodiment of the present invention;

[0049] Figure 4 is a schematic diagram of a process of registering on an authentication server according to an embodiment of the present invention;

[0050] Figure 5 is a schematic diagram of a process of obtaining an authorized client token of an interface according to an embodiment of the present invention;

[0051] Figure 6 is a schematic diagram of a flow chart of an authentication call request according to an embodiment of the present invention;

[0052] Figure 7 is a schematic diagram of another process of authentication call request according to an embodiment of the present invention;

[0053] Figure 8 is a schematic diagram of the flow of interaction between a server and an authentication server according to an embodiment of the present invention;

[0054] Fig. 9 is a schematic diagram of the main structure of an interface authentication device according to an embodiment of the present invention;

[0055] Fig.10 is a schematic diagram of the main process of a method for interface authentication according to another embodiment of the present invention;

[0056] Fig.11 is a schematic diagram of the main structure of an interface authentication device according to another embodiment of the present invention;

[0057] Fig.12 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0058] Fig.13 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0060] At present, most of the external authentication of microservice systems is done through the Hypertext Transfer Protocol (HTTP), which includes OAuth, SAML, and OpenID Connect. Some of the above authentication methods are relatively mature, such as OAuth, and there are also more complex ones such as SAML.

[0061] But in general, these are all authentications of internal systems for external calls. The external here includes browsers or application programming interfaces (APIs). However, there are currently few general authentication methods for microservice internal interfaces based on remote procedure calls (RPCs).

[0062] RPC is a remote procedure call, which is a protocol for requesting services from a remote computer program over a network without having to understand the underlying network technology. RPC makes it easier to develop applications including network distributed multi-programs.

[0063] For example, some small and medium-sized enterprises assume that their internal systems are secure, and there is no need for mutual authentication between departments. However, for large enterprises with multiple organizations, there are many business lines, and authentication is also required between internal departments for the sake of system stability, security, monitoring, and statistics.

[0064] For the authentication requirements in the above scenarios, the current solutions mainly include the following methods:

[0065] Method 1: No verification and no authentication.

[0066] The framework used, whether it is the more popular dubbo on the market or the service call framework developed by each company itself, is by default inside a secure network, because there is a secure boundary in the outer layer, and the services within the boundary are trustworthy to each other, so no verification is required.

[0067] For method one:

[0068] By default, no verification is performed within the security boundary. The main disadvantages are as follows.

[0069] First of all, for those outside the border, if an attacker breaks into the internal network, it means that all interfaces are exposed to the attacker, allowing him to do anything, which is a huge security risk.

[0070] Secondly, for some important interfaces within the boundary, such as those involving finance and password modification, the scope of access or the source of access needs to be controlled. Obviously, the above important interfaces cannot be opened to all internal applications.

[0071] In addition, in some scenarios, it is also necessary to count the access sources, as well as the number and frequency of accesses from different sources, all of which require differentiation and authentication of the RPC client.

[0072] Method 2: Set a token.

[0073] A common token is agreed upon between the RPC server and client. If a new client wants to call this service, it must ask the server for the token and then carry the token as an implicit parameter when calling the service.

[0074] After receiving the call request, the RPC framework checks the implicit parameters carried by the client, extracts the token, and compares it with the token of the calling service. If they are the same token, the service will be called; otherwise, the service will be rejected and the relevant information will be returned to the client.

[0075] For method 2:

[0076] The RPC client and server use the same token. Although this method can achieve preliminary authentication and authorization, so that an outside intruder cannot call internal services after entering the internal network, the big disadvantage is that it cannot distinguish different clients. Moreover, since the token cannot be dynamically allocated one-to-one to different clients, it may be abused, and it is impossible to distinguish statistics by client source.

[0077] Method 3: API key.

[0078] There are many ways to implement API keys, and how to use them depends on the specific technical solutions used by the system. Not only can they identify the service caller, but they can also impose various restrictions on them, including access to specific resources, interface speed limits, etc. Many systems use a shared API key model, and use a hashed message authentication code (HMAC) for verification. Some systems also use a public key and private key pair.

[0079] For method three:

[0080] While ensuring secure calls, the complexity of dynamically allocating and managing keys or certificates comes with it. Especially in distributed scenarios, the client itself is a cluster and needs to call multiple services at the same time, which requires a complex management mechanism. The same is true for server management, and RPC may be frequently called. This frequent encryption and decryption process with large computational load also drags down the internal service performance, so this solution is not suitable for calls within the RPC framework.

[0081] In microservices, clients can call services based on call requests. However, for internal calls of the RPC framework, the encryption and decryption process results in a large amount of computation, thus affecting the internal service performance.

[0082] To sum up, without affecting the internal service performance, there is a technical problem that the clients cannot be distinguished, resulting in any access end being able to call the service, making it difficult to ensure the security of the service.

[0083] In order to solve the technical problem of being unable to distinguish different clients, the following technical solution in the embodiment of the present invention may be adopted.

[0084] See also Figure 1 , Figure 1 Schematic diagram of the main process of the method for interface authentication according to an embodiment of the present invention, wherein the server obtains the authorized client token and then can authenticate the call request. Figure 1 As shown, the specific steps include:

[0085] S101. In a remote procedure call framework, a client that needs to call an interface sends a call request for calling a service interface to a server. The call request includes a client token, which is allocated to the client by an authentication server.

[0086] The RPC framework is an architecture that uses RPC-related protocols. Figure 2 , Figure 2 is a schematic diagram of a remote procedure call framework according to an embodiment of the present invention, Figure 2 There are three servers in the system, namely server A, server B and server C.

[0087] An application is deployed on server A, and server B and server C provide services that can be used by the application.

[0088] The application deployed on server A needs to call the service used by the application on server B or server C. Since they are not in the same memory space, they cannot call directly. Therefore, the semantics of the call and the data of the call need to be expressed through the network. That is, the application in server A calls the service used by the application on server B or server C through RPC.

[0089] In the embodiment of the present invention, interface authentication involves the following aspects: the client that calls the interface, the service provider of the interface, the service end and the authentication server.

[0090] It can be understood that the server is a device that provides various services in the application to the client.

[0091] The specific process of registering a service and allocating a token is exemplarily described below. It can be understood that the server obtains a service token, and the client that calls the interface is allocated a client token.

[0092] See also Figure 3 , Figure 3 1 is a schematic diagram of interaction with an authentication server according to an embodiment of the present invention, specifically including:

[0093] S301. Registration service.

[0094] In one embodiment of the present invention, the service provider of the interface registers the service. Specifically, the service provider of the interface registers its own service on the authentication server.

[0095] It is understandable that an interface can provide one or more services. That is, when the interface provides one service, the client calling the interface can call one service through the interface; when the interface provides multiple services, the client calling the interface can call multiple services through the interface.

[0096] S302: Feedback configuration identification.

[0097] The authentication server is used to verify whether the server has the right to obtain the authorized client token and whether the client has the right to call the interface.

[0098] In the embodiment of the present invention, both the service provider of the interface and the client that needs to call the interface need to register with the authentication server.

[0099] After the service provider of the interface sends a request to register the service, the authentication server applies for a configuration identifier for the interface, or applies for a configuration identifier for the service corresponding to the interface.

[0100] S303: Apply for a service token.

[0101] The service provider of the interface sends a request for a service token to the authentication server.

[0102] S304: Feedback service token.

[0103] The authentication server generates a service token, which is used as the basis for the server to access the authentication server. The configuration identifier and the service token can be provided to the server by the service provider of the interface, so that the server can provide the service of calling the interface to the client that calls the interface.

[0104] The above S301 to S304 are the specific process of the service provider of the interface registering with the authentication server and obtaining the configuration identifier and service token.

[0105] S305: Apply for a client token.

[0106] Before calling the interface, the server needs to register with the authentication server to obtain a client token. The client that calls the interface applies for service calling permissions through the authentication server.

[0107] S306, pending application.

[0108] The authentication server sends a pending approval message to the service provider of the interface, and the service provider of the interface determines whether to allow the above client to call the interface.

[0109] S307, approved.

[0110] If the service provider of the interface allows the client that calls the interface to call the interface, the feedback approval is passed; if the service provider of the interface does not allow the client that calls the interface to call the interface, the feedback approval is not passed.

[0111] S308: Feedback the customer token.

[0112] If the application is approved, the authentication server will allocate a client token to the client, which makes it easier for the client to call the above interface.

[0113] S305 to S308 are the specific processes of the client that calls the interface registering with the authentication server and obtaining the client token.

[0114] It is understandable that the registration steps of the above-mentioned server and the client that calls the interface can be summarized as follows.

[0115] See also Figure 4 , Figure 4 1 is a schematic diagram of a process of registering on an authentication server according to an embodiment of the present invention, specifically including:

[0116] S401. The service provider of the interface registers the interface service with the authentication server and obtains a configuration identifier.

[0117] In the embodiment of the present invention, the configuration identifier is a parameter used to distinguish different RPC services accessing the authentication server. When the service provider of the interface accesses the authentication server, the configuration identifier is used to obtain various configuration data under the service.

[0118] S402: The client applies for calling an interface through the authentication server.

[0119] The client applies for the call of the interface by sending a request for a client token to the authentication server.

[0120] S403: After the service provider of the interface authorizes the client to call the interface, the authentication server allocates a client token to the client.

[0121] After obtaining authorization from the service provider of the interface, the authentication server allocates a client token to the client.

[0122] It is understandable that the client has a client token and the service provider of the interface has a service token. The above tokens are two different tokens. The client accesses the interface through the client token; the server uses the service token as the basis for accessing the authentication system.

[0123] It is understandable that the service token is obtained by the service provider of the interface after registering on the authentication server.

[0124] After both the service provider and the client of the interface are registered with the authentication server, the client can initiate interface authentication to call the interface.

[0125] It is understandable that the technical solution in the embodiment of the present invention is applicable to Figure 2 The RPC framework in . The client that needs RPC sends a call request to the server to call the service interface.

[0126] In one embodiment of the present invention, when a remote procedure is called, the client is activated in the filter call chain to obtain the allocated client token from the authentication server.

[0127] The filter call chain is a filter chain formed by multiple filters, which can process a request in turn, pass it to the next filter, and finally distribute it to the control layer for business processing.

[0128] After obtaining the client token from the authentication server, you can send a call request to the server to call the service interface. After authentication, you can call the service interface. The call request includes the client token. It can be understood that the client token is assigned to the client by the authentication server.

[0129] According to S305 to S308, the authentication server allocates a client token to each client that needs to call the interface. Since the clients are different, the client tokens of the clients are also different. That is, there is a one-to-one correspondence between the client and the client token, and the client can be known based on the client token.

[0130] S102: The server obtains the authorized client token of the interface from the authentication server according to the configuration identifier.

[0131] In the embodiment of the present invention, before the RPC call of the server, the filter call chain is called. In addition to the standard universal filter, the filter call chain adds an authentication server filter. The authentication server filter is essentially a client of the authentication server.

[0132] In an embodiment of the present invention, the authentication server filter is one of a plurality of filters executed sequentially.

[0133] See also Figure 5 , Figure 5 The following is a flow chart of obtaining an authorized client token of an interface according to an embodiment of the present invention, which specifically includes:

[0134] S501: The server starts the authentication server filter in the filter call chain.

[0135] The filter call chain includes multiple filters. After the server receives the call request and obtains the client token in the call request, it starts the authentication server filter in the filter call chain.

[0136] S502: The authentication server filter in the filter call chain obtains the authorized client token of the interface from the authentication server based on the configuration identifier and the server token.

[0137] The authentication server filter connects the server and the authentication server and is the glue of the two systems. The authentication server filter is equivalent to a client for the authentication server. When the filter call chain reaches this node, the authentication server filter carries the configuration identifier and the server token of the server, and uses a specific network protocol to obtain the authorized client token of the interface from the authentication server. Exemplarily, the authorized client token includes a collection of client tokens of the client list that has been authorized by the interface.

[0138] The authentication server stores the authorized client token of the interface. The authorized client token is the client token that has applied for the interface or method and has been approved.

[0139] Among them, the server token of the server is pre-assigned to the server by the authentication server.

[0140] In one embodiment of the present invention, an authorized client token of a predefined method of an interface is obtained from an authentication server. There are many methods in an interface, and the authorized client token of the predefined method can be sent to the server. The predefined method can be one method or multiple methods.

[0141] S103: The server authenticates the call request based on the client token in the call request and the authorized client token, and feeds back the authentication result to the client.

[0142] The server can authenticate the call request based on the client token and the authorized client token in the call request.

[0143] See also Figure 6 , Figure 6 1 is a schematic diagram of a flow chart of an authentication call request according to an embodiment of the present invention, which specifically includes:

[0144] S601. The server determines that the client token in the call request is an authorized client token, and the call request authentication is successful.

[0145] Based on the client token in the call request and the authorized client token, the server determines that the client token in the call request is an authorized client token, and the call request authentication is successful.

[0146] S602: Feedback success of authentication to the client.

[0147] If the call request is authenticated successfully, the authentication success is fed back to the client, and the service is called to continue processing the next node in the filter call chain.

[0148] In the RPC framework, the client receives the feedback results and performs subsequent processing based on the filter call chain.

[0149] exist Figure 6 In the embodiment, the server authenticates based on the client token and the authorized client token, and feeds back the authentication result, thereby determining that the service can be called.

[0150] See also Figure 7 , Figure 7 FIG. 1 is a flowchart of another authentication call request according to an embodiment of the present invention, which specifically includes:

[0151] S701. The server determines that the client token in the call request is not an authorized client token, and the call request authentication fails.

[0152] Based on the client token in the call request and the authorized client token, the server determines that the client token in the call request is not an authorized client token, and the call request authentication fails.

[0153] S702: Feedback a service denial response to the client.

[0154] If the authentication request fails, a denial of service response is fed back to the client.

[0155] exist Figure 7 In the embodiment, the server performs authentication based on the client token and the authorized client token, and feeds back an authentication failure, thereby determining that the service cannot be called.

[0156] In the above embodiment, in the remote procedure call framework, the client that needs to call the interface sends a call request for calling the service interface to the server, and the call request includes a client token, which is assigned to the client by the authentication server; the server obtains the authorized client token of the interface from the authentication server according to the configuration identifier; the server authenticates the call request based on the client token and the authorized client token in the call request, and feeds back the authentication result to the client. Since different access terminals can be distinguished based on the client token, the security of the service is guaranteed.

[0157] See also Figure 8 , Figure 8 The figure is a schematic diagram of the process of interaction between the server and the authentication server according to an embodiment of the present invention, which specifically includes:

[0158] S801. Obtain an authorized client token according to the configuration identifier.

[0159] The server obtains the authorized client token from the authentication server based on the configuration identifier.

[0160] S802: Feedback the authorized customer token.

[0161] The authentication server returns the authorized client token to the server.

[0162] S803: Determine whether the client token is an authorized client token.

[0163] If the server determines that the client token is an authorized client token, the authentication is successful; if the server determines that the client token is not an authorized client token, the authentication fails.

[0164] S804: Feedback the authentication result.

[0165] The server feeds back the authentication result to the client.

[0166] In an embodiment of the present invention, the client is cleverly integrated into the filter call chain of the RPC server. At each RPC service call, the client is activated in the call chain to obtain the client token and configuration identifier from the server of the authentication server, thereby authenticating the client.

[0167] See also Fig. 9 , Fig. 9Schematic diagram of the main structure of the interface authentication device according to an embodiment of the present invention, the interface authentication device can implement the interface authentication method, such as Fig. 9 As shown, the interface authentication device specifically includes:

[0168] The sending module 901 is used for the client that needs to call the interface to send a call request for calling the service interface to the server in the remote procedure call framework. The call request includes a client token, which is allocated to the client by the authentication server.

[0169] The acquisition module 902 is used to control the server to obtain the authorized client token of the interface from the authentication server according to the configuration identifier.

[0170] The authentication module 903 is used to control the server to authenticate the call request according to the client token and the authorized client token in the call request, and feed back the authentication result to the client.

[0171] In one embodiment of the present invention, the acquisition module 902 is specifically used to control the server to obtain the authorized client token of the interface from the authentication server based on the configuration identifier and the service token through the authentication server filter.

[0172] In one embodiment of the present invention, the authentication server filter is one of a plurality of filters that are executed sequentially.

[0173] In one embodiment of the present invention, the acquisition module 902 is specifically configured to acquire an authorized client token of a predefined method of an interface from an authentication server.

[0174] In one embodiment of the present invention, the service token is obtained after the service provider of the interface registers on the authentication server.

[0175] In one embodiment of the present invention, the authentication module 903 is specifically used to control the service provider of the interface to register the interface service on the authentication server and obtain the configuration identifier;

[0176] Control the client to apply for the call of the interface from the service provider of the interface through the authentication server;

[0177] After the service provider of the interface authorizes the client to call the interface, the receiving authentication server allocates a client token to the client.

[0178] See also Fig.10 , Fig.10 is a schematic diagram of the main process of the interface authentication method according to another embodiment of the present invention, Fig.10 The execution subject of the technical solution is the authentication server, which specifically includes:

[0179] S1001. Receive an authentication request sent by a server for interface authentication, where the authentication request includes a configuration identifier and a service token.

[0180] In one embodiment of the present invention, the service provider of the interface needs to register with the authentication server to obtain a configuration identifier and a service token.

[0181] Specifically, the authentication server receives the registration of the service provider of the interface, and sends a configuration identifier to the service provider of the interface.

[0182] The authentication server receives the service application from the service provider of the interface and sends a service token to the service provider of the interface.

[0183] In one embodiment of the present invention, a client that needs to call an interface needs to register in an authentication server to obtain a service token.

[0184] The authentication server receives the service application from the client that needs to call the interface, and sends an approval message to the service provider of the interface;

[0185] The authentication server receives the approval message sent by the service provider of the interface, and sends a feedback configuration identifier of the client corresponding to the interface to the client that needs to call the interface. The client token is an authorized client token.

[0186] The authentication server receives the authentication request sent by the interface authentication server. The purpose of the server sending the authentication request is to obtain the authorized client token of the interface corresponding to the configuration identifier, so as to authenticate the call request sent by the client that needs to call the interface. The authentication request includes the configuration identifier and the service token.

[0187] In one embodiment of the present invention, an authentication request sent by a service end of an interface authentication is received through an authentication server filter.

[0188] The authentication server filter is one of multiple filters executed in sequence. In addition to the standard general filters, the filter call chain also adds an authentication server filter. The authentication server filter is essentially a client of the authentication server.

[0189] S1002. If the interface authentication server determines that it has passed the authentication based on the service token, the authorized client token of the interface corresponding to the configuration identifier is fed back to the interface authentication server.

[0190] The authentication server can determine whether the interface authentication server can pass the authentication based on the service token. As an example, the authentication server searches for the received service token in the stored authorized service tokens, and then determines that the interface authentication server has passed the authentication.

[0191] If the interface authentication server passes the authentication, the authentication server will feedback the authorized client token of the interface corresponding to the configuration identifier to the interface authentication server.

[0192] exist Fig.10 In the embodiment, an authentication request sent by the service end is received, and an authorized client token of the interface is fed back. Since different access ends can be distinguished based on the client token, the security of the service is guaranteed.

[0193] See also Fig.11 , Fig.11 is a schematic diagram of the main structure of an interface authentication device according to another embodiment of the present invention;

[0194] The receiving module 1101 is used to receive an authentication request sent by the interface authentication server, where the authentication request includes a configuration identifier and a service token.

[0195] The authentication module 1102 is used to determine that the interface authentication server has passed the authentication based on the service token, and then feedback the authorized customer token of the interface corresponding to the configuration identifier to the interface authentication server.

[0196] In one embodiment of the present invention, the receiving module 1101 is specifically configured to receive an authentication request sent by a server of an interface authentication through an authentication server filter.

[0197] In one embodiment of the present invention, the authentication module 1102 is further used to receive a registration of a service provider of the interface and send a configuration identifier to the service provider of the interface;

[0198] Receive the service application from the service provider of the interface and send a service token to the service provider of the interface.

[0199] In one embodiment of the present invention, the authentication module 1102 is further used to receive a service application from a client that needs to call an interface, and send an approval message to the service provider of the interface;

[0200] The approval message sent by the service provider of the receiving interface is sent to the client that needs to call the interface. The feedback configuration identifier corresponds to the client token of the interface. The client token is an authorized client token.

[0201] Fig.12 An exemplary system architecture 1200 is shown to which the method for interface authentication or the apparatus for interface authentication according to the embodiments of the present invention may be applied.

[0202] like Fig.12As shown, the system architecture 1200 may include terminal devices 1201, 1202, 1203, a network 1204, and a server 1205. The network 1204 is used to provide a medium for communication links between the terminal devices 1201, 1202, 1203 and the server 1205. The network 1204 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0203] Users can use terminal devices 1201, 1202, 1203 to interact with server 1205 through network 1204 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 1201, 1202, 1203, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social server software, etc. (only as examples).

[0204] The terminal devices 1201 , 1202 , and 1203 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0205] The server 1205 may be a server that provides various services, such as a backend management server (only an example) that provides support for shopping websites browsed by users using the terminal devices 1201, 1202, and 1203. The backend management server may analyze and process the received data such as product information query requests, and feed back the processing results (such as target push information, product information - only an example) to the terminal device.

[0206] It should be noted that the interface authentication method provided in the embodiment of the present invention is generally executed by the server 1205 , and accordingly, the interface authentication device is generally set in the server 1205 .

[0207] It should be understood that Fig.12 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0208] Reference below Fig.13 , which shows a schematic diagram of the structure of a computer system 1300 of a terminal device suitable for implementing an embodiment of the present invention. Fig.13 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0209] like Fig.13As shown, the computer system 1300 includes a central processing unit (CPU) 1301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1302 or a program loaded from a storage part 1308 into a random access memory (RAM) 1303. In the RAM 1303, various programs and data required for the operation of the system 1300 are also stored. The CPU 1301, the ROM 1302, and the RAM 1303 are connected to each other via a bus 1304. An input / output (I / O) interface 1305 is also connected to the bus 1304.

[0210] The following components are connected to the I / O interface 1305: an input section 1306 including a keyboard, a mouse, etc.; an output section 1307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1308 including a hard disk, etc.; and a communication section 1309 including a network interface card such as a LAN card, a modem, etc. The communication section 1309 performs communication processing via a network such as the Internet. A drive 1310 is also connected to the I / O interface 1305 as needed. A removable medium 1313, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1310 as needed, so that a computer program read therefrom is installed into the storage section 1308 as needed.

[0211] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1309, and / or installed from the removable medium 1313. When the computer program is executed by the central processing unit (CPU) 1301, the above-mentioned functions defined in the system of the present invention are executed.

[0212] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0213] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0214] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be provided in a processor. For example, they may be described as follows: a processor includes a sending unit, an acquisition unit, a determination unit, and a first processing unit. The names of these units do not, in some cases, constitute limitations on the units themselves. For example, the sending unit may also be described as a "unit that sends a request for obtaining an image to a connected server."

[0215] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes:

[0216] In the remote procedure call framework, a client that needs to call an interface sends a call request to the server to call the service interface, and the call request includes a client token, which is assigned to the client by the authentication server;

[0217] The server obtains the authorized client token of the interface from the authentication server according to the configuration identifier;

[0218] The server authenticates the call request based on the client token in the call request and the authorized client token, and feeds back the authentication result to the client.

[0219] According to the technical solution of the embodiment of the present invention, in the remote procedure call framework, the client that needs to call the interface sends a call request for calling the service interface to the server, and the call request includes a client token, which is assigned to the client by the authentication server; the server obtains the authorized client token of the interface from the authentication server according to the configuration identifier; the server authenticates the call request based on the client token and the authorized client token in the call request, and feeds back the authentication result to the client. Since different access terminals can be distinguished based on the client token, the security of the service is guaranteed.

[0220] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for interface authentication, characterized in that: include: In the remote procedure call framework, a client that needs to call an interface sends a call request to the server to call the service interface, and the call request includes a client token, which is assigned to the client by the authentication server; The server obtains the authorized client token of the interface from the authentication server according to the configuration identifier; The server authenticates the call request based on the client token in the call request and the authorized client token, and feeds back the authentication result to the client; The server obtains the authorized client token of the interface from the authentication server according to the configuration identifier, including: The service end obtains the authorized client token of the interface from the authentication server through the authentication server filter based on the configuration identifier and the service token.

2. The method for interface authentication according to claim 1, characterized in that: The authentication server filter is one of a plurality of filters that are executed sequentially.

3. The method for interface authentication according to claim 1, characterized in that: The step of obtaining an authorized client token of the interface from the authentication server comprises: Obtain an authorized client token for a predefined method of the interface from the authentication server.

4. The method for interface authentication according to claim 1, characterized in that: The service token is obtained by the service provider of the interface after registering on the authentication server.

5. The method for interface authentication according to claim 1, characterized in that: The method further comprises: The service provider of the interface registers the interface service on the authentication server and obtains the configuration identifier; The client applies to the service provider for calling the interface through the authentication server; After the service provider authorizes the client to call the interface, the authentication server allocates the client token to the client.

6. An interface authentication device, characterized in that: include: A sending module, used for sending a call request for calling a service interface to a server in a remote procedure call framework, wherein the call request includes a client token, and the client token is allocated to the client by an authentication server; An acquisition module, used to control the server to acquire the authorized client token of the interface from the authentication server according to the configuration identifier; Specifically, the server obtains the authorized client token of the interface from the authentication server through the authentication server filter based on the configuration identifier and the service token; The authentication module is used to control the server to authenticate the call request according to the client token in the call request and the authorized client token, and feed back the authentication result to the client.

7. A method for interface authentication, characterized in that: include: Receive an authentication request sent by a server of an interface authentication, wherein the authentication request includes a configuration identifier and a service token; If the interface authentication server is determined to have passed the authentication according to the service token, the authorized client token of the interface corresponding to the configuration identifier is fed back to the interface authentication server; The receiving the authentication request sent by the interface authentication server includes: The authentication request sent by the interface authentication server is received through the authentication server filter.

8. The method for interface authentication according to claim 7, characterized in that: The method further comprises: receiving a registration of a service provider of an interface, and sending the configuration identifier to the service provider of the interface; A service application from a service provider of an interface is received, and the service token is sent to the service provider of the interface.

9. The method for interface authentication according to claim 7, characterized in that: The method further comprises: Receive service requests from clients that need to call the interface, and send approval messages to the service provider of the interface; Receive the approval message sent by the service provider of the interface, and feedback the client token of the interface corresponding to the configuration identifier to the client that needs to call the interface, where the client token belongs to the authorized client token.

10. An interface authentication device, characterized in that: include: A receiving module, used to receive an authentication request sent by the interface authentication server, wherein the authentication request includes a configuration identifier and a service token; Specifically, receiving the authentication request sent by the interface authentication server through the authentication server filter; The authentication module is used to determine that the interface authentication server has passed the authentication based on the service token, and then feedback the authorized customer token of the interface corresponding to the configuration identifier to the interface authentication server.

11. An electronic device for interface authentication, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in any one of claims 1 to 5 and 7 to 9.

12. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 and 7 to 9 is implemented.

Images