A token generation method, system and device

Abstract

The present invention discloses a token generation method, system and device, which constructs a key of the SM4 algorithm based on the current project name of the system and the user name of the token to be issued, so as to encrypt the data to be encrypted based on the SM4 algorithm and its key to obtain the first data; the first data is combined according to the preset data combination strategy to obtain the second data; the first characteristic value of the second data is calculated by the SM3 algorithm, and the second data and its first characteristic value are combined to obtain the third data; the third data is encoded according to the preset encoding algorithm to obtain the encoded data, and the encoded data is issued to the corresponding user as a token. It can be seen that the present application constructs a key of the preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, that is, the key is bound to the user and project in the system, which reduces the scope of influence of key leakage and improves security; moreover, the national secret SM4 algorithm and SM3 algorithm have high security.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing management platforms, and in particular to a token generation method, system and device. Background Art

[0002] In the openstack (an open source cloud computing management platform project) system, tokens are used as user authentication identifiers. When a user logs in to the openstack system for the first time, they need to register a username and password to log in. At this time, the openstack system will generate a token for the user. In the future, the user only needs to bring this token to request data from the openstack system without bringing a username and password.

[0003] At present, the method for generating tokens in the openstack system is: encrypt the data to be encrypted according to the AES (Advanced Encryption Standard)-CBC (Cipher Block Chaining) algorithm, sign it with the SHA256 (Secure Hash Algorithm)-HMAC (Hash-based Message Authentication Code) algorithm, and send the obtained ciphertext to the user as a token (the purpose of encryption is to prevent the outside world from knowing the token issuance rules). However, the token keys corresponding to different users or the same user in different system projects are the same. The problem brought about by this is that once the key is leaked, the tokens of all users will be cracked, which is very risky.

[0004] Therefore, how to provide a solution to the above technical problems is a problem that technicians in this field need to solve at present. Summary of the invention

[0005] The purpose of the present invention is to provide a token generation method, system and device, which construct a key of a preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, that is, to bind the key to the user and project in the system, thereby reducing the impact scope of key leakage and improving security; moreover, compared with the international general algorithms AES-CBC algorithm and SHA256-HMAC algorithm, the national secret SM4 algorithm and SM3 algorithm are more secure.

[0006] In order to solve the above technical problems, the present invention provides a token generation method, comprising:

[0007] Constructing a key of a preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, so as to encrypt the data to be encrypted based on the SM4 algorithm and its key to obtain first data;

[0008] Combining the first data according to a preset data combination strategy to obtain second data;

[0009] Calculate the first eigenvalue of the second data using a preset SM3 algorithm, and combine the second data and its first eigenvalue to obtain third data;

[0010] The third data is encoded according to a preset encoding algorithm to obtain encoded data, and the encoded data is sent to the corresponding user as a token.

[0011] Optionally, before encrypting the data to be encrypted based on the SM4 algorithm and its key, the token generation method further includes:

[0012] The number of bytes pre-filled after the data to be encrypted is determined according to a preset filling relational formula n-(x%n); wherein x is the number of original bytes of the data to be encrypted; n is the preset number of basic filling bytes; and % is a modulo operation;

[0013] Bytes are filled after the data to be encrypted according to the number of bytes, so as to encrypt the data to be encrypted with the filled bytes based on the SM4 algorithm and its key.

[0014] Optionally, encrypting the data to be encrypted based on the SM4 algorithm and its key to obtain the first data includes:

[0015] Get the current first timestamp of the system and construct a random vector of preset length;

[0016] The data to be encrypted, the first timestamp, the random vector and the key are taken together as input parameters of the SM4 algorithm, and the input parameters are encrypted using the SM4 algorithm to obtain the first data.

[0017] Optionally, combining the first data according to a preset data combination strategy to obtain second data includes:

[0018] The first data, the first timestamp and the random vector are combined to obtain second data.

[0019] Optionally, the token generation method further includes:

[0020] After receiving a user request with the token, obtaining a second timestamp of the system, and decoding the token using a decoding algorithm corresponding to the encoding algorithm to obtain a first timestamp decoding value, a first data decoding value, a random vector decoding value, and a first eigenvalue decoding value;

[0021] Determining whether the first timestamp decoded value is valid according to the second timestamp and a preset timestamp validity period;

[0022] If valid, combining the first data decoded value, the first timestamp decoded value and the random vector decoded value to obtain second combined data, and using the SM3 algorithm to calculate a second eigenvalue of the second combined data, and determining whether the second eigenvalue is the same as the first eigenvalue decoded value;

[0023] If they are the same, the first data decoding value, the first timestamp decoding value, the random vector decoding value and the key are used together as input parameters of the SM4 algorithm, so as to use the SM4 algorithm to decrypt the input parameters to obtain the data to be encrypted, and remove the bytes filled after the data to be encrypted according to the number of bytes to obtain the original data to be encrypted, so as to return the requested data to the corresponding user based on the user request if the original data to be encrypted has not been tampered with.

[0024] Optionally, encoding the third data according to a preset encoding algorithm to obtain encoded data includes:

[0025] Divide every three bytes of the third data into a group to obtain a plurality of first groups including 24 bits;

[0026] Divide each of the first group of bits into 4 groups evenly, to obtain a plurality of second groups including 6 bits;

[0027] Add two 0s in front of each of the second groups to expand each of the first groups into a first group containing 32 bits;

[0028] Each of the first groups after expansion is replaced with a base64 code according to a base64 table, and all the base64 codes obtained by replacement are combined to obtain the encoded data.

[0029] Optionally, a key of a preset SM4 algorithm is constructed based on the current project name of the system and the user name of the token to be issued, including:

[0030] Calculate the first summary information of the UUID of the user name by using the SM3 algorithm, and divide the first summary information into 4 parts on average, and take the first character of each part to obtain 4 first characters;

[0031] Calculate the second summary information of the ID of the project name using the SM3 algorithm, and divide the second summary information into 4 parts on average, and take the first character of each part to obtain 4 second characters;

[0032] Converting the first character and the second character into bits, and combining the converted bits to obtain bit data;

[0033] The bit data is randomly filled to the key length of the SM4 algorithm, and the filled bit data is used as the key of the SM4 algorithm.

[0034] Optionally, in the bit data, the bit position of the first character conversion is arranged before the bit position of the second character conversion;

[0035] Randomly padding the bit data to the key length of the SM4 algorithm includes:

[0036] 32 bits of data are randomly filled between the first character conversion bit and the second character conversion bit, and 32 bits of data are randomly filled after the second character conversion bit to obtain bit data with a length equal to the key length.

[0037] In order to solve the above technical problems, the present invention also provides a token generation system, comprising:

[0038] An encryption module, used to construct a key of a preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, so as to encrypt the data to be encrypted based on the SM4 algorithm and its key to obtain first data;

[0039] A first combining module, used for combining the first data according to a preset data combining strategy to obtain second data;

[0040] A second combining module, used for calculating the first eigenvalue of the second data by using a preset SM3 algorithm, and combining the second data and its first eigenvalue to obtain third data;

[0041] The encoding module is used to encode the third data according to a preset encoding algorithm to obtain encoded data, and send the encoded data as a token to the corresponding user.

[0042] In order to solve the above technical problems, the present invention also provides a token generation device, comprising:

[0043] Memory for storing computer programs;

[0044] A processor is used to implement the steps of any of the above token generation methods when executing the computer program.

[0045] The present invention provides a token generation method, which constructs a preset SM4 algorithm key based on the current project name of the system and the user name of the token to be issued, so as to encrypt the data to be encrypted based on the SM4 algorithm and its key to obtain the first data; the first data is combined according to the preset data combination strategy to obtain the second data; the first characteristic value of the second data is calculated by the preset SM3 algorithm, and the second data and its first characteristic value are combined to obtain the third data; the third data is encoded according to the preset encoding algorithm to obtain the encoded data, and the encoded data is issued to the corresponding user as a token. It can be seen that the present application constructs a preset SM4 algorithm key based on the current project name of the system and the user name of the token to be issued, that is, the key is bound to the user and project in the system, which reduces the scope of influence of key leakage and improves security; moreover, compared with the international general algorithms AES-CBC algorithm and SHA256-HMAC algorithm, the national secret SM4 algorithm and SM3 algorithm have higher security.

[0046] The present invention also provides a token generation system and device, which have the same beneficial effects as the above-mentioned token generation method. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the prior art and the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 A flowchart of a token generation method provided by an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of the structure of a token generation system provided by an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of the structure of a token generation device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The core of the present invention is to provide a token generation method, system and device, which constructs a key of a preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, that is, binds the key to the user and project in the system, reduces the impact of key leakage and improves security; moreover, compared with the international general algorithms AES-CBC algorithm and SHA256-HMAC algorithm, the national secret SM4 algorithm and SM3 algorithm are more secure.

[0052] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] Please refer to Figure 1 , Figure 1 A flowchart of a token generation method provided by an embodiment of the present invention.

[0054] The token generation method includes:

[0055] Step S1: construct a key of a preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, so as to encrypt the data to be encrypted based on the SM4 algorithm and its key to obtain first data.

[0056] Specifically, this application constructs a preset SM4 algorithm (a domestic cryptographic algorithm) key based on the current project name of the system and the user name of the token to be issued, that is, binds the key to the users and projects in the system, reduces the impact of key leakage, and improves security.

[0057] After constructing the key of the SM4 algorithm, the present application can encrypt the data to be encrypted based on the SM4 algorithm and the constructed key of the SM4 algorithm to obtain the first data.

[0058] Step S2: Combining the first data according to a preset data combination strategy to obtain second data.

[0059] Specifically, the present application sets a data combination strategy in advance to guide the first data to be combined. Based on this, after obtaining the first data, the present application combines the first data according to the preset data combination strategy to obtain the second data.

[0060] Step S3: Calculate the first eigenvalue of the second data using a preset SM3 algorithm, and combine the second data and its first eigenvalue to obtain third data.

[0061] Specifically, after obtaining the second data, the present application uses a preset SM3 algorithm (a domestic cryptographic algorithm) to calculate the eigenvalue of the second data (called the first eigenvalue), and then combines the second data and the first eigenvalue of the second data to obtain the third data.

[0062] Step S4: Encode the third data according to a preset encoding algorithm to obtain encoded data, and send the encoded data as a token to the corresponding user.

[0063] Specifically, after obtaining the third data, the present application encodes the third data according to a preset encoding algorithm to obtain encoded data, and then sends the encoded data as a token to the corresponding user for the user to use in subsequent requests for system data.

[0064] It can be seen that this application constructs a preset SM4 algorithm key based on the system's current project name and the user name of the token to be issued, that is, binds the key to the user and project in the system, reduces the impact of key leakage, and improves security; moreover, compared with the international general algorithms AES-CBC algorithm and SHA256-HMAC algorithm, the national secret SM4 algorithm and SM3 algorithm are more secure.

[0065] Based on the above embodiments:

[0066] As an optional embodiment, before encrypting the data to be encrypted based on the SM4 algorithm and its key, the token generation method further includes:

[0067] The number of bytes pre-filled after the data to be encrypted is determined according to a preset filling relationship formula n-(x%n); wherein x is the number of original bytes of the data to be encrypted; n is the preset number of basic filling bytes; and % is a modulo operation;

[0068] Bytes are filled after the data to be encrypted according to the number of bytes, so as to encrypt the data to be encrypted with the filled bytes based on the SM4 algorithm and its key.

[0069] Furthermore, the SM4 algorithm is a block cipher algorithm with a block length of 128 bits (128 bits = 16 bytes), so the number of bytes of the data to be encrypted pre-encrypted by the SM4 algorithm must be an integer multiple of 16 bytes. Therefore, before encrypting the data to be encrypted based on the SM4 algorithm and its key, the present application also determines the number of bytes to be pre-filled after the data to be encrypted according to the preset filling relationship n-(x%n), and then fills bytes after the data to be encrypted according to the determined number of filled bytes (PKCS7 filling method can be used) to encrypt the data to be encrypted with filled bytes based on the SM4 algorithm and its key; wherein, x is the original number of bytes of the data to be encrypted; n is the preset number of basic filling bytes. Since the number of bytes of the data to be encrypted must be an integer multiple of 16 bytes, n is 16; % is a modulo operation, that is, the remainder of the division of two numbers.

[0070] It should be noted that when the original byte number x of the data to be encrypted is an integer multiple of the preset basic padding byte number n, n bytes still need to be padded after the data to be encrypted. This is because if n bytes are not padded more, after decryption, if the last byte of the decrypted data happens to be the same byte as the padding byte, it is impossible to determine whether the last byte is padded or actual data. Therefore, regardless of whether x is an integer multiple of n, padding is performed, which can obviously be processed in a unified manner.

[0071] As an optional embodiment, encrypting the data to be encrypted based on the SM4 algorithm and its key to obtain the first data includes:

[0072] Get the current first timestamp of the system and construct a random vector of preset length;

[0073] The data to be encrypted, the first timestamp, the random vector and the key are taken together as input parameters of the SM4 algorithm, and the input parameters are encrypted using the SM4 algorithm to obtain the first data.

[0074] Specifically, the encryption process of the data to be encrypted in the present application includes: 1) obtaining the current first timestamp of the system and constructing a random vector of a preset length (such as 16 bits); 2) using the data to be encrypted with padding bytes, the first timestamp, the random vector and the constructed key of the SM4 algorithm as input parameters of the SM4 algorithm, and using the SM4 algorithm CBC (Cipher BlockChaining) mode to encrypt the input parameters to obtain the first data.

[0075] As an optional embodiment, combining the first data according to a preset data combination strategy to obtain the second data includes:

[0076] The first data, the first timestamp and the random vector are combined to obtain second data.

[0077] Specifically, the data combination strategy of the present application is: combining the encrypted first data, the first timestamp and the constructed random vector to obtain the second data.

[0078] As an optional embodiment, the token generation method further includes:

[0079] After receiving a user request with a token, obtain the current second timestamp of the system, and decode the token using a decoding algorithm corresponding to the encoding algorithm to obtain a first timestamp decoding value, a first data decoding value, a random vector decoding value, and a first eigenvalue decoding value;

[0080] Determining whether the first timestamp decoded value is valid according to the second timestamp and the preset timestamp validity time;

[0081] If valid, the first data decoded value, the first timestamp decoded value and the random vector decoded value are combined to obtain second combined data, and the second eigenvalue of the second combined data is calculated using the SM3 algorithm, and it is determined whether the second eigenvalue is the same as the first eigenvalue decoded value;

[0082] If they are the same, the first data decoding value, the first timestamp decoding value, the random vector decoding value and the key are used together as input parameters of the SM4 algorithm, and the SM4 algorithm is used to decrypt the input parameters to obtain the data to be encrypted, and the bytes padded after the data to be encrypted are removed according to the number of bytes to obtain the original data to be encrypted, so as to return the requested data to the corresponding user based on the user request if the original data to be encrypted has not been tampered with.

[0083] Furthermore, after receiving a user request with the above-mentioned token, the present application obtains the current second timestamp of the system, and decodes the token using a decoding algorithm corresponding to the encoding algorithm to obtain a first timestamp decoding value, a first data decoding value, a random vector decoding value and a first eigenvalue decoding value, and then determines whether the first timestamp decoding value is valid based on the second timestamp and the preset timestamp validity time; if the time obtained by subtracting the first timestamp decoding value from the second timestamp exceeds the preset timestamp validity time, it means that the first timestamp decoding value is invalid, and the user request is not processed; if the time obtained by subtracting the first timestamp decoding value from the second timestamp does not exceed the preset timestamp validity time, it means that the first timestamp decoding value is valid, and then the first data decoding value, the first timestamp decoding value and the random vector decoding value are combined to obtain second combined data, and the second eigenvalue of the second combined data is calculated using the SM3 algorithm, and it is determined whether the second eigenvalue is the same as the first eigenvalue decoding value; if not, If they are the same, the user request will not be processed; if they are the same, the first data decoding value, the first timestamp decoding value, the random vector decoding value and the constructed key of the SM4 algorithm (if there is a key of the SM4 algorithm constructed when the above-mentioned token was generated before, it can be used directly; if there is no key of the SM4 algorithm constructed when the above-mentioned token was generated before, the key of the SM4 algorithm can be reconstructed based on the current project name and user name of the system. Since the project name, user name and construction principle are the same, the key of the reconstructed SM4 algorithm is the same as the key of the SM4 algorithm constructed when the above-mentioned token was generated before) are used as input parameters of the SM4 algorithm, so as to use the SM4 algorithm to decrypt the input parameters to obtain the data to be encrypted, and remove the bytes filled after the data to be encrypted according to the number of bytes filled after the data to be encrypted to obtain the original data to be encrypted, so as to return the requested data to the corresponding user based on the user request if the original data to be encrypted has not been tampered with.

[0084] As an optional embodiment, encoding the third data according to a preset encoding algorithm to obtain encoded data includes:

[0085] Divide every three bytes of the third data into a group to obtain a plurality of first groups including 24 bits;

[0086] Divide each of the first group of bits into 4 groups evenly, to obtain a plurality of second groups containing 6 bits;

[0087] Add two zeros in front of each second group to expand each first group to a first group containing 32 bits;

[0088] According to the base64 table, each first group after expansion is replaced with base64 encoding, and all the replaced base64 encodings are combined to obtain the encoded data.

[0089] Specifically, the encoding algorithm of the present application is: 1) divide every three bytes (24 bits) of the third data into a group to obtain multiple first groups containing 24 bits; 2) divide the bits of each first group into 4 groups evenly to obtain multiple second groups containing 6 bits; 3) add two 0s in front of each second group, then add a total of 8 0s to the first group containing 4 groups of second groups, then each first group is expanded to a first group containing 32 bits; 4) according to the table of base64 (an algorithm for encoding arbitrary byte data based on 64 printable ASCII (American Standard Code for Information Interchange) characters), replace each expanded first group with base64 code, and combine all the replaced base64 codes to obtain the encoded data corresponding to the third data.

[0090] It should be noted that if the total number of bytes of the third data cannot be divided by three, there will be one or two extra bytes. The processing method is to replace one or two bytes with an "=" sign and add them to the end of the above base64 encoding.

[0091] As an optional embodiment, a key of a preset SM4 algorithm is constructed based on the current project name of the system and the user name of the token to be issued, including:

[0092] Calculate the first summary information of the UUID of the user name using the SM3 algorithm, and divide the first summary information into 4 parts on average, and take the first character of each part to obtain 4 first characters;

[0093] Calculate the second summary information of the project name ID using the SM3 algorithm, and divide the second summary information into 4 parts equally, and take the first character of each part to obtain 4 second characters;

[0094] Converting the first character and the second character into bits, and combining the converted bits to obtain bit data;

[0095] The bit data is randomly padded to the key length of the SM4 algorithm, and the padded bit data is used as the key of the SM4 algorithm.

[0096] Specifically, the process of constructing the key of the SM4 algorithm in the present application includes: 1) using the SM3 algorithm to calculate the first summary information (SM3 summary) of the UUID (Universally Unique Identifier) ​​of the user name, and dividing the first summary information into 4 parts on average, and taking the first character of each part to obtain 4 first characters; 2) using the SM3 algorithm to calculate the second summary information of the ID (Identity document, unique code, UUID and ID are randomly generated) of the project name, and dividing the second summary information into 4 parts on average, and taking the first character of each part to obtain 4 second characters; 3) converting the 4 first characters (corresponding to 32 bits) and the 4 second characters (corresponding to 32 bits) into bits, and combining the converted bits of the two to obtain bit data; 4) randomly filling the combined bit data to the key length of the SM4 algorithm (128 bits, 16 characters), and using the filled bit data as the key of the SM4 algorithm.

[0097] As an optional embodiment, in the bit data, the bit position of the first character conversion is arranged before the bit position of the second character conversion;

[0098] Randomly pad the bit data to the key length of the SM4 algorithm, including:

[0099] 32 bits of data are randomly filled between the bit position of the first character conversion and the bit position of the second character conversion, and 32 bits of data are randomly filled after the bit position of the second character conversion to obtain bit data with a length equal to the key length.

[0100] Specifically, in the bit data obtained by combining the bits converted from the first character and the second character, the bits converted from the first character are arranged before the bits converted from the second character, i.e., 32 bits (user) 32 bits (project). Based on this, the present application randomly fills 32 bits of data between the bits converted from the first character and the bits converted from the second character, and randomly fills 32 bits of data after the bits converted from the second character, to obtain bit data with a length equal to the key length, i.e., 32 bits (user) X 32 bits (project) X, where X is the randomly filled 32 bits of data. Since the user UUID and project ID themselves use strong random characters, information extraction is performed, and 64 bits of pure random bits are supplemented, security is further enhanced.

[0101] Please refer to Figure 2 , Figure 2 A schematic diagram of the structure of a token generation system provided by an embodiment of the present invention.

[0102] The token generation system includes:

[0103] The encryption module 1 is used to construct a key of a preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, so as to encrypt the data to be encrypted based on the SM4 algorithm and its key to obtain the first data;

[0104] A first combining module 2, used for combining the first data according to a preset data combining strategy to obtain second data;

[0105] A second combining module 3, used to calculate the first eigenvalue of the second data using a preset SM3 algorithm, and combine the second data and its first eigenvalue to obtain third data;

[0106] The encoding module 4 is used to encode the third data according to a preset encoding algorithm to obtain encoded data, and send the encoded data as a token to the corresponding user.

[0107] For an introduction to the token generation system provided in this application, please refer to the above-mentioned embodiment of the token generation method, and this application will not go into details here.

[0108] Please refer to Figure 3 , Figure 3 A schematic diagram of the structure of a token generation device provided in an embodiment of the present invention.

[0109] The token generating device comprises:

[0110] Memory 5, used for storing computer programs;

[0111] The processor 6 is used to implement the steps of any one of the above token generation methods when executing a computer program.

[0112] For an introduction to the token generation device provided in this application, please refer to the above-mentioned embodiment of the token generation method, and this application will not go into details here.

[0113] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0114] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A token generation method, characterized in that: include: Constructing a key of a preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, so as to encrypt the data to be encrypted based on the SM4 algorithm and its key to obtain first data; Combining the first data according to a preset data combination strategy to obtain second data; Calculate the first eigenvalue of the second data using a preset SM3 algorithm, and combine the second data and its first eigenvalue to obtain third data; Encode the third data according to a preset encoding algorithm to obtain encoded data, and send the encoded data as a token to the corresponding user; Among them, the key of the preset SM4 algorithm is constructed based on the current project name of the system and the user name of the token to be issued, including: Calculate the first summary information of the UUID of the user name by using the SM3 algorithm, and calculate the second summary information of the ID of the project name by using the SM3 algorithm, so as to construct a key of the preset SM4 algorithm based on the first summary information and the second summary information; Combining the first data according to a preset data combination strategy to obtain second data includes: The first data, the current first timestamp of the system and the constructed random vector of a preset length are combined to obtain second data; Encoding the third data according to a preset encoding algorithm to obtain encoded data includes: Grouping the bytes in the third data to obtain a plurality of first groups; wherein the number of bytes in each of the first groups is the same; Grouping the bits of each of the first groups to obtain a plurality of second groups; wherein the number of bits in each of the second groups is the same; Performing an adding 0 operation in front of each of the second groups to expand each of the first groups; Each of the first groups after expansion is replaced with a base64 code according to a base64 table, and all the base64 codes obtained by replacement are combined to obtain the encoded data.

2. The token generation method according to claim 1, characterized in that: Before encrypting the data to be encrypted based on the SM4 algorithm and its key, the token generation method further includes: The number of bytes pre-filled after the data to be encrypted is determined according to a preset filling relational formula n-(x%n); wherein x is the number of original bytes of the data to be encrypted; n is the preset number of basic filling bytes; and % is a modulo operation; Bytes are filled after the data to be encrypted according to the number of bytes, so as to encrypt the data to be encrypted with the filled bytes based on the SM4 algorithm and its key.

3. The token generation method according to claim 2, characterized in that: Encrypting the data to be encrypted based on the SM4 algorithm and its key to obtain first data includes: Get the current first timestamp of the system and construct a random vector of preset length; The data to be encrypted, the first timestamp, the random vector and the key are taken together as input parameters of the SM4 algorithm, and the input parameters are encrypted using the SM4 algorithm to obtain the first data.

4. The token generation method according to claim 3, characterized in that: The token generation method further comprises: After receiving a user request with the token, obtaining a second timestamp of the system, and decoding the token using a decoding algorithm corresponding to the encoding algorithm to obtain a first timestamp decoding value, a first data decoding value, a random vector decoding value, and a first eigenvalue decoding value; Determining whether the first timestamp decoded value is valid according to the second timestamp and a preset timestamp validity period; If valid, combining the first data decoded value, the first timestamp decoded value and the random vector decoded value to obtain second combined data, and using the SM3 algorithm to calculate a second eigenvalue of the second combined data, and determining whether the second eigenvalue is the same as the first eigenvalue decoded value; If they are the same, the first data decoding value, the first timestamp decoding value, the random vector decoding value and the key are used together as input parameters of the SM4 algorithm, so as to use the SM4 algorithm to decrypt the input parameters to obtain the data to be encrypted, and remove the bytes padded after the data to be encrypted according to the number of bytes to obtain the original data to be encrypted, so as to return the requested data to the corresponding user based on the user request if the original data to be encrypted has not been tampered with.

5. The token generation method according to claim 1, characterized in that: Encoding the third data according to a preset encoding algorithm to obtain encoded data includes: Divide every three bytes of the third data into a group to obtain a plurality of first groups including 24 bits; Divide each of the first group of bits into 4 groups evenly, to obtain a plurality of second groups including 6 bits; Add two 0s in front of each of the second groups to expand each of the first groups into a first group containing 32 bits; Each of the first groups after expansion is replaced with a base64 code according to a base64 table, and all the base64 codes obtained by replacement are combined to obtain the encoded data.

6. The token generation method according to any one of claims 1 to 5, characterized in that: Construct the key of the preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, including: Calculate the first summary information of the UUID of the user name by using the SM3 algorithm, and divide the first summary information into 4 parts on average, and take the first character of each part to obtain 4 first characters; Calculate the second summary information of the ID of the project name using the SM3 algorithm, and divide the second summary information into 4 parts on average, and take the first character of each part to obtain 4 second characters; Converting the first character and the second character into bits, and combining the converted bits to obtain bit data; The bit data is randomly filled to the key length of the SM4 algorithm, and the filled bit data is used as the key of the SM4 algorithm.

7. The token generation method according to claim 6, characterized in that: In the bit data, the bit position of the first character conversion is arranged before the bit position of the second character conversion; Randomly padding the bit data to the key length of the SM4 algorithm includes: 32 bits of data are randomly filled between the first character conversion bit and the second character conversion bit, and 32 bits of data are randomly filled after the second character conversion bit to obtain bit data with a length equal to the key length.

8. A token generation system, characterized in that: include: An encryption module, used to construct a key of a preset SM4 algorithm based on the current project name of the system and the user name of the token to be issued, so as to encrypt the data to be encrypted based on the SM4 algorithm and its key to obtain first data; A first combining module, used for combining the first data according to a preset data combining strategy to obtain second data; A second combining module, used for calculating the first eigenvalue of the second data by using a preset SM3 algorithm, and combining the second data and its first eigenvalue to obtain third data; An encoding module, used for encoding the third data according to a preset encoding algorithm to obtain encoded data, and sending the encoded data as a token to a corresponding user; The encryption module is specifically used to calculate the first summary information of the UUID of the user name by using the SM3 algorithm, and calculate the second summary information of the ID of the project name by using the SM3 algorithm, so as to construct a key of the preset SM4 algorithm based on the first summary information and the second summary information; The first combining module is specifically used to combine the first data, the current first timestamp of the system and the constructed random vector of a preset length to obtain the second data; The encoding module is specifically used to group the bytes in the third data to obtain multiple first groups; wherein the number of bytes in each of the first groups is the same; group the bits of each of the first groups to obtain multiple second groups; wherein the number of bits in each of the second groups is the same; perform a 0-adding operation in front of each of the second groups to expand each of the first groups; replace each of the expanded first groups with base64 encoding according to a base64 table, and combine all the replaced base64 encodings to obtain the encoded data.

9. A token generation device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the token generation method according to any one of claims 1 to 7 when executing the computer program.

Images