Token generation method, token signature verification method, device, equipment and storage medium

Abstract

This application discloses a token generation method, token verification method, apparatus, device, and storage medium, comprising: generating a key pair based on the latest user information obtained through a client; constructing target information to be signed, and signing the target information based on the private key in the key pair to obtain a signature value corresponding to the latest user information; constructing a corresponding token based on the target information, the signature value, and the public key in the key pair, and sending the token to the client so that the client can verify the token. This application, by combining the key generation process with user information, avoids the situation where the token remains valid even after the user changes their password or the server modifies a user's permissions or roles, thus improving the security of the token and the system.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a token generation method, a token verification method, an apparatus, a device, and a storage medium. Background Art

[0002] JWT (JSON Web Token, an open standard based on JSON) format tokens are commonly used in information systems for identity verification. JWT is an open standard based on JSON designed for transmitting claims between web application environments. This token is designed to be compact and secure, and is particularly suitable for Single Sign-On (SSO) scenarios in distributed sites. JWT claims are generally used to transmit authenticated user identity information between identity providers and service providers to facilitate resource retrieval from resource servers. They can also be used to add additional claims necessary for other business logic. The token can be used directly for authentication or it can be encrypted.

[0003] Currently, the JWT token in the system remains valid even when user information is changed during use, which poses a certain security risk to the system. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a token generation method, token verification method, apparatus, device, and storage medium that can invalidate the token when the latest user information changes, thereby improving system security. The specific solution is as follows:

[0005] Firstly, this application discloses a token generation method applied to a server, including:

[0006] Generate a key pair based on the latest user information obtained through the client;

[0007] Construct target information to be signed, and sign the target information based on the private key in the key pair to obtain a signature value corresponding to the latest user information;

[0008] A corresponding token is constructed based on the target information, the signature value, and the public key in the key pair, and the token is sent to the client so that the client can verify the signature of the token.

[0009] Optionally, generating a key pair based on the latest user information obtained through the client includes:

[0010] Retrieve the latest user information sent by the client, including the current user's password and current role permissions;

[0011] The latest user information is processed using a preset message digest algorithm to obtain a summary message.

[0012] The digest information is processed using a preset asymmetric key generation algorithm to obtain the current key pair.

[0013] Optionally, the step of using a preset information digest algorithm to digest the latest user information to obtain digest information includes:

[0014] Generate the target random number using a preset random number generation algorithm;

[0015] The latest user information and the target random number are digested using a preset message digest algorithm to obtain digest information.

[0016] Optionally, constructing the corresponding token based on the target information, the signature value, and the public key in the key pair includes:

[0017] Configure a corresponding validity period for the key pair and create a timestamp corresponding to the validity period;

[0018] A corresponding token is constructed based on the target information, the signature value, the public key in the key pair, and the timestamp.

[0019] Optionally, constructing the corresponding token based on the target information, the signature value, the public key in the key pair, and the timestamp includes:

[0020] The timestamp is encrypted using a preset symmetric encryption algorithm to obtain an encrypted timestamp;

[0021] A corresponding token is constructed based on the target information, the signature value, the public key in the key pair, and the encrypted timestamp.

[0022] Optionally, constructing the corresponding token based on the target information, the signature value, the public key in the key pair, and the timestamp further includes:

[0023] Determine whether the current conditions for key regeneration are met;

[0024] If so, then repeat the step of generating a key pair based on the latest user information obtained through the client;

[0025] The conditions for key regeneration include any one of the following: the validity period corresponding to the timestamp has expired, the token verification fails, or the user information has changed.

[0026] Secondly, this application discloses a token verification method applied to a client, including:

[0027] The server sends the latest user information to the server so that the server can generate a key pair based on the latest user information, and sign the target information to be signed based on the private key in the key pair to obtain a signature value corresponding to the latest user information, and construct a corresponding token based on the target information, the signature value and the public key in the key pair.

[0028] Obtain the token sent by the server;

[0029] The signature value in the token is verified based on the public key in the token and the target information.

[0030] Thirdly, this application discloses a token generation device, applied on a server side, comprising:

[0031] The key generation module is used to generate key pairs based on the latest user information obtained through the client;

[0032] The information construction module is used to construct the target information to be signed;

[0033] The information signature module is used to sign the target information based on the private key in the key pair to obtain a signature value corresponding to the latest user information.

[0034] A token construction module is used to construct a corresponding token based on the target information, the signature value, and the public key in the key pair.

[0035] A token sending module is used to send the token to the client so that the client can verify the token.

[0036] Fourthly, this application discloses an electronic device, comprising:

[0037] Memory, used to store computer programs;

[0038] A processor for executing the computer program to implement the steps of the method disclosed above.

[0039] Fifthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the method disclosed above.

[0040] As can be seen, this application provides a token generation method, including: generating a key pair based on the latest user information obtained through a client; constructing target information to be signed, and signing the target information based on the private key in the key pair to obtain a signature value corresponding to the latest user information; constructing a corresponding token based on the target information, the signature value, and the public key in the key pair, and sending the token to the client so that the client can verify the token. Therefore, this application combines the key pair generation process with the latest user information, i.e., generating the key pair based on the latest user information, so that the token is updated simultaneously when the user information changes. This ensures that when the user information changes, the client's verification fails, improving the security of the token and the system, and guaranteeing the security of the user's continued access to the system after performing relevant sensitive operations. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0042] Figure 1 This is a flowchart of a token generation method disclosed in this application;

[0043] Figure 2 This is a flowchart of a specific token generation method disclosed in this application;

[0044] Figure 3 This is a flowchart of a specific token generation method disclosed in this application;

[0045] Figure 4 This application discloses a flowchart of a token verification method.

[0046] Figure 5 A schematic diagram of the token generation method provided in this application;

[0047] Figure 6 This application provides a structural diagram of an electronic device. Detailed Implementation

[0048] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0049] Currently, the original standard uses a fixed server key for key generation, which is not user-specific. Therefore, the token remains valid even when the user changes their password or the server modifies the user's permissions or roles. To address this, this application provides a token generation method that improves the security of both the token and the system, ensuring the security of continued system access after the user performs sensitive operations.

[0050] This invention discloses a token generation method, see [link to relevant documentation]. Figure 1 As shown, the method includes:

[0051] Step S11: Generate a key pair based on the latest user information obtained through the client.

[0052] In this embodiment, the server obtains the latest user information sent by the client, and then generates a key pair based on this latest user information. The key pair includes a public key and a private key, with the private key stored on the server and the public key made public to the client. It is understood that by combining the key pair generation process with the latest user information in the system—that is, using the system's permission role information and user password as input parameters for key pair generation—one user corresponds to one public-private key pair. Therefore, when critical information such as user permission role information or password changes, the key pair will also change accordingly, ensuring the security of continued system access after the user performs sensitive operations.

[0053] Step S12: Construct the target information to be signed, and sign the target information based on the private key in the key pair to obtain the signature value corresponding to the latest user information.

[0054] In this embodiment, after generating the key pair, target information to be signed is constructed. Then, the target information is signed based on the private key in the key pair to obtain a signature value corresponding to the latest user information. For example, the token consists of three parts connected by periods (.). These three parts are the Header, Payload, and Signature. It is understood that the target information includes the Header and Payload, and the signature value corresponding to the latest user information is the Signature.

[0055] Step S13: Construct a corresponding token based on the target information, the signature value, and the public key in the key pair, and send the token to the client so that the client can verify the token.

[0056] In this embodiment, after obtaining the signature value corresponding to the latest user information, the target information, the signature value, and the public key in the key pair are integrated to construct a corresponding token. The token is then sent to the client for verification. Next, it is determined whether the key regeneration conditions are met. If the conditions are met, the step of generating a key pair based on the latest user information obtained from the client is repeated. If the conditions are not met, the current process ends. It should be noted that the key regeneration conditions include any one of the following: the expiration date corresponding to the timestamp has expired, the token verification fails, or the user information has changed.

[0057] For example, when a request to obtain a new key is received from the client, it indicates that the public key's validity period has expired, satisfying the condition that the validity period corresponding to the timestamp in the key regeneration condition has expired. Therefore, the step of generating a key pair based on the latest user information obtained through the client is re-executed to generate a new public key and send the new public key to the client. It should be noted that after receiving the new public key, the client caches the new public key locally and sends another request to obtain a new public key to the server within the new public key's validity period.

[0058] Understandably, the token is a string generated by the server to serve as a request token for the client. Upon the first login, the server generates a token and returns it to the client. Subsequent requests only require this token; the client no longer needs to include the username and password. Specifically, the Header field has changed, adding a new symmetric encryption algorithm. The Payload field remains unchanged. The Signature field, calculated using a new method, replaces the original Signature field. Essentially, it's all a string of type String; only the algorithm for generating the string has been modified to meet the design requirements.

[0059] As can be seen, this application provides a token generation method, including: generating a key pair based on the latest user information obtained through a client; constructing target information to be signed, and signing the target information based on the private key in the key pair to obtain a signature value corresponding to the latest user information; constructing a corresponding token based on the target information, the signature value, and the public key in the key pair, and sending the token to the client so that the client can verify the token. Therefore, this application combines the key pair generation process with the latest user information, i.e., generating the key pair based on the latest user information, so that the token is updated simultaneously when the user information changes. This ensures that when the user information changes, the client's verification fails, improving the security of the token and the system, and guaranteeing the security of the user's continued access to the system after performing relevant sensitive operations.

[0060] See Figure 2 As shown, this embodiment of the invention discloses a token generation method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution.

[0061] Step S21: Obtain the latest user information sent by the client, which includes the current user's password and current role permissions.

[0062] In this embodiment, the latest user information sent by the client is first obtained. This latest user information includes the current user password and the current role permission information. It is understood that the current user password and the current role permission information are used as input parameters for key pair generation; when this key information changes, the key pair will also change accordingly. Furthermore, the key information includes, but is not limited to, the current user password and the current role permission information, and can be customized according to actual needs.

[0063] Step S22: Use a preset information digest algorithm to perform digest processing on the latest user information to obtain digest information.

[0064] In this embodiment, after obtaining the latest user information sent by the client, which includes the current user's password and current role permissions, a target random number is generated using a preset random number generation algorithm. Then, a preset message digest algorithm is used to digest the latest user information and the target random number to obtain digest information. It should be noted that the preset message digest algorithm may include, but is not limited to, MD5 (Message-Digest Algorithm), SHA (Secure Hash Algorithm), MAC (Hash Message Authentication Code) algorithms, etc.

[0065] It is understood that the target random number is created so that, when the current latest user information remains unchanged, the digest information will change and evolve with the target random number, thereby generating different key pairs.

[0066] Step S23: Calculate the digest information using a preset asymmetric key generation algorithm to obtain the current key pair.

[0067] In this embodiment, the private key stored on the server is used to process the digest information using a preset asymmetric key generation algorithm to obtain the current key pair. It is understood that the asymmetric key generation algorithm is the RSA (Rivest-Shamir-Adleman) algorithm, but it can also be other algorithms such as Elgamal encryption, knapsack algorithm, or ECC (Error Correcting Code).

[0068] For example, in SEED_RSA_SECRET(HMACSHA256(userinfo)), userinfo is user information, HMACSHA256 is the preset message digest algorithm, RSA_SECRET is the asymmetric key generation algorithm, and SEED indicates that the digest is the feature.

[0069] Step S24: Construct the target information to be signed, and sign the target information based on the private key in the key pair to obtain the signature value corresponding to the latest user information.

[0070] Step S25: Construct a corresponding token based on the target information, the signature value, and the public key in the key pair, and send the token to the client so that the client can verify the token.

[0071] For details regarding steps S24 and S25, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0072] As can be seen, in this embodiment, after obtaining the latest user information sent by the client, which includes the current user's password and current role permissions, a target random number is generated using a random number generation algorithm. A preset message digest algorithm is then used to digest the latest user information and the target random number to obtain digest information. Finally, a preset asymmetric key generation algorithm is used to process the digest information to obtain the current key pair. By combining the key generation process with user information, this embodiment ensures that the key pair changes accordingly when the current user's password and / or current role permissions change, thus guaranteeing the security of the user's continued access to the system after performing sensitive operations.

[0073] See Figure 3 As shown, this embodiment of the invention discloses a token generation method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution.

[0074] Step S31: Generate a key pair based on the latest user information obtained through the client.

[0075] Step S32: Construct the target information to be signed, and sign the target information based on the private key in the key pair to obtain the signature value corresponding to the latest user information.

[0076] Step S33: Configure a corresponding validity period for the key pair and create a timestamp corresponding to the validity period.

[0077] In this embodiment, a corresponding validity period is configured for the key pair, and a timestamp corresponding to the validity period is created. It is understood that the key validity period is generally set to be short, for example, within a range of 1 to 10 minutes, so that the client can only use the key for a short period. Once the time exceeds the timestamp setting, the key expires. Secondly, when a user performs operations such as logging out or disabling, it can also ensure that the token expires promptly within a given time window.

[0078] Step S34: Encrypt the timestamp using a preset symmetric encryption algorithm to obtain an encrypted timestamp.

[0079] In this embodiment, the timestamp is encrypted using a preset symmetric encryption algorithm to obtain the encrypted timestamp. It can be understood that the timestamp of the key's validity period is encrypted using symmetric encryption and then appended to the secret (key). The symmetric encryption algorithm includes: AES (Advanced Encryption Standard), DES (Data Encryption Standard), 3DES, or Triple DES (Triple Data Encryption Algorithm), etc. The Header portion of the token consists of:

[0080] {

[0081] 'alg':"HS256",

[0082] 'typ':"JWT"

[0083] }

[0084] Change to:

[0085] {

[0086] 'alg':"HS256",

[0087] 'alg-cryptoperiod':"AES",

[0088] 'typ':"JWT"

[0089] }

[0090] 'alg':"HS256" indicates the default message digest algorithm, 'typ':"JWT" ​​indicates an open standard based on JSON (RFC 7519), and 'alg-cryptoperiod':"AES" indicates the addition of the AES algorithm, which can be flexibly replaced with other symmetric encryption algorithms. It should be noted that the symmetric key used for symmetric encryption is determined through negotiation between the server and the client.

[0091] Step S35: Construct a corresponding token based on the target information, the signature value, the public key in the key pair, and the encrypted timestamp, and send the token to the client so that the client can verify the token.

[0092] In this embodiment, a corresponding token is constructed based on the target information, the signature value, the public key in the key pair, and the encrypted timestamp. It is understood that the encrypted timestamp is appended to the secret (key), for example:

[0093] RS256(base64UrlEncode(header)+"."+base64UrlEncode(payload),SEED_RS A_SECRET(HMACSHA256(userinfo))+AES(timestamp,aes_secret))

[0094] In the formula, AES(timestamp, aes_secret) is the encrypted timestamp.

[0095] For details regarding steps S31 and S32, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0096] As can be seen, this application introduces the concept of key validity period. A validity period is set for the key pair and a corresponding timestamp is generated. Then, the timestamp is encrypted using a symmetric key negotiated by both parties to obtain an encrypted timestamp. This encrypted timestamp is appended to the key and sent to the client along with the token. When the client discovers that the key has expired, it will automatically update the key and then perform the signature verification process. This solves the system security problem caused by malicious key cracking, improves token security, and ensures that the token expires promptly within a given time window when the user logs out or disables the key.

[0097] See Figure 4 As shown, this embodiment of the invention discloses a token verification method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution.

[0098] Step S41: Send the latest user information to the server so that the server can generate a key pair based on the latest user information, sign the target information to be signed based on the private key in the key pair to obtain a signature value corresponding to the latest user information, and construct a corresponding token based on the target information, the signature value and the public key in the key pair.

[0099] In this embodiment, after the user inputs user information into the client, the client sends the latest user information to the server so that the server can generate a key pair based on the latest user information, and sign the target information to be signed based on the private key in the key pair to obtain a signature value corresponding to the latest user information, and construct a corresponding token based on the target information, the signature value and the public key in the key pair.

[0100] Step S42: Obtain the token sent by the server.

[0101] In this embodiment, after the server constructs and sends the token, the client obtains the token sent by the server to perform a signature verification operation. It is understood that the token serves as proof of whether the server will respond to the data request sent by the client.

[0102] Step S42: Verify the signature value in the token based on the public key in the token and the target information.

[0103] In this embodiment, the encrypted timestamp in the token is obtained, and then the encrypted timestamp is decrypted using the symmetric key to determine whether the key is valid. If the key is invalid, a request to obtain a new key needs to be sent to the server to obtain a new public key. If the key is valid, the signature value corresponding to the latest user information is decrypted using the public key to obtain the first digest information. Then, the target information is digested using a preset message digest algorithm to obtain the second digest information. The first digest information and the second digest information are compared. If the first digest information and the second digest information are consistent, the signature verification is successful; if the first digest information and the second digest information are inconsistent, the signature verification fails.

[0104] As can be seen, this application provides a token verification method. This application sends the latest user information to the server so that the server can generate a key pair based on the latest user information and construct a corresponding token based on the target information, the signature value, and the public key in the key pair. Then, the server obtains the token and verifies the signature value in the token based on the public key in the token and the target information, thereby improving the security of the token and the system.

[0105] See Figure 5 As shown in the illustration, this application also discloses a token generation device, comprising:

[0106] The key generation module 11 is used to generate key pairs based on the latest user information obtained through the client;

[0107] Information construction module 12 is used to construct the target information to be signed;

[0108] The information signature module 13 is used to sign the target information based on the private key in the key pair to obtain a signature value corresponding to the latest user information.

[0109] Token construction module 14 is used to construct a corresponding token based on the target information, the signature value, and the public key in the key pair;

[0110] The token sending module 15 is used to send the token to the client so that the client can verify the token.

[0111] As can be seen, this application includes: generating a key pair based on the latest user information obtained through the client; constructing target information to be signed, and signing the target information based on the private key in the key pair to obtain a signature value corresponding to the latest user information; constructing a corresponding token based on the target information, the signature value, and the public key in the key pair, and sending the token to the client so that the client can verify the token. Therefore, this application combines the key pair generation process with the latest user information, i.e., generating the key pair based on the latest user information, so that the token is updated simultaneously when the user information changes. This ensures that when the user information changes, the client's verification fails, improving the security of the token and the system, and guaranteeing the security of the user's continued access to the system after performing relevant sensitive operations.

[0112] In some specific embodiments, the key generation module 11 specifically includes:

[0113] The user information acquisition unit is used to acquire the latest user information sent by the client, which includes the current user password and current role permission information;

[0114] The random number generation unit is used to generate target random numbers using a preset random number generation algorithm.

[0115] The information digest unit is used to perform digest processing on the latest user information and the target random number using a preset information digest algorithm to obtain digest information;

[0116] The key generation unit is used to perform calculations on the digest information using a preset asymmetric key generation algorithm to obtain the current key pair.

[0117] In some specific embodiments, the token construction module 14 specifically includes:

[0118] A timestamp creation unit is used to configure a corresponding validity period for the key pair and create a timestamp corresponding to the validity period;

[0119] A timestamp encryption unit is used to encrypt the timestamp using a preset symmetric encryption algorithm to obtain an encrypted timestamp.

[0120] A token construction unit is used to construct a corresponding token based on the target information, the signature value, the public key in the key pair, and the encrypted timestamp.

[0121] In some specific embodiments, the token generation device further includes:

[0122] The condition judgment module is used to determine whether the current key regeneration conditions are met.

[0123] The re-execution module is used to re-execute the step of generating a key pair based on the latest user information obtained through the client if the current key regeneration conditions are met.

[0124] Furthermore, embodiments of this application also provide an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0125] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the token generation method or token verification method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0126] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0127] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0128] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the token generation method or token verification method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0129] Furthermore, this application also discloses a storage medium storing a computer program. When the computer program is loaded and executed by a processor, it implements the token generation method or token verification method steps disclosed in any of the foregoing embodiments.

[0130] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0131] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0132] The token generation method, token verification method, apparatus, device, and storage medium provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A token generation method, characterized in that, Applied to the server side, including: A key pair is generated based on the latest user information obtained through the client, and the private key of the key pair is kept on the server and the public key is made public to the client. Construct target information to be signed, and sign the target information based on the private key in the key pair to obtain a signature value corresponding to the latest user information; A corresponding token is constructed based on the target information, the signature value, and the public key in the key pair, and the token is sent to the client so that the client can verify the signature of the token; The step of generating a key pair based on the latest user information obtained through the client includes: The key pair is generated based on the latest user information obtained through the client and the target random number; The step of generating a key pair based on the latest user information obtained through the client includes: Retrieve the latest user information sent by the client, including the current user's password and current role permissions; The latest user information is processed using a preset message digest algorithm to obtain a summary message. The digest information is processed using a preset asymmetric key generation algorithm to obtain the current key pair; Furthermore, the step of using a preset information digest algorithm to digest the latest user information to obtain digest information includes: Generate the target random number using a preset random number generation algorithm; The latest user information and the target random number are digested using a preset message digest algorithm to obtain digest information; The token generation method further includes: Determine whether the current conditions for key regeneration are met; If so, then repeat the step of generating a key pair based on the latest user information obtained through the client; The conditions for key regeneration include any one of the following: the expiration date corresponding to the timestamp has expired, the signature verification of the token fails, or the user information has changed; the expiration date is the expiration date corresponding to the key pair, and the expiration date corresponds to the timestamp.

2. The token generation method according to claim 1, characterized in that, The construction of the corresponding token based on the target information, the signature value, and the public key in the key pair includes: Configure a corresponding validity period for the key pair and create a timestamp corresponding to the validity period; A corresponding token is constructed based on the target information, the signature value, the public key in the key pair, and the timestamp.

3. The token generation method according to claim 2, characterized in that, The process of constructing a corresponding token based on the target information, the signature value, the public key in the key pair, and the timestamp includes: The timestamp is encrypted using a preset symmetric encryption algorithm to obtain an encrypted timestamp; A corresponding token is constructed based on the target information, the signature value, the public key in the key pair, and the encrypted timestamp.

4. A token verification method, characterized in that, Applied to the client side, including: The server sends the latest user information to the client so that the server can generate a key pair based on the latest user information and a target random number, and sign the target information to be signed based on the private key in the key pair to obtain a signature value corresponding to the latest user information. The server also constructs a corresponding token based on the target information, the signature value and the public key in the key pair. The private key of the key pair is kept on the server and the public key is made public to the client. Obtain the token sent by the server; The signature value in the token is verified based on the public key in the token and the target information. Wherein, the key pair is obtained by the server from the latest user information sent by the client, which includes the current user password and current role permission information, and the latest user information is digested using a preset message digest algorithm to obtain digest information. The digest information is then processed using a preset asymmetric key generation algorithm to obtain the current key pair. The digest information is obtained by the server generating a target random number using a preset random number generation algorithm, and digesting the latest user information and the target random number using a preset message digest algorithm. The token generation method further includes: Determine whether the current conditions for key regeneration are met; If so, the latest user information is resent to the server so that the server can execute the step of generating a key pair based on the latest user information obtained through the client; wherein, the conditions for regenerating the key include any one of the following: the expiration date corresponding to the timestamp has expired, the signature verification of the token fails, or the user information has changed; the expiration date is the expiration date corresponding to the key pair, and the expiration date corresponds to the timestamp.

5. A token generation device, characterized in that, Applied to the server side, including: The key generation module is used to generate a key pair based on the latest user information obtained through the client, and to keep the private key of the key pair on the server and make the public key public to the client. The information construction module is used to construct the target information to be signed; The information signature module is used to sign the target information based on the private key in the key pair to obtain a signature value corresponding to the latest user information. A token construction module is used to construct a corresponding token based on the target information, the signature value, and the public key in the key pair. A token sending module is used to send the token to the client so that the client can verify the token. Specifically, the key generation module is used to generate the key pair based on the latest user information obtained through the client and a target random number; The key generation module includes: The user information acquisition unit is used to acquire the latest user information sent by the client, which includes the current user password and current role permission information; The random number generation unit is used to generate target random numbers using a preset random number generation algorithm. The information digest unit is used to perform digest processing on the latest user information and the target random number using a preset information digest algorithm to obtain digest information; A key generation unit is used to perform calculations on the digest information using a preset asymmetric key generation algorithm to obtain the current key pair; The token generation device further includes: The condition judgment module is used to determine whether the current key regeneration conditions are met. The re-execution module is used to re-execute the step of generating a key pair based on the latest user information obtained through the client if the current key regeneration conditions are met. The conditions for key regeneration include any one of the following: the expiration date corresponding to the timestamp has expired, the signature verification of the token fails, or the user information has changed; the expiration date is the expiration date corresponding to the key pair, and the expiration date corresponds to the timestamp.

6. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 4.

Images