Authentication method, device, electronic device and storage medium

Abstract

The present invention provides an authentication method, device, electronic device and storage medium, which are applied to a server including an identity authentication module and a service providing module, by receiving a plurality of randomly generated authentication keys and corresponding key numbers; storing each authentication key and corresponding key number in the identity authentication module and the service providing module respectively; controlling the identity authentication module to receive a login request sent by a user, selecting a target key from the authentication key; encrypting the login request and the target key to generate a target signaling carrying a target key number corresponding to the target key, and returning the target signaling to the user; controlling the service providing module to receive an access request sent by the user carrying the target signaling; parsing the target key number from the target signaling, and determining the corresponding target key; if the target signaling is verified to be valid according to the target key, providing the user with the service corresponding to the access request. The security of signaling authentication can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of information and communication technology, and in particular to an authentication method, device, electronic device and storage medium. Background Art

[0002] At present, the method of using signaling (token) for authentication and authorization is used in many client-server systems. The authentication mechanism based on signaling is similar to the hypertext transfer protocol, which is stateless and does not require the server to retain the user's authentication information or session information. This signaling must be passed to the server at each request, usually carried in the request header, and the server performs authentication and authorization after receiving it, without considering which server the user is logging in on, which facilitates the expansion of applications.

[0003] In the existing signaling authentication and authorization methods, the server often uses a fixed key for encryption and distribution to the client. However, since all signaling is encrypted and generated using this key, developers, operation and maintenance personnel, and personnel with machine access rights will have access to this key. If the key is leaked, it will threaten the security of the entire system. Therefore, there is still a problem of low authentication and authorization security. Summary of the invention

[0004] The embodiments of the present disclosure at least provide an authentication method, device, electronic device and storage medium, which can improve the security of signaling authentication.

[0005] The present disclosure provides an authentication method, which is applied to a server including an identity authentication module and a service provision module. The method includes:

[0006] Receiving a plurality of randomly generated authentication keys and corresponding key numbers;

[0007] storing each authentication key and the corresponding key number in the identity authentication module and the service provision module respectively;

[0008] Control the identity authentication module, receive a login request sent by a user, select a target key from the authentication key; generate a target signaling according to the login request and the target key encryption, and return the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key;

[0009] Control the service provision module to receive the access request sent by the user and carrying the target signaling; parse the target key number from the target signaling and determine the target key corresponding to the target key number; if the target signaling is verified to be valid according to the target key, provide the user with the service corresponding to the access request.

[0010] In an optional implementation manner, the target signaling is generated based on the following method:

[0011] Controlling the identity authentication module to parse the login request, and determining user information corresponding to the user according to the login request;

[0012] Encode the user information and the target key number to generate a payload character string of the target signaling;

[0013] Defining a preset target encryption algorithm for the target signaling, and encoding the algorithm type corresponding to the target encryption algorithm to generate a header string of the target signaling;

[0014] Encrypt the header string and the payload string respectively according to the target encryption algorithm and the target key to generate a visa string of the target signaling;

[0015] The header string, the payload string and the visa string are sequentially connected in series to generate the target signaling.

[0016] In an optional implementation manner, the target signaling is verified based on the following method:

[0017] Control the service providing module to parse the target key number from the payload string of the target signaling; parse the target encryption algorithm corresponding to the target signaling from the header string of the target signaling;

[0018] According to the target key number, the target key corresponding to the target key number is screened out from the multiple authentication keys and the corresponding key numbers stored in the service providing module;

[0019] According to the target key and the target encryption algorithm, re-encrypt the header string and the payload string of the target signaling respectively to generate a verification string of the target signaling;

[0020] Determine whether the verification string matches the visa string. If they match, the target signaling is valid; if they do not match, the target signaling is invalid.

[0021] In an optional implementation manner, after the control of the service provision module receives an access request sent by the user and carrying the target signaling; parses the target key number from the target signaling, and determines the target key corresponding to the target key number; and if the target signaling is verified to be valid according to the target key, then provides the user with the service corresponding to the access request, the method further includes:

[0022] Deleting the target key and the corresponding target key number stored in the identity authentication module and the service provision module;

[0023] Continue to receive the authentication key and the corresponding key number, and store the newly received authentication key and the corresponding key number in the identity authentication module and the service provision module respectively.

[0024] In an optional implementation, the authentication key is generated by a preset key generation server according to a preset key generation period and is configured with a corresponding key number.

[0025] The embodiment of the present disclosure also provides an authentication device, which is applied to a server including an identity authentication module and a service providing module, and the device includes:

[0026] A receiving module, used for receiving a plurality of randomly generated authentication keys and corresponding key numbers;

[0027] A storage module, used to store each of the authentication keys and the corresponding key numbers in the identity authentication module and the service provision module respectively;

[0028] A first control module is used to control the identity authentication module, receive a login request sent by a user, select a target key from the authentication key; generate a target signaling according to the login request and the target key encryption, and return the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key;

[0029] The second control module is used to control the service provision module, receive the access request sent by the user and carrying the target signaling; parse the target key number from the target signaling, and determine the target key corresponding to the target key number; if the target signaling is valid according to the target key, provide the user with the service corresponding to the access request.

[0030] In an optional implementation manner, the first control module is specifically configured to:

[0031] Controlling the identity authentication module to parse the login request, and determining user information corresponding to the user according to the login request;

[0032] Encode the user information and the target key number to generate a payload character string of the target signaling;

[0033] Defining a preset target encryption algorithm for the target signaling, and encoding the algorithm type corresponding to the target encryption algorithm to generate a header string of the target signaling;

[0034] Encrypt the header string and the payload string respectively according to the target encryption algorithm and the target key to generate a visa string of the target signaling;

[0035] The header string, the payload string and the visa string are sequentially connected in series to generate the target signaling.

[0036] In an optional implementation manner, the second control module is specifically configured to:

[0037] Control the service providing module to parse the target key number from the payload string of the target signaling; parse the target encryption algorithm corresponding to the target signaling from the header string of the target signaling;

[0038] According to the target key number, the target key corresponding to the target key number is screened out from the multiple authentication keys and the corresponding key numbers stored in the service providing module;

[0039] According to the target key and the target encryption algorithm, re-encrypt the header string and the payload string of the target signaling respectively to generate a verification string of the target signaling;

[0040] Determine whether the verification string matches the visa string. If they match, the target signaling is valid; if they do not match, the target signaling is invalid.

[0041] In an optional implementation, the device further includes a key cleaning module, the key cleaning module being used to: delete the target key and the corresponding target key number stored in the identity authentication module and the service provision module;

[0042] Continue to receive the authentication key and the corresponding key number, and store the newly received authentication key and the corresponding key number in the identity authentication module and the service provision module respectively.

[0043] In an optional implementation, the authentication key is generated by a preset key generation server according to a preset key generation period and is configured with a corresponding key number.

[0044] An embodiment of the present disclosure also provides an electronic device, including: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the above-mentioned authentication method or steps in any possible implementation of the above-mentioned authentication method are performed.

[0045] The embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the authentication method or the steps in any possible implementation of the authentication method are executed.

[0046] The embodiments of the present disclosure also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-mentioned authentication method, or the steps in any possible implementation of the above-mentioned authentication method.

[0047] The present disclosure provides an authentication method, device, electronic device and storage medium, which are applied to a server including an identity authentication module and a service providing module, by receiving a plurality of randomly generated authentication keys and corresponding key numbers; storing each authentication key and corresponding key number in the identity authentication module and the service providing module respectively; controlling the identity authentication module to receive a login request sent by a user, and selecting a target key from the authentication key; generating a target signaling according to the login request and the target key encryption, and returning the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key; controlling the service providing module to receive an access request sent by the user carrying the target signaling; parsing the target key number from the target signaling, and determining the target key corresponding to the target key number; and providing the user with a service corresponding to the access request if the target signaling is verified to be valid according to the target key. The security of signaling authentication can be improved.

[0048] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0050] Figure 1 A flow chart of an authentication method provided by an embodiment of the present disclosure is shown;

[0051] Figure 2 A flowchart of another authentication method provided by an embodiment of the present disclosure is shown;

[0052] Figure 3 A schematic diagram of an authentication device provided by an embodiment of the present disclosure is shown;

[0053] Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0055] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0056] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0057] Research has found that in the existing signaling authentication and authorization methods, the server often uses a fixed key for encryption and distribution to the client. However, since all signaling is encrypted and generated using this key, developers, operation and maintenance personnel, and personnel with machine access rights will have access to this key. If the key is leaked, it will threaten the security of the entire system. Therefore, there is still a problem of low authentication and authorization security.

[0058] Based on the above research, the present disclosure provides an authentication method, device, electronic device and storage medium, which are applied to a server including an identity authentication module and a service provision module, by receiving a plurality of randomly generated authentication keys and corresponding key numbers; storing each authentication key and corresponding key number in the identity authentication module and the service provision module respectively; controlling the identity authentication module to receive a login request sent by a user, and selecting a target key from the authentication key; generating a target signaling according to the login request and the target key encryption, and returning the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key; controlling the service provision module to receive an access request sent by the user carrying the target signaling; parsing the target key number from the target signaling, and determining the target key corresponding to the target key number; and providing the user with the service corresponding to the access request if the target signaling is valid according to the target key verification. The security of signaling authentication can be improved.

[0059] To facilitate understanding of this embodiment, first, an authentication method disclosed in the embodiment of the present disclosure is introduced in detail. The execution subject of the authentication method provided in the embodiment of the present disclosure is a server including an identity authentication module and a service provision module, wherein the identity authentication module is used to verify the identity authentication information such as the login password of the user through the client, and issue a signaling to the user after verification; the service provision module is used to verify the user's access request carrying the signaling issued by the identity authentication module, and provide the service corresponding to the access request after the access is successful. In some possible implementations, the authentication method can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0060] See also Figure 1FIG. 1 is a flowchart of an authentication method provided by an embodiment of the present disclosure. The method is applied to a server including an identity authentication module and a service providing module, and includes steps S101 to S104, wherein:

[0061] S101. Receive a plurality of randomly generated authentication keys and corresponding key numbers.

[0062] In a specific implementation, the server receives a plurality of randomly generated authentication keys and a key number corresponding to each authentication key. The authentication key may be automatically generated regularly according to a preset generation cycle, and the server may continuously receive the authentication key.

[0063] Here, the authentication key can be generated by a preset key generation server according to a preset key generation period and configured with a corresponding key number. Specifically, a periodic task is preset in the preset key generation server, and an authentication key is generated every time period. When the authentication key is generated, a corresponding key number is configured for the authentication key.

[0064] It should be noted that the generation period of the authentication key can be selected according to actual needs and is not specifically limited here. For example, the generation period of the authentication key can be set to 1 minute, 1 hour or 1 day. When the generation period of the authentication key is set to 1 minute, the preset key generation server randomly generates an authentication key every 1 minute and configures a corresponding key number for it. The final generated authentication key can be in the form of key[n], where n represents the key number n corresponding to the authentication key key.

[0065] As a possible implementation method, the generation cycle of the authentication key can be determined based on the validity period of the signaling. If the generation cycle of the authentication key is greater than the validity period of the signaling, fewer valid keys will be saved; if the generation cycle of the authentication key is less than the validity period of the signaling, the more times the authentication key is generated within the validity period of the signaling, the more keys will be saved.

[0066] S102: Store each authentication key and the corresponding key number in the identity authentication module and the service provision module respectively.

[0067] In a specific implementation, after obtaining multiple randomly generated authentication keys and the key number corresponding to each authentication key, the server stores each authentication key and the corresponding key number in the identity authentication module and the service provision module respectively, so that the identity authentication module and the service provision module can synchronously update all newly generated authentication keys and the corresponding key numbers.

[0068] As a possible implementation, a data sharing module may also be provided in the server. After receiving multiple randomly generated authentication keys and corresponding key numbers, the server may cache them in the data sharing module. The data sharing module is respectively communicated with the identity authentication module and the service provision module. The server controls the data sharing module to simultaneously send multiple authentication keys and corresponding key numbers to the identity authentication module and the service provision module.

[0069] It should be noted that the authentication key and the corresponding key number stored in the identity authentication module are the same as the authentication key and the corresponding key number stored in the service provision module.

[0070] S103, control the identity authentication module, receive the login request sent by the user, select the target key from the authentication key; generate a target signaling according to the login request and the encryption of the target key, and return the target signaling to the user, wherein the target signaling carries the target key number corresponding to the target key.

[0071] In the specific implementation, the server controls the identity authentication module to receive the login request sent by the user, and verifies the user name and login password in the user login request to determine whether the user has login permission. If the user login password verification is successful, one of the authentication keys stored in the identity authentication module is selected, and the authentication key is used to encrypt the user identity information contained in the login request, generate a target signaling, and distribute the target signaling to the user.

[0072] It should be noted that, in the process of generating the target signaling, the key number corresponding to the selected authentication key needs to be encoded into the target signaling, so that the target signaling carries the key number corresponding to the authentication key used to encrypt the signaling.

[0073] Here, any valid authentication key stored in the identity authentication module can be selected as the target key. Preferably, in order to avoid the time difference problem of synchronization data, an authentication key corresponding to the latest key number can be used. For example, if the latest valid key number is 10, the authentication key key[9] with valid key number 9 can be used to encrypt the target signaling.

[0074] Optionally, the user can send a login request to the identity authentication module in the server through the client. The login request carries the user's username and login password. If the identity authentication module verifies that the username matches the user's login password, it determines that the login request is valid and then distributes the target signaling to the user.

[0075] Optionally, the target signaling can be a JWT signaling. JWT signaling consists of three pieces of information: header, payload, and signature. Connecting these three pieces of information text with dots constitutes a JWT string. For example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ.

[0076] As a possible implementation method, the target signaling can be generated based on the following method: control the identity authentication module to parse the login request, and determine the user information corresponding to the user according to the login request; encode the user information and the target key number to generate a payload string of the target signaling; define a preset target encryption algorithm for the target signaling, and encode the algorithm type corresponding to the target encryption algorithm to generate a header string of the target signaling; according to the target encryption algorithm and the target key, encrypt the header string and the payload string respectively to generate a visa string of the target signaling; concatenate the header string, the payload string and the visa string in sequence to generate the target signaling.

[0077] In a specific implementation, the payload portion of the target signaling is the portion where valid information is stored, including standard registered declarations, public declarations, private declarations, etc. The standard registered declarations include: the signaling issuer, the user to which the signaling is directed, the signaling receiver, the signaling expiration time, the signaling effective time, the signaling issuance time, the signaling unique identity, etc. This part of the declaration may be included in the target signaling in its entirety, or only in part or not at all, and may be selected based on actual needs, without specific restrictions here. Any information may be added to the public declaration, generally user-related information or necessary information required by other services may be added, but it is not recommended to add sensitive information because this part can be decrypted on the client side. In an embodiment of the present application, the content of the public declaration portion may be the user information determined by parsing the login request sent by the user, and may specifically include information such as the user name, and may be selected based on actual needs, without specific restrictions here.

[0078] Furthermore, with respect to the private declaration part, in this embodiment, based on the private declaration part, the target key number corresponding to the target key can be input into the private declaration part, and the declaration registered in the payload part of the target signaling, the public declaration, and the private declaration can be encoded to generate a payload string of the target signaling, thereby constituting the payload segment information of the target signaling.

[0079] Furthermore, the header part of the target signaling may include two fields: life type and encryption algorithm. In the encryption algorithm field, the preset encryption algorithm type may be configured for the target signaling, which defines which target encryption algorithm is required for the target signaling to be encrypted. For example, configuring 'alg': 'HS256' in the target header part means that the target encryption algorithm is the HS256 algorithm, which defines that the target signaling needs to be encrypted using the HS256 algorithm. After encoding the header part, the header string of the target signaling can be generated, which constitutes the header segment information of the target signaling.

[0080] Furthermore, after encoding the header string and payload string of the target signaling, since the header part of the target signaling has defined the target encryption algorithm required for the target signaling, and the target key for target signaling encryption has been selected in the previous steps, the target encryption algorithm and the target key are used to encrypt the header string and payload string of the target signaling to generate a corresponding encrypted string, which is used as the visa string of the target signaling to constitute the visa segment information of the target signaling.

[0081] Finally, the header string, payload string, and visa string are connected in series with dots, and the final string is the target signaling. Here, the payload segment information and header segment information in the target signaling are equivalent to plain text transmission, that is, this part of the information can be decrypted on the client side, and the target encryption algorithm for encrypting the target signaling can be easily obtained. However, since the payload segment information only carries the key number corresponding to the target key, the target key for encrypting the target signaling cannot be obtained on the client side. At the same time, the target key is dynamically and randomly generated and randomly selected by the server-controlled identity authentication module. In this way, the risk of key leakage can be reduced, thereby achieving the effect of improving the security of signaling authentication and authorization.

[0082] S104, control the service provision module to receive the access request sent by the user and carrying the target signaling; parse the target key number from the target signaling, and determine the target key corresponding to the target key number; if the target signaling is valid according to the target key, provide the user with the service corresponding to the access request.

[0083] In a specific implementation, after the identity authentication module distributes the target signaling to the user, the user can send an access request to the service provision module with the target signaling. After receiving the access request carrying the target signaling, the service provision module parses the target key number corresponding to the target key carried by the target signaling for encrypting the target signaling in the target signaling. Since the authentication key and its corresponding key number stored in the identity authentication module are the same as the authentication key and its corresponding key number stored in the identity authentication module, the corresponding target key can be found in the authentication key stored in the service provision module according to the target key number parsed from the target signaling. The validity of the target signaling is further verified using the target key that is the same as the encrypted target signaling. If the target signaling is valid, the service corresponding to the access request can be provided to the user.

[0084] Here, the services provided by the service providing module may include data transmission, etc., and the access request requests the service providing module to send certain data to the client, etc., which can be selected according to actual needs and are not specifically limited here.

[0085] As a possible implementation method, the method for verifying the validity of the target signaling can be: controlling the service provision module to parse the target key number from the payload string of the target signaling; parsing the target encryption algorithm corresponding to the target signaling from the header string of the target signaling; according to the target key number, screening out the target key corresponding to the target key number from the multiple authentication keys and the corresponding key numbers stored in the service provision module; according to the target key and the target encryption algorithm, re-encrypting the header string and the payload string of the target signaling respectively to generate a verification string of the target signaling; determining whether the verification string matches the visa string, if so, the target signaling is valid; if not, the target signaling is invalid.

[0086] In a specific implementation, the target key number is parsed from the payload string of the target signaling, and then the target key corresponding to the target key number is screened out from the multiple authentication keys stored in the service provider module according to the target key number; the target encryption algorithm corresponding to the target signaling is parsed from the header string of the target signaling, and the target encryption algorithm and the target key are used to re-encrypt the header string and payload string of the target signaling to verify the validity of the target signaling.

[0087] Here, if the target signaling has not been tampered with during the transmission process, then the target key number carried in the target signaling corresponds to the target key in the authentication key stored in the service provider module and is consistent with the target key when the identity authentication module encrypts the target signaling. The target key and the target encryption algorithm parsed from the target signaling are used to re-encrypt the header string and payload string of the target signaling. The result should be consistent with the visa string in the target signaling. If it is inconsistent, it means that the target signaling has been intercepted or tampered with during the transmission process, and the target signaling is invalid. The service provider module does not provide services to users to ensure information security.

[0088] An authentication method provided by the embodiment of the present disclosure is applied to a server including an identity authentication module and a service provision module, by receiving a plurality of randomly generated authentication keys and corresponding key numbers; storing each authentication key and corresponding key number in the identity authentication module and the service provision module respectively; controlling the identity authentication module to receive a login request sent by a user, and selecting a target key from the authentication key; generating a target signaling according to the login request and the target key encryption, and returning the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key; controlling the service provision module to receive an access request sent by the user carrying the target signaling; parsing the target key number from the target signaling, and determining the target key corresponding to the target key number; and providing the user with a service corresponding to the access request if the target signaling is verified to be valid according to the target key. The security of signaling authentication can be improved.

[0089] See also Figure 2 FIG. 2 is a flowchart of another authentication method provided by an embodiment of the present disclosure, wherein the method includes steps S201 to S206, wherein:

[0090] S201. Receive a plurality of randomly generated authentication keys and corresponding key numbers.

[0091] S202: Store each authentication key and the corresponding key number in the identity authentication module and the service provision module respectively.

[0092] S203, control the identity authentication module, receive the login request sent by the user, select the target key from the authentication key; generate a target signaling according to the login request and the encryption of the target key, and return the target signaling to the user, wherein the target signaling carries the target key number corresponding to the target key.

[0093] S204, control the service provision module to receive the access request sent by the user and carrying the target signaling; parse the target key number from the target signaling, and determine the target key corresponding to the target key number; if the target signaling is valid according to the target key, provide the user with the service corresponding to the access request.

[0094] Here, steps S201 to S204 are substantially the same as steps S101 to S104, have the same implementation methods and can achieve the same technical effects, and will not be described in detail herein.

[0095] S205: Delete the target key and the corresponding target key number stored in the identity authentication module and the service provision module.

[0096] In a specific implementation, for the authentication key and the corresponding key number that have been used, the server can delete the target key and the corresponding target key number that have been used and stored in the identity authentication module and the service provision module to save storage space and avoid the problem of reduced security due to key reuse.

[0097] S206: Continue to receive the authentication key and the corresponding key number, and store the newly received authentication key and the corresponding key number in the identity authentication module and the service provision module respectively.

[0098] In a specific implementation, the server may continuously receive authentication keys and their corresponding key numbers randomly generated according to a preset generation cycle to replenish the authentication keys consumed after each authentication.

[0099] An authentication method provided by the embodiment of the present disclosure is applied to a server including an identity authentication module and a service provision module, by receiving a plurality of randomly generated authentication keys and corresponding key numbers; storing each authentication key and corresponding key number in the identity authentication module and the service provision module respectively; controlling the identity authentication module to receive a login request sent by a user, and selecting a target key from the authentication key; generating a target signaling according to the login request and the target key encryption, and returning the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key; controlling the service provision module to receive an access request sent by the user carrying the target signaling; parsing the target key number from the target signaling, and determining the target key corresponding to the target key number; and providing the user with a service corresponding to the access request if the target signaling is verified to be valid according to the target key. The security of signaling authentication can be improved.

[0100] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0101] Based on the same inventive concept, an authentication and verification device corresponding to the authentication and verification method is also provided in the embodiment of the present disclosure. Since the principle of solving the problem by the device in the embodiment of the present disclosure is similar to the above-mentioned authentication and verification method in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0102] See also Figure 3 , Figure 3 FIG. 3 is a schematic diagram of a structure of an authentication device 300 provided in an embodiment of the present disclosure. Figure 3 As shown in , the authentication device 300 provided in the embodiment of the present disclosure is applied to a server including an identity authentication module and a service providing module, including:

[0103] A receiving module 310, configured to receive a plurality of randomly generated authentication keys and corresponding key numbers;

[0104] The storage module 320 is used to store each of the authentication keys and the corresponding key numbers in the identity authentication module and the service provision module respectively;

[0105] The first control module 330 is used to control the identity authentication module, receive a login request sent by a user, select a target key from the authentication key; generate a target signaling according to the login request and the target key encryption, and return the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key;

[0106] The second control module 340 is used to control the service provision module, receive the access request sent by the user and carrying the target signaling; parse the target key number from the target signaling, and determine the target key corresponding to the target key number; if the target signaling is valid according to the target key, provide the user with the service corresponding to the access request.

[0107] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0108] An authentication device provided by the embodiment of the present disclosure is applied to a server including an identity authentication module and a service provision module, by receiving a plurality of randomly generated authentication keys and corresponding key numbers; storing each authentication key and corresponding key number in the identity authentication module and the service provision module respectively; controlling the identity authentication module to receive a login request sent by a user, and selecting a target key from the authentication key; generating a target signaling according to the login request and the target key encryption, and returning the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key; controlling the service provision module to receive an access request sent by the user carrying the target signaling; parsing the target key number from the target signaling, and determining the target key corresponding to the target key number; and providing the user with a service corresponding to the access request if the target signaling is verified to be valid according to the target key. The security of signaling authentication can be improved.

[0109] Corresponds to Figure 1 and Figure 2 The authentication method in the present disclosure also provides an electronic device 400, such as Figure 4 FIG. 4 is a schematic diagram of the structure of an electronic device 400 provided in an embodiment of the present disclosure, including:

[0110] Processor 41, memory 42, and bus 43; memory 42 is used to store execution instructions, including memory 421 and external memory 422; memory 421 here is also called internal memory, which is used to temporarily store operation data in processor 41 and data exchanged with external memory 422 such as hard disk. Processor 41 exchanges data with external memory 422 through memory 421. When the electronic device 400 is running, the processor 41 communicates with the memory 42 through bus 43, so that the processor 41 executes Figure 1 and Figure 2 The steps of the authentication method in .

[0111] The present disclosure also provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the steps of the authentication method described in the above method embodiment are executed. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0112] The present disclosure also provides a computer program product, which includes computer instructions. When the computer instructions are executed by a processor, the steps of the authentication method described in the above method embodiment can be executed. For details, please refer to the above method embodiment, which will not be repeated here.

[0113] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is implemented as a computer storage medium. In another optional embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0114] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0115] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0116] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0117] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0118] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. An authentication method, applied to a server including an identity authentication module and a service provision module, characterized in that: The method comprises: Receiving a plurality of randomly generated authentication keys and corresponding key numbers; storing each authentication key and the corresponding key number in the identity authentication module and the service provision module respectively; Control the identity authentication module, receive a login request sent by a user, select a target key from the authentication key; generate a target signaling according to the login request and the target key encryption, and return the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key; Control the service provision module to receive the access request sent by the user and carrying the target signaling; parse the target key number from the target signaling and determine the target key corresponding to the target key number; if the target signaling is verified to be valid according to the target key, provide the user with the service corresponding to the access request; The target signaling is generated based on the following method: Controlling the identity authentication module to parse the login request, and determining user information corresponding to the user according to the login request; Encode the user information and the target key number to generate a payload character string of the target signaling; Defining a preset target encryption algorithm for the target signaling, and encoding the algorithm type corresponding to the target encryption algorithm to generate a header string of the target signaling; Encrypt the header string and the payload string respectively according to the target encryption algorithm and the target key to generate a visa string of the target signaling; The header character string, the payload character string and the visa character string are sequentially connected in series to generate the target signaling.

2. The method according to claim 1, characterized in that Verify the target signaling based on the following method: Control the service providing module to parse the target key number from the payload string of the target signaling; parse the target encryption algorithm corresponding to the target signaling from the header string of the target signaling; According to the target key number, the target key corresponding to the target key number is screened out from the multiple authentication keys and the corresponding key numbers stored in the service providing module; According to the target key and the target encryption algorithm, re-encrypt the header string and the payload string of the target signaling respectively to generate a verification string of the target signaling; Determine whether the verification string matches the visa string, if so, the target signaling is valid; If there is no match, the target signaling is invalid.

3. The method according to claim 1, characterized in that In the control module for providing the service, receiving an access request sent by the user and carrying the target signaling; parsing the target key number from the target signaling, and determining a target key corresponding to the target key number; If the target signaling is verified to be valid according to the target key, after providing the user with the service corresponding to the access request, the method further includes: Deleting the target key and the corresponding target key number stored in the identity authentication module and the service provision module; Continue to receive the authentication key and the corresponding key number, and store the newly received authentication key and the corresponding key number in the identity authentication module and the service provision module respectively.

4. The method according to claim 1, characterized in that: The authentication key is generated by a preset key generation server according to a preset key generation period and is configured with a corresponding key number.

5. An authentication device, applied to a server including an identity authentication module and a service provision module, characterized in that: The device comprises: A receiving module, used for receiving a plurality of randomly generated authentication keys and corresponding key numbers; A storage module, used to store each of the authentication keys and the corresponding key numbers in the identity authentication module and the service provision module respectively; A first control module is used to control the identity authentication module, receive a login request sent by a user, select a target key from the authentication key; generate a target signaling according to the login request and the target key encryption, and return the target signaling to the user, wherein the target signaling carries a target key number corresponding to the target key; A second control module is used to control the service providing module to receive an access request sent by the user and carrying the target signaling; parse the target key number from the target signaling and determine the target key corresponding to the target key number; if the target signaling is verified to be valid according to the target key, provide the user with the service corresponding to the access request; The first control module is specifically used for: Controlling the identity authentication module to parse the login request, and determining user information corresponding to the user according to the login request; Encode the user information and the target key number to generate a payload character string of the target signaling; Defining a preset target encryption algorithm for the target signaling, and encoding the algorithm type corresponding to the target encryption algorithm to generate a header string of the target signaling; Encrypt the header string and the payload string respectively according to the target encryption algorithm and the target key to generate a visa string of the target signaling; The header character string, the payload character string and the visa character string are sequentially connected in series to generate the target signaling.

6. The device according to claim 5, characterized in that The second control module is specifically used for: Control the service providing module to parse the target key number from the payload string of the target signaling; parse the target encryption algorithm corresponding to the target signaling from the header string of the target signaling; According to the target key number, the target key corresponding to the target key number is screened out from the multiple authentication keys and the corresponding key numbers stored in the service providing module; According to the target key and the target encryption algorithm, re-encrypt the header string and the payload string of the target signaling respectively to generate a verification string of the target signaling; Determine whether the verification string matches the visa string, if so, the target signaling is valid; If there is no match, the target signaling is invalid.

7. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the authentication method as described in any one of claims 1 to 4 are performed.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the authentication method according to any one of claims 1 to 4 are executed.

Images