A method for generating an access token and a method for recognizing an access token.

Abstract

This invention provides a method for generating and identifying access tokens. The method for generating an access token includes: a server first receiving user information sent by a client; then performing B-encoding on the user information and time information for the token to generate a first target access token; and finally returning the first target access token to the client. This invention achieves a B-encoding-based encoding method, reducing the storage space and network transmission bandwidth required for the access token; effectively saving data storage overhead and reducing network transmission bandwidth pressure. Furthermore, the introduction of a timestamp concept in B-encoding ensures that the access token contains the time information required for JWT issuance.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, and in particular to a method for generating an access token and a method for identifying an access token. Background Technology

[0002] The native HTTP (Hypertext Transfer Protocol) request is a stateless network request protocol, so the server cannot determine the identity of the user making the request or the login status based on the user's request.

[0003] To enable user login via HTTP requests, the main methods currently used include server-side sessions and token-based JWT (JSON Web Token) implementations. JWT, in particular, is widely used in high-concurrency scenarios because it does not require storing user information on the server, exhibiting excellent distributed and stateless characteristics.

[0004] However, the current JWT method uses a combination of JSON format and base64 encoding, resulting in a large storage space and requiring significant network bandwidth. This makes it impractical for scenarios demanding high responsiveness and low bandwidth, such as the Internet of Things (IoT). Summary of the Invention

[0005] In view of the above problems, a method for generating an access token and a method for identifying an access token are proposed to overcome or at least partially solve the above problems, including:

[0006] A method for generating an access token, the method comprising:

[0007] Receive user information sent by the client;

[0008] The user information and the time information for the token are encoded using Bencoding to generate a first target access token;

[0009] Return the first target access token to the client.

[0010] Optionally, the step of performing Bencoding B-encoding on the user information and the time information for the token to generate the first target access token includes:

[0011] Generate the first target's header portion;

[0012] The user information and the time information are B-encoded to generate a first target payload portion;

[0013] Based on the first target header and the first target payload, a first target signature string is generated, and the first target signature string is B-encoded to generate the first target signature part;

[0014] A first target access token is generated based on the first target header portion, the first target payload portion, and the first target signature portion.

[0015] Optionally, the step of B-encoding the user information and the time information to generate the first target payload portion includes:

[0016] The user information is B-encoded to generate the first payload portion;

[0017] The time information is arranged in big-endian order as a 32-bit first target integer, and the first target integer is encoded using base64 to generate a first string;

[0018] Remove the last two bytes of the first string to obtain the second string;

[0019] The second string is B-encoded to generate the second payload portion;

[0020] The first target load portion is obtained based on the first load portion and the second load portion.

[0021] Optionally, the user information includes an integer string that uniquely identifies the user and other information. The step of B-encoding the user information to generate a first payload portion includes:

[0022] The other information is B-encoded to generate a third string;

[0023] The integer string is arranged in big-endian order to form a second target integer of 64 bits, and the second target integer is base64 encoded to generate a fourth string;

[0024] Remove the last byte of the fourth string and perform B encoding to generate the fifth string;

[0025] The first payload portion is generated based on the third string and the fifth string.

[0026] Optionally, generating the first target signature string based on the first target header portion and the first target payload portion includes:

[0027] Concatenate the first target header portion and the first target payload portion into a sixth string;

[0028] The sixth string is signed using a preset encryption algorithm to generate the seventh string;

[0029] The seventh string is base64 encoded to generate the first target signature string.

[0030] This invention also provides a method for identifying access tokens, the method comprising:

[0031] When a service request containing a second target access token is received from a client, the second target access token is decoded using B encoding to obtain the second target header, the second target payload, and the second target signature.

[0032] Verification is performed based on the second target header portion, the second target payload portion, and the second target signature portion;

[0033] When the verification passes, the corresponding user information is obtained from the second target load portion.

[0034] This invention also provides a server.

[0035] The server is configured to receive user information sent by the client; perform B-encoding on the user information and B-encoding on the time information of the token to generate a first target access token; and return the first target access token to the client.

[0036] The server is further configured to, when receiving a service request from a client that includes a second target access token, perform a B-encoding decoding process on the second target access token to obtain a second target header, a second target payload, and a second target signature; perform verification based on the second target header, the second target payload, and the second target signature; and when the verification passes, obtain the corresponding user information from the second target payload.

[0037] This invention also provides an access token generation apparatus, the apparatus comprising:

[0038] The receiving module is used to receive user information sent by the client;

[0039] The encoding module is used to perform Bencoding B encoding on the user information and the time information for the token to generate a first target access token;

[0040] The return module is used to return the first target access token to the client.

[0041] Optionally, the encoding module includes:

[0042] The header generation submodule allows users to generate the first target header portion.

[0043] The load generation submodule is used to perform B-encoding on the user information and the time information to generate a first target load portion;

[0044] The signature generation submodule is used to generate a first target signature string based on the first target header and the first target payload, and to perform B encoding on the first target signature string to generate a first target signature part;

[0045] The token generation submodule is used to generate a first target access token based on the first target header portion, the first target payload portion, and the first target signature portion.

[0046] Optionally, the load generation submodule is configured to: B-encode the user information to generate a first load portion; arrange the time information in big-endian order into a 32-bit first target integer, and encode the first target integer using base64 to generate a first string; remove the last two bytes of the first string to obtain a second string; B-encode the second string to generate a second load portion; and obtain the first target load portion based on the first load portion and the second load portion.

[0047] Optionally, the load generation submodule is configured to perform B-encode on the other information to generate a third string; arrange the integer string in big-endian order into a 64-bit second target integer, and perform base64 encoding on the second target integer to generate a fourth string; remove the last byte of the fourth string and perform B-encode on it to generate a fifth string; and generate the first load portion based on the third string and the fifth string.

[0048] Optionally, the signature generation submodule is used to concatenate the first target header portion and the first target payload portion into a sixth string; use a preset encryption algorithm to sign the sixth string to generate a seventh string; and perform base64 encoding on the seventh string to generate the first target signature string.

[0049] This invention also provides an access token identification device, the device comprising:

[0050] The decoding module is used to perform a B-encoding decoding process on the second target access token when a service request containing the second target access token is received from the client, to obtain the second target header, the second target payload, and the second target signature.

[0051] The verification module is used to verify the second target header, the second target payload, and the second target signature.

[0052] The user information acquisition module is used to acquire the corresponding user information from the second target load portion when the verification passes.

[0053] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for generating or recognizing access tokens.

[0054] The embodiments of the present invention have the following advantages:

[0055] In this embodiment of the invention, the server first receives user information sent by the client; then, it performs B-encoding on the user information and the time information for the token to generate a first target access token; finally, it returns the first target access token to the client. This embodiment of the invention implements a B-encoding-based encoding method, reducing the storage space required for the access token and the network transmission bandwidth it occupies; effectively saving data storage overhead and reducing network transmission bandwidth pressure; and the introduction of the timestamp concept in B-encoding ensures that the access token contains the time information required for JWT issuance. Attached Figure Description

[0056] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is a flowchart illustrating the steps of an access token generation method according to an embodiment of the present invention;

[0058] Figure 2 This is a flowchart of another method for generating an access token according to an embodiment of the present invention;

[0059] Figure 3 This is a flowchart illustrating the steps of another method for generating an access token according to an embodiment of the present invention.

[0060] Figure 4 This is a flowchart illustrating the steps of an access token identification method according to an embodiment of the present invention;

[0061] Figure 5 This is a schematic diagram of the existing JWT certification process;

[0062] Figure 6This is a schematic diagram of a JWT authentication process according to an embodiment of the present invention;

[0063] Figure 7 This is a schematic diagram of the structure of a server according to an embodiment of the present invention;

[0064] Figure 8 This is a structural block diagram of an access token generation device according to an embodiment of the present invention;

[0065] Figure 9 This is a structural block diagram of an access token identification device according to an embodiment of the present invention. Detailed Implementation

[0066] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0067] Currently, existing JWTs use JSON and Base64 encoding for definition. JSON is a syntax definition for defining data structures derived from the JavaScript language, used to replace the more expensive XML format definition, but it still has a relatively large data overhead. Base64 is a data encoding format that maps source data to other data structures through mapping algorithms, but it also generates about 30% additional space overhead.

[0068] For example, the same string and integer are stored in JSON format as follows:

[0069] {

[0070] "name":"test",

[0071] "project":"hello world",

[0072] "length":1234,

[0073] "score":-1234,

[0074] }

[0075] The curly braces, double quotes, and commas in the JSON format add unnecessary space overhead, making the JSON data larger. After base64 encoding, the above data becomes eyJuYW1lIjogInRlc3QiLCAicHJvamVjdCI6ICJoZWxsb3dvcmxkIiwgImxlbmd0aCI6IDEyMzQsICJzY29yZSI6IDEyMzR9.

[0076] It is 24 bytes longer than the original 72 bytes of JSON data, which is about 33% more space overhead. However, this extra overhead is not related to the JWT authentication mechanism.

[0077] B-encoding is a format definition used in the BitTorrent transport protocol for storing transmitted metadata files. It supports data types including strings, integers, lists, and dictionaries. By definition, it is compatible with JSON format, but its space overhead is more efficient than JSON. Therefore, this embodiment of the invention employs B-encoding, which is compatible with existing JWT authentication mechanisms, to reduce the encoding space overhead of JWT.

[0078] Reference Figure 1 The diagram illustrates a flowchart of a method for generating an access token according to an embodiment of the present invention, which may include the following steps:

[0079] Step 101: Receive user information sent by the client.

[0080] The user information may include multiple string-type information for the user, such as username, user ID (identity document), etc., but this embodiment of the invention does not limit this.

[0081] When a client needs to obtain an access token, it can first send user information to the server.

[0082] Step 102: Encode the user information and the time information for the token using Bencoding to generate the first target access token.

[0083] The first target access token can be an access token stored in Bencoding format, and the first target access token can refer to a JWT token.

[0084] After receiving user information, the server can generate a corresponding access token; however, current technology uses a combination of JSON format and base64 encoding, which requires a large storage space and consumes a significant amount of network bandwidth. This is not very practical in scenarios requiring high responsiveness and low bandwidth, such as the Internet of Things (IoT).

[0085] To reduce the storage space required for the obtained access token and the network transmission traffic it occupies, the user information can be Bencoded.

[0086] The rules of Bencoding are as follows:

[0087] String type: <string length>:<string>

[0088] For example:

[0089] 5:hello represents the string "hello".

[0090] 6:telecom represents the string "telecom".

[0091] Integer type: i<integer>e

[0092] It starts with the string i, ends with e, and the middle is the string representation of an integer.

[0093] For example:

[0094] i369e represents the number 369.

[0095] i803110e represents the number 803110.

[0096] List type: l<Bencoded data type>e

[0097] It starts with the character l, ends with e, and contains several Bencoded data formats in the middle, which can be strings, integers, lists, dictionaries, etc. data, listed in sequence, without a quantity limit.

[0098] For example:

[0099] li803110e6:telecome represents the list [803110, "telecom"]

[0100] Dictionary type: d<Bencoded string><Bencoded type>e

[0101] It starts with the character d, ends with e, and in the middle are pairs of key values represented by Bencoded strings and Bencoded data types as values.

[0102] For example:

[0103] d6:telecomi803110e5:hello8:dizhie represents the dictionary {"telecom":803110, "hello":"dizhi"}

[0104] Compared to the standard JWT method, encoding using B encoding can effectively save data storage overhead and reduce network transmission bandwidth pressure.

[0105] However, the issuance of JWTs involves the concept of timestamps in many places, while traditional B encoding does not have a format definition for timestamps.

[0106] Therefore, after receiving user information, the server can obtain the time information for the access token, so that the concept of a timestamp is introduced in B encoding; the time information may include the issuance time and the token validity period, which is not limited in this embodiment of the invention.

[0107] Specifically, when performing B-encoding on user information, time information for the access token can also be B-encoded; thus, based on the strings obtained from the two encodings, the first target access token stored in B-encoding format is obtained.

[0108] Step 103: Return the first target access token to the client.

[0109] After generating the first target access token, the server can return it to the corresponding client. The client can then save this first target access token in a cookie, and automatically include it in subsequent requests to the server for identity verification.

[0110] Taking user yangmei as an example, the following is the data content of the payload that records information in JWT.

[0111] {

[0112] "sub":1486170625572139008,

[0113] "iss":"telecom",

[0114] "name":"yangmei",

[0115] "iat":1643065790981,

[0116] "nbf":1643065800981

[0117] }

[0118] If using JSON format with base64 encoding, the access token is:

[0119] eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjE0ODYxNzA2MjU1NzIxMzkwMDAsImlzcyI6InRlbGVjb20iLCJuYW1lIjoieW FuZ21laSIsImlhdCI6MTY0MzA2NTc5MDk4MSwibmJmIjoxNjQzMDY1ODAwOTgxfQ.VJbVtYOLhaKx5OviXbZpGmWGQa5zEIt5r4PKbGe-2JA

[0120] The JWT format content occupies 215 bytes, of which the JSON format payload occupies 109 bytes.

[0121] The access token obtained using B encoding is:

[0122] d3:subi1486170625572139008e3:iss6:telecom4:name7:yangmei3:iati1643065790981e3:nbfi1643065800981ee

[0123] It is 97 bytes long. This reduces storage space by approximately 11% compared to a payload in JSON format.

[0124] In this embodiment of the invention, the server first receives user information sent by the client; then, it performs B-encoding on the user information and the time information for the token to generate a first target access token; finally, it returns the first target access token to the client. This embodiment of the invention implements a B-encoding-based encoding method, reducing the storage space required for the access token and the network transmission bandwidth it occupies; effectively saving data storage overhead and reducing network transmission bandwidth pressure; and the introduction of the timestamp concept in B-encoding ensures that the access token contains the time information required for JWT issuance.

[0125] Reference Figure 2 The diagram illustrates a flowchart of another method for generating an access token according to an embodiment of the present invention, which may include the following steps:

[0126] Step 201: Receive user information sent by the client.

[0127] When a client needs to obtain an access token, it can first send user information to the server.

[0128] Step 202: Generate the first target head portion.

[0129] The first target header portion can be used to describe the metadata of the JWT.

[0130] After receiving user information, the server can generate the first target header based on the signature algorithm and the token attributes.

[0131] Specifically, when generating the first target header, the first target header can be generated and stored in Bencoding format according to the rules of JWT.

[0132] For example, if the signature algorithm is HS2563 and the token attribute is JWTe, then the first target header part can be generated in B-encoding according to the rules of JWT: d3:alg5:HS2563:typ3:JWTe.

[0133] Step 203: Perform B-coding on the user information and time information to generate the first target payload portion.

[0134] The first target payload portion can be used to store the actual data that needs to be transmitted.

[0135] When generating the first target header, the server can B-encode the received user information and the time information for the access token to generate the first target payload stored in Bencoding format.

[0136] For example: User information includes: Username yangmei, User ID number 1486170625572139008; Time information includes: Issuance time is 13:32:53 on January 12, 2022, Token validity period is from 14:13:32 on January 12, 2022 to 11:12:13 on February 14, 2022; Issuing agency is telecom.

[0137] Then, the above user information, as well as the above time information and issuing agency, can be B-coded to generate the first target payload part: d3:subxiFJ / wT1TY8AA4:name7:yangmei3:iatxtYd7YhQ3:nbfxtYd7iDA3:expxtYgo5DQ3:iss7:telecome.

[0138] Step 204: Generate a first target signature string based on the first target header and the first target payload, and perform B encoding on the first target signature string to generate the first target signature part.

[0139] The first target signature portion can be a signature of the first target header portion and the first target payload portion, used to prevent data tampering.

[0140] After generating the first target header and the first target payload, the server can generate the first target signature string based on the first target header and the first target payload.

[0141] Then, the first target signature string can be B-encoded to generate the first target signature string stored in Bencoding format.

[0142] In one embodiment of the present invention, the first target signature string can be implemented through the following sub-steps:

[0143] Sub-step 11: Concatenate the header and payload of the first target into the sixth string.

[0144] First, the header and payload of the first target can be concatenated together to obtain the sixth string.

[0145] For example, if the header of the first target is d3:alg5:HS2563:typ3:JWTe, and the payload of the first target is d3:subxiFJ / wT1TY8AA4:name7:yangmei3:iatxtYd7YhQ3:nbfxtYd7iDA3:expxtYgo5DQ3:iss7:telecome, then the header and payload of the first target can be concatenated to obtain the sixth string d3:alg5:HS2563:typ3:JWTed3:subxiFJ / wT1TY8AA4:name7:yangmei3:iatxtYd7YhQ3:nbfxtYd7iDA3:expxtYgo5DQ3:iss7:telecome.

[0146] Sub-step 12: Use a preset encryption algorithm to sign the sixth string and generate the seventh string.

[0147] After generating the sixth string, the server can use a preset encryption algorithm to sign the sixth string to generate the encrypted seventh string. The preset encryption algorithm can be set according to the actual situation, such as the signature HMAC algorithm. This embodiment of the invention does not limit this.

[0148] Sub-step 13: Encode the seventh string using base64 to generate the first target signature string.

[0149] After obtaining the seventh string, the server can perform base64 encoding on the seventh string to generate the first target signature string.

[0150] For example: The sixth string d3:alg5:HS2563:typ3:JWTed3:subxiFJ / wT1TY8AA4:name7:yangmei3:iatxtYd7YhQ3:nbfxtYd7iDA3:expxtYgo5DQ3:iss7:telecome is signed using the HMAC signature algorithm to generate the seventh string. Then, the seventh string is base64 encoded to generate the first target signature string lf4+mJ1Q19g35q4CBGyCc22ZW+KgQKMORTWW2lMSgnY=.

[0151] Step 205: Generate a first target access token based on the first target header, the first target payload, and the first target signature.

[0152] After obtaining the first target header, first target payload, and first target signature, the server can combine the first target header, first target payload, and first target signature to obtain the first target access token.

[0153] For example: the header of the first target is d3:alg5:HS2563:typ3:JWTed, the payload of the first target is 3:subxiFJ / wT1TY8AA4:name7:yangmei3:iatxtYd7YhQ3:nbfxtYd7iDA3:expxtYgo5DQ3:iss7:telecome, and the signature of the first target is lf4+mJ1Q19g35q4CBGyCc22ZW+KgQKMORTWW2lMSgnY=; The header of the first target... Combining the first target payload portion and the first target signature portion yields the first target access token d3:alg5:HS2563:typ3:JWTed3:subxiFJ / wT1TY8AA4:name7:yangmei3:iatxtYd7YhQ3:nbfxtYd7iDA3:expxtYgo5DQ3:iss7:telecome44:lf4+mJ1Q19g35q4CBGyCc22ZW+KgQKMORTWW2lMSgnY=.

[0154] If a JSON format combined with base64 encoding is used, the following access token will be generated: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjE0ODYxNzA2MjU1NzIxMzkwMDAsImlzcyI6InRlbGVjb20iLCJuYW1lIjoieWFuZ21laSIsImlhdCI6MTY0MTk5NDM3MzAwMCwibmJmIjoxNjQxOTk2ODEyMDAwLCJleHAiOjE2NDQ4MzcxMzMwMDB9.aF-e42GepocqnHPC6mO1IYe0pPLzc32wVr3OvUewwgM.

[0155] A comparison shows that the access token generated by the method of the present invention is 160 bytes, while the access token generated by combining JSON format with base64 encoding is 241 bytes; with the same data, the access token generation method of the present invention has a data compression rate of 33.6%.

[0156] Step 206: Return the first target access token to the client.

[0157] After generating the first target access token, the server can return it to the corresponding client. The client can then save this first target access token in a cookie, and automatically include it in subsequent requests to the server for identity verification.

[0158] In this embodiment of the invention, the server first receives user information sent by the client; then generates a first target header; and performs B-encoding on the user information and time information to generate a first target payload; and generates a first target signature string based on the first target header and the first target payload, and performs B-encoding on the first target signature string to generate a first target signature portion; then generates a first target access token based on the first target header, the first target payload, and the first target signature portion; and finally returns the first target access token to the client. This embodiment of the invention implements a B-encoding-based encoding method, reducing the storage space required for the access token and the network transmission traffic it occupies; effectively saving data storage overhead and reducing network transmission bandwidth pressure; and the introduction of the timestamp concept in B-encoding ensures that the access token contains the time information required for JWT issuance.

[0159] Reference Figure 3The diagram illustrates a flowchart of another method for generating an access token according to an embodiment of the present invention, which may include the following steps:

[0160] Step 301: Receive user information sent by the client.

[0161] When a client needs to obtain an access token, it can first send user information to the server.

[0162] Step 302: Generate the first target head portion.

[0163] After receiving user information, the server can generate the first target header based on the signature algorithm and the token attributes.

[0164] Specifically, when generating the first target header, the first target header can be generated and stored in Bencoding format according to the rules of JWT.

[0165] Step 303: B-encode the user information to generate the first payload.

[0166] When generating the first target header, the server can B-encode the received user information and the time information for the access token to generate the first target payload stored in Bencoding format.

[0167] In one embodiment of the present invention, the user information includes an integer string that uniquely identifies the user and other information. The first payload portion can be generated through the following sub-steps:

[0168] Sub-step 21: B-encode the other information to generate the third string.

[0169] First, the other information can be B-encoded to generate the third string.

[0170] For example, if other information includes the username yangmei, then the username yangmei can be B-encoded to generate a third string name7:yangmei3 stored in Bencoding format.

[0171] Sub-step 22: Arrange the integer string into a second target integer with big-endian order (64 bits), and perform base64 encoding on the second target integer to generate the fourth string.

[0172] In practical applications, JWT needs to carry a 64-bit number as a unique identifier for the user. B encoding in JWT applications requires multiple data conversions between strings and large integers, which can result in significant system and network overhead in high-concurrency and low-memory environments (such as IoT devices).

[0173] Therefore, when processing integer strings, the present invention can first arrange the integer strings in big-endian order into a second target integer of 64 bits; thereby reducing the overhead pressure of decoding and encoding integer strings, and significantly reducing the storage space overhead and bandwidth overhead during transmission.

[0174] Then, the second target integer is base64 encoded to generate the fourth string.

[0175] As an example, big-endian is a computer format used to represent numbers exceeding one byte. Commonly used Intel processors typically use little-endian, while ARM processors used in network transmission and mobile devices generally use big-endian. Big-endian means that the most significant byte of the integer is stored first, followed by the least significant byte. For example, a 32-bit integer 0xaa55 is represented as [0xaa, 0x55] in big-endian, and [0x55, 0xaa] in little-endian.

[0176] Sub-step 23: Remove the last byte of the fourth string and perform B encoding to generate the fifth string.

[0177] The last byte of the fourth string is "=", which adds unnecessary space overhead; therefore, after obtaining the fourth string, the last byte "=" can be removed. Then, the fourth string with the last byte removed is encoded to generate the fifth string stored in Bencoding format.

[0178] Specifically, you can start with the character "xi" and then append a fourth string (with the last byte removed) to get a fifth string: xi<fourth string with the last byte removed>; where the fifth string can represent an integer string.

[0179] As an example, during decoding, an "=" can be added to the end of the fifth string, then it can be decoded using base64 and converted into the native integer type according to the big-endian representation rules.

[0180] Sub-step 24: Generate the first payload part based on the third and fifth strings.

[0181] After obtaining the third string generated for other information and the fifth string generated for integer strings, the server can concatenate the third string and the fifth string to generate the first payload.

[0182] Step 304: Arrange the time information into a 32-bit first target integer in big-endian order, and encode the first target integer using base64 to generate the first string.

[0183] For encoding time information, the time information can first be arranged in big-endian order as a first target integer of 32 bits, and then the first target integer can be encoded using base64 to generate the first string.

[0184] Specifically, the number of seconds from Greenwich Mean Time 00:00:00 on January 1, 1970 to the corresponding time can be arranged in big-endian order as a first target integer of 32 bits.

[0185] Then, the server can use base64 to encode the first target integer and obtain the first string.

[0186] Step 305: Remove the last two bytes of the second load portion to obtain the second string.

[0187] The last byte of the first string is "==", which adds unnecessary space overhead. Therefore, after obtaining the first string, the last two bytes "==" can be removed to generate the second string.

[0188] Step 306: B-encode the second string to generate the second payload part.

[0189] Then, the second string can be B-encoded to generate the second payload portion stored in Bencoding format.

[0190] Specifically, it can start with the character "xt" and be followed by a second string to obtain the second payload: xt<second string>; where the second payload can represent a timestamp; this timestamp has a direct mapping relationship with the computer's internal timestamp and can be directly compared with the system clock; thus, the system overhead of date encoding and decoding can be reduced.

[0191] As an example, during decoding, the character "==" can be added to the end of the second payload, then decoded using base64, and converted into a local integer according to the big-endian representation rules to obtain the timestamp of the corresponding time.

[0192] Step 307: Obtain the first target load portion based on the first load portion and the second load portion.

[0193] After obtaining the first load portion and the second load portion, the server can concatenate the first load portion and the second load portion to obtain the first target load portion.

[0194] Step 308: Generate a first target signature string based on the first target header and the first target payload, and B-encode the first target signature string to generate the first target signature part.

[0195] After generating the first target header and the first target payload, the server can generate the first target signature string based on the first target header and the first target payload.

[0196] Then, the first target signature string can be B-encoded to generate the first target signature string stored in Bencoding format.

[0197] Step 309: Generate a first target access token based on the first target header, the first target payload, and the first target signature.

[0198] After obtaining the first target header, first target payload, and first target signature, the server can combine the first target header, first target payload, and first target signature to obtain the first target access token.

[0199] Step 310: Return the first target access token to the client.

[0200] After generating the first target access token, the server can return it to the corresponding client. The client can then save this first target access token in a cookie, and automatically include it in subsequent requests to the server for identity verification.

[0201] In this embodiment of the invention, the server first receives user information sent by the client; then generates a first target header; and performs B-encoding on the user information to generate a first payload; and arranges the time information in big-endian order into a 32-bit first target integer, and encodes the first target integer using base64 to generate a first string; and removes the last two bytes of the second payload to obtain a second string; and uses xt<second string> as the second payload; and obtains a first target payload based on the first payload and the second payload; then generates a first target signature string based on the first target header and the first target payload, performs B-encoding on the first target signature string to generate a first target signature part, and generates a first target access token based on the first target header, the first target payload, and the first target signature part; finally, returns the first target access token to the client. Through the embodiments of the present invention, a B-encoding-based encoding method is implemented, which reduces the storage space required for access tokens and the network transmission traffic occupied; effectively saves data storage overhead and reduces network transmission bandwidth pressure; and the concept of timestamp is introduced into B-encoding, which can ensure that the access token contains the time information required for JWT issuance.

[0202] Furthermore, this timestamp has a direct mapping relationship with the computer's internal timestamp and can be directly compared with the system clock; thus, the system overhead of date encoding and decoding can be reduced.

[0203] Reference Figure 4 The diagram illustrates a flowchart of an access token identification method according to an embodiment of the present invention, which may include the following steps:

[0204] Step 401: When a service request containing a second target access token is received from the client, the second target access token is decoded by B encoding to obtain the second target header, the second target payload, and the second target signature.

[0205] The business request can be used by the client to request business data from the server; the business request may include a second target access token, or other information used to request business data.

[0206] The second target access token can be an access token stored in the client or pre-generated by the server according to the aforementioned access token generation method. When requesting business data, the client can include this second target access token in the request to verify its identity.

[0207] When the server receives a service request from the client that includes a second target access token, it can first perform a B-encoding decoding process on the second target access token to obtain the second target header, the second target payload, and the second target signature.

[0208] Specifically, the second target access token can be first decoded using B-encoding to obtain the header portion of the second target; then, the remaining data of the second target access token can be decoded using B-encoding to obtain the payload portion of the second target.

[0209] Then, the remaining data of the second target access token is decoded using B encoding to obtain the second target signature.

[0210] Step 402: Verify based on the second target header, the second target payload, and the second target signature.

[0211] After obtaining the second target header, the second target payload, and the second target signature, the signature algorithm and token attributes can be obtained from the second target header. Then, the string concatenated from the second target header and the second target payload can be signed according to the signature algorithm to obtain the current signature string.

[0212] Then, compare the current signature string with the content of the second target signature part. If they do not match, it means that the client's second target access token has been modified. If they match, it means that the client's second target access token is the access token issued by the server earlier and has not been modified.

[0213] Step 403: When the verification passes, obtain the corresponding user information from the second target load section.

[0214] When the current signature string matches the content of the second target signature part, it indicates that the verification is successful. At this time, the corresponding user information can be obtained from the second target payload part so that the server can perform the next operation based on the user information, such as responding to client requests, etc. This embodiment of the invention does not limit this.

[0215] The following example illustrates the process of generating and recognizing access tokens:

[0216] Generation process:

[0217] Step 1a. Generate the header of the JWT using B encoding according to the rules of JWT.

[0218] Step 2a. Encode the payload content in the JWT rule using the improved B encoding method.

[0219] Step 3a. Concatenate the contents of Step 1a and Step 2a, and then sign the data using HMAC256 according to JWT rules before encoding it using Base64.

[0220] Step 4a. Encode the signature string generated in step 3a using B encoding.

[0221] Step 5a. Combine the data generated in Step 1a, Step 2a and Step 4a to obtain the final access token.

[0222] Identification process: Step 1b. Decode the obtained access token using B encoding to obtain the header of the first part.

[0223] Step 2b. Continue to use B encoding to decode the remaining data and obtain the payload data.

[0224] Step 3b. Continue using B encoding to obtain the final signature string.

[0225] Step 4b. Based on the JWT token header obtained in Step 1b and the signature obtained in Step 3b, verify the payload obtained in Step 2b according to the JWT verification mechanism to verify the validity of the access token and obtain the data in the access token.

[0226] During verification, due to the characteristics of B encoding itself, it can naturally distinguish the header, payload and signature parts during the decoding process. Therefore, according to steps 1b to 4b, the token data that conforms to the JWT verification mechanism can be recovered. After that, the JWT verification mechanism is used to verify the token data.

[0227] like Figure 5 The existing JWT authentication process is as follows: First, authentication information is generated, then encrypted using JWT authentication; next, an access token is generated using JSON format encoding + Base64 encoding; then, the access token is transmitted over the network. During decoding, Base64 decoding is performed first, followed by JSON format decoding, and finally, JWT decryption and verification are performed.

[0228] like Figure 6 The JWT authentication process of this embodiment of the invention is as follows: First, authentication information is generated, and then encrypted using JWT authentication; subsequently, it is encoded using the optimized B-encoding in the access token generation method of this embodiment of the invention; then, the access token is transmitted over the network. During decoding, the optimized B-encoding in the access token recognition method of this embodiment of the invention is used for decoding, and JWT decryption verification is performed.

[0229] In this embodiment of the invention, when the server receives a service request from the client that includes a second target access token, it performs a B-encoding decoding process on the second target access token to obtain a second target header, a second target payload, and a second target signature. The server then verifies the second target header, payload, and signature. If the verification passes, the server returns the corresponding service data to the client according to the service request. This embodiment of the invention implements a B-encoding-based encoding method, reducing the storage space required for the access token and the network transmission bandwidth it occupies; effectively saving data storage overhead and reducing network transmission bandwidth pressure.

[0230] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0231] Reference Figure 7 The diagram shows a structural schematic of a server according to an embodiment of the present invention.

[0232] On one hand, server 700 can be used to receive user information sent by the client; B-encode the user information and the time information for the token to generate a first target access token; and return the first target access token to the client.

[0233] Specifically, after receiving user information, server 700 can perform B-encoding on the user information.

[0234] At the same time, after receiving user information, the time information of the access token can be obtained, so that the concept of timestamp is introduced in B encoding.

[0235] When performing B-encoding on user information, time information for the access token can also be B-encoded; thus, based on the strings obtained from the two encodings, the first target access token stored in Bencoding format is obtained.

[0236] After generating the first target access token, server 700 can return the first target access token to the corresponding client. The client can then save this first target access token in a cookie, and when sending subsequent requests to server 700, the client can automatically include this first target access token in the request for identity verification.

[0237] On the other hand, server 700 can also be used to decode the target access token by performing B encoding when it receives a business request from a client that includes a second target access token, to obtain the second target header, the second target payload, and the second target signature; to perform verification based on the second target header and the second target signature; and to return the corresponding business data to the client according to the business request when the verification passes.

[0238] When server 700 receives a service request from a client that includes a second target access token, it can first perform a B-encoding decoding process on the second target access token to obtain the second target header, the second target payload, and the second target signature.

[0239] Specifically, the second target access token can be first decoded using B-encoding to obtain the header portion of the second target; then, the remaining data of the second target access token can be decoded using B-encoding to obtain the payload portion of the second target.

[0240] Then, the remaining data of the second target access token is decoded using B encoding to obtain the second target signature.

[0241] After obtaining the second target header, the second target payload, and the second target signature, the signature algorithm and token attributes can be obtained from the second target header. Then, the string concatenated from the second target header and the second target payload can be signed according to the signature algorithm to obtain the current signature string.

[0242] Then, compare the current signature string with the content of the second target signature part. If they do not match, it means that the client's second target access token has been modified. If they match, it means that the client's second target access token is the access token issued by the server 700 earlier and has not been modified.

[0243] When the current signature string matches the content of the second target signature part, it indicates that the verification has passed. At this time, the corresponding user information can be obtained from the second target payload part so that the server 700 can perform the next operation based on the user information.

[0244] In this embodiment of the invention, the server first receives user information sent by the client; then, it performs B-encoding on the user information and the time information for the token to generate a first target access token; finally, it returns the first target access token to the client. This embodiment of the invention implements a B-encoding-based encoding method, reducing the storage space required for the access token and the network transmission bandwidth it occupies; effectively saving data storage overhead and reducing network transmission bandwidth pressure; and the introduction of the timestamp concept in B-encoding ensures that the access token contains the time information required for JWT issuance.

[0245] Reference Figure 8 The diagram shows a schematic representation of an access token generation device according to an embodiment of the present invention, which may include the following modules:

[0246] The receiving module 801 is used to receive user information sent by the client;

[0247] Encoding module 802 is used to encode user information and time information for the token using Bencoding B to generate the first target access token;

[0248] Return module 803 is used to return the first target access token to the client.

[0249] In an optional embodiment of the present invention, the encoding module 802 includes:

[0250] The header generation submodule allows users to generate the first target header portion.

[0251] The load generation submodule is used to perform B-encoding on user information and time information to generate the first target load portion;

[0252] The signature generation submodule is used to generate a first target signature string based on the first target header and the first target payload, and to perform B encoding on the first target signature string to generate the first target signature part;

[0253] The token generation submodule is used to generate a first target access token based on the first target header, the first target payload, and the first target signature.

[0254] In an optional embodiment of the present invention, a load generation submodule is used to perform B-encoding on user information to generate a first load portion; arrange time information in big-endian order into a 32-bit first target integer, and encode the first target integer using base64 to generate a first string; remove the last two bytes of the first string to obtain a second string; perform B-encoding on the second string to generate a second load portion; and obtain a first target load portion based on the first load portion and the second load portion.

[0255] In an optional embodiment of the present invention, the load generation submodule is used to perform B encoding on other information to generate a third string; to arrange the integer string in big-endian order into a 64-bit second target integer, and to perform base64 encoding on the second target integer to generate a fourth string; to remove the last byte of the fourth string and perform B encoding to generate a fifth string; and to generate a first load portion based on the third string and the fifth string.

[0256] In an optional embodiment of the present invention, the signature generation submodule is used to concatenate the first target header portion and the first target payload portion into a sixth string; to sign the sixth string using a preset encryption algorithm to generate a seventh string; and to base64 encode the seventh string to generate the first target signature string.

[0257] In this embodiment of the invention, the server first receives user information sent by the client; then, it performs B-encoding on the user information and the time information for the token to generate a first target access token; finally, it returns the first target access token to the client. This embodiment of the invention implements a B-encoding-based encoding method, reducing the storage space required for the access token and the network transmission bandwidth it occupies; effectively saving data storage overhead and reducing network transmission bandwidth pressure; and the introduction of the timestamp concept in B-encoding ensures that the access token contains the time information required for JWT issuance.

[0258] Reference Figure 9 The diagram illustrates the structure of an access token identification device according to an embodiment of the present invention, which may include the following modules:

[0259] The decoding module 901 is used to perform a B-encoding decoding process on the second target access token when it receives a service request from the client that includes the second target access token, to obtain the second target header, the second target payload, and the second target signature.

[0260] Verification module 902 is used to verify the second target header portion, the second target payload portion, and the second target signature portion.

[0261] The user information acquisition module 903 is used to acquire the corresponding user information from the second target load section when the verification is successful.

[0262] In this embodiment of the invention, when the server receives a service request from the client that includes a second target access token, it performs a B-encoding decoding process on the second target access token to obtain a second target header, a second target payload, and a second target signature. The server then verifies the second target header, payload, and signature. If the verification passes, the server returns the corresponding service data to the client according to the service request. This embodiment of the invention implements a B-encoding-based encoding method, reducing the storage space required for the access token and the network transmission bandwidth it occupies; effectively saving data storage overhead and reducing network transmission bandwidth pressure.

[0263] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for generating or recognizing an access token.

[0264] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0265] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0266] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0267] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0268] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0269] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0270] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0271] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0272] The above provides a detailed description of an access token generation method and an access token identification method. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for generating an access token, characterized in that, The method includes: Receive user information sent by the client; The user information and the time information for the token are encoded using Bencoding to generate a first target access token; Return the first target access token to the client; The step of performing Bencoding B-encoding on the user information and the time information for the token to generate the first target access token includes: Generate the first target's header portion; The user information and the time information are B-encoded to generate a first target payload portion; Based on the first target header and the first target payload, a first target signature string is generated, and the first target signature string is B-encoded to generate the first target signature part; A first target access token is generated based on the first target header portion, the first target payload portion, and the first target signature portion.

2. The method according to claim 1, characterized in that, The step of B-encoding the user information and the time information to generate the first target payload includes: The user information is B-encoded to generate the first payload portion; The time information is arranged in big-endian order as a 32-bit first target integer, and the first target integer is encoded using base64 to generate a first string; Remove the last two bytes of the first string to obtain the second string; The second string is B-encoded to generate the second payload portion; The first target load portion is obtained based on the first load portion and the second load portion.

3. The method according to claim 2, characterized in that, The user information includes an integer string that uniquely identifies the user and other information. The step of B-encoding the user information to generate a first payload portion includes: The other information is B-encoded to generate a third string; The integer string is arranged in big-endian order to form a second target integer of 64 bits, and the second target integer is base64 encoded to generate a fourth string; Remove the last byte of the fourth string and perform B encoding to generate the fifth string; The first payload portion is generated based on the third string and the fifth string.

4. The method according to any one of claims 1-3, characterized in that, The step of generating a first target signature string based on the first target header portion and the first target payload portion includes: Concatenate the first target header portion and the first target payload portion into a sixth string; The sixth string is signed using a preset encryption algorithm to generate the seventh string; The seventh string is base64 encoded to generate the first target signature string.

5. A method for identifying an access token, characterized in that, The method includes: When a service request containing a second target access token is received from a client, the second target access token is decoded using B encoding to obtain the second target header, the second target payload, and the second target signature. Verification is performed based on the second target header portion, the second target payload portion, and the second target signature portion; When the verification passes, the corresponding user information is obtained from the second target load portion; The second target access token consists of a second target header, a second target payload, and a second target signature.

6. An access token generation device, characterized in that, The device includes: The receiving module is used to receive user information sent by the client; The encoding module is used to perform Bencoding B encoding on the user information and the time information for the token to generate a first target access token; The return module is used to return the first target access token to the client; The encoding module includes: The header generation submodule is used to generate the header portion of the first target. The load generation submodule is used to perform B-encoding on user information and time information to generate the first target load portion; The signature generation submodule is used to generate a first target signature string based on the first target header and the first target payload, and to perform B encoding on the first target signature string to generate the first target signature part; The token generation submodule is used to generate a first target access token based on the first target header, the first target payload, and the first target signature.

7. A device for identifying access tokens, characterized in that, The device includes: The decoding module is used to perform a B-encoding decoding process on the second target access token when a service request containing the second target access token is received from the client, to obtain the second target header, the second target payload, and the second target signature. The verification module is used to verify the second target header, the second target payload, and the second target signature. The user information acquisition module is used to acquire the corresponding user information from the second target load portion when the verification passes. The second target access token consists of a second target header, a second target payload, and a second target signature.

8. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the method for generating an access token as described in any one of claims 1 to 4, or the method for recognizing an access token as described in claim 5.

Images