Gateway token-based security authentication method, system, device and medium

Abstract

The application relates to a gateway Token-based security authentication method, system, device and medium, wherein the method comprises the following steps: obtaining user information through a client, requesting a Token from an authorization server via a gateway device; verifying the user information by the authorization server, and returning an access token and a refresh token to the gateway device after verification; if the access token is verified as valid by the gateway device, providing the client with corresponding service in an application server via the gateway device; and if the access token is verified as invalid by the gateway device, calling the refresh token by the gateway device, and requesting a new access token from the authorization server. Through the application, the problem that Token authentication needs to process Token update logic in each client and increases the complexity of client access to the authentication system is solved, an automatic Token refreshing mechanism is added on the gateway side, user authentication systems can be quickly accessed, and the complexity of client access is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and particularly relates to a gateway Token-based security authentication method, system, device and medium. BACKGROUND

[0002] With the development of science and technology, people's work and life gradually step into digitization and intelligentization, but at the same time, the problem of easy leakage and easy tampering of data information comes along, and there are multiple business departments and multiple business systems in a company, so it is necessary to access a user authentication system to solve the security problem.

[0003] The first prior art solution: the patent with the patent application number 2020111045209 discloses a security authentication method based on API gateway, specifically, the method comprises: the API gateway receives the API authentication request message sent by the API calling party and forwards it to the authentication authorization server, the authentication authorization server generates a token, the API calling party caches the token to the local, the API calling party sends a business request to the API gateway carrying the token, the API gateway verifies whether the token is valid by using a public key, if valid, the API gateway provides a backend service business for the API calling party, if invalid, the API gateway returns the token invalid information to the API calling party to make it resend the API authentication request message.

[0004] The second prior art solution: the patent with the patent application number 2020104210593 discloses a token processing method and system for multiple devices, specifically, the method comprises: the Mesh gateway device performs an online operation, directly reports a device ID to an authentication server to apply for a token, uses the token to establish a receiving and sending information channel with a data server, when a Mesh sub-device is online, binds the Mesh sub-device on the receiving and sending information channel, completes the message transmission between the Mesh sub-device and the data server, the Mesh gateway device only needs to apply for a token once in a period of online operation, and the Mesh sub-device does not need to repeatedly apply for a token and reconnect the server.

[0005] It can be seen that in the prior art solution one, the API invoker obtains the token from the authentication server through the API gateway, the API gateway is responsible for verifying the token, and if the token is invalid, the API invoker needs to resend the API authentication request message to obtain a new token, which causes each API invoker to process token update logic, and increases the complexity of the client to access the backend service business. In the prior art solution two, the Mesh gateway device applies for a token only once in one online period, that is, the token will not be updated actively before the Mesh gateway device is online again. As known, issuing a token with a long validity period has a serious security problem.

[0006] Currently, there is no effective solution to the problem that the Token authentication in the related art needs to process Token update logic at each client, and increases the complexity of the client to access the authentication system. SUMMARY

[0007] Embodiments of the present application provide a gateway-based Token security authentication method, system, device and medium to at least solve the problem that Token authentication in the related art needs to process Token update logic at each client, and increases the complexity of the client to access the authentication system.

[0008] In a first aspect, the embodiments of the present application provide a gateway-based Token security authentication method, which comprises:

[0009] obtaining user information through a client, and requesting a Token from an authorization server through a gateway device;

[0010] verifying the user information through the authorization server, and returning an access token and a refresh token to the gateway device after the verification is passed;

[0011] if the access token is verified as valid through the gateway device, providing a corresponding business service in an application server for the client through the gateway device;

[0012] if the access token is verified as invalid through the gateway device, calling the refresh token through the gateway device to request a new access token from the authorization server.

[0013] In some embodiments, if the access token is verified as invalid through the gateway device, calling the refresh token through the gateway device to request a new access token from the authorization server comprises:

[0014] return the access token to the client and configure the refresh token in the gateway device after receiving the access token and the refresh token issued by the authorization server;

[0015] send a service request carrying the access token to the gateway device by the client;

[0016] verify the access token in the service request by the gateway device, if the access token is invalid, call the refresh token by the gateway device, request a new access token from the authorization server, and return the new access token to the client to reinitiate the service request.

[0017] In some embodiments, the access token issued by the authorization server has a first validity period, and the refresh token has a second validity period, wherein the first validity period is less than the second validity period;

[0018] The client calls the refresh token by the gateway device to request a new access token from the authorization server within a preset time period before the access token expires.

[0019] In some embodiments, if the access token is verified by the gateway device to be valid, the gateway device provides the corresponding service in the application server for the client, including:

[0020] return the access token to the client after receiving the access token and the refresh token issued by the authorization server;

[0021] send a service request carrying the access token to the gateway device by the client;

[0022] The gateway device verifies the access token in the service request, and if the access token is valid, the gateway device provides the corresponding service in the application server for the client.

[0023] In some embodiments, the authorization server is configured with an encryption algorithm, and the access token and the refresh token issued by the authorization server after verifying the user information are access tokens and refresh tokens encrypted by a private key of the encryption algorithm.

[0024] In some embodiments, verifying the access token by the gateway device includes:

[0025] The public key in the encryption algorithm configured by the authorization server is configured in the gateway device, and the access token is verified by the public key in the gateway device;

[0026] The access token issued by the authorization server has a preset validity period, and the validity period of the access token is checked by the gateway device.

[0027] Only when the key check and the validity period check pass, the access token is a valid access token.

[0028] In a second aspect, the embodiments of the present application provide a gateway Token-based security authentication system, characterized in that the system comprises a client module, a gateway device module, an authorization server module and an application server module.

[0029] The client module is configured to obtain user information and request a Token from the authorization server via the gateway device module.

[0030] The authorization server module is configured to verify the user information, and return an access token and a refresh token to the gateway device module after the verification is passed.

[0031] The gateway device module is configured to check whether the access token is valid, and if so, provide the client with a corresponding business service in the application server; if not, request a new access token from the authorization server module by calling the refresh token.

[0032] The application server module is configured to provide the client module with a corresponding business service.

[0033] In some embodiments, the gateway device module is further configured to:

[0034] After receiving the access token and the refresh token issued by the authorization server module, the gateway device module returns the access token to the client module and configures the refresh token in the gateway device module.

[0035] When the client module sends a business request carrying the access token to the gateway device module, the gateway device module checks the access token in the business request, and if the access token is invalid, the gateway device module calls the refresh token to request a new access token from the authorization server and returns the new access token to the client module to reinitiate the business request.

[0036] In a third aspect, the embodiments of the present application provide an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the method of the first aspect when executing the computer program.

[0037] In a fourth aspect, the embodiments of the present application provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the method of the first aspect.

[0038] Compared with the related art, the embodiments of the present application provide a gateway Token-based security authentication method, system, device and medium. The method obtains user information through a client, requests a Token from an authorization server via a gateway device, verifies the user information through the authorization server, returns an access token and a refresh token to the gateway device after verification, provides a corresponding service in an application server for the client via the gateway device if the access token is valid, and calls the refresh token through the gateway device to request a new access token from the authorization server if the access token is invalid. The embodiments of the present application solve the problem that Token authentication needs to process Token update logic in each client, and increase the complexity of client access to an authentication system. The embodiments of the present application implement an automatic Token refresh mechanism on the gateway side, can quickly access a user authentication system, and reduce the complexity of client access. BRIEF DESCRIPTION OF DRAWINGS

[0039] The accompanying drawings, which are included to provide a further understanding of the present application, form a part of the present application and illustrate the illustrative embodiments of the present application and together with the description, serve to explain the present application. In the drawings:

[0040] Figure 1 is a step flowchart of a gateway Token-based security authentication method according to an embodiment of the present application;

[0041] Figure 2 is a structural block diagram of a gateway Token-based security authentication system according to an embodiment of the present application;

[0042] Figure 3 is a schematic diagram of the internal structure of an electronic device according to an embodiment of the present application.

[0043] BRIEF DESCRIPTION OF DRAWINGS: 21, client module; 22, gateway device module; 23, authorization server module; and 24, application server module. DETAILED DESCRIPTION

[0044] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is described and explained below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0045] It is apparent that the drawings in the following description merely show some examples or embodiments of the present application, and for those skilled in the art, the present application can be applied to other similar situations without creative labor based on these drawings. In addition, it can be understood that although the efforts made in this development process can be complex and lengthy, some design, manufacture or production changes based on the technical content disclosed in the present application are only routine technical means for those skilled in the art related to the content disclosed in the present application, and should not be understood as insufficient disclosure of the content disclosed in the present application.

[0046] Reference to "an embodiment" in this application means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. It is explicitly contemplated that embodiments described herein can be combined with other embodiments in a non- conflicting manner.

[0047] Unless otherwise defined, technical terms or scientific terms used in the present application should be understood as their common meanings to those skilled in the art. The terms "a", "an", "one", "the", and similar terms in the present application do not denote a quantity of one, but can denote a singular or a plurality. The terms "comprise", "include", "have", and any variations thereof in the present application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device including a list of steps or modules (units) is not limited to the listed steps or units, but can further include other steps or units not listed or can further include other steps or units inherent to such processes, methods, products, or devices. The terms "connect", "connected", "coupled", and similar terms in the present application are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The term "plurality" in the present application means two or more. The term "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that A exists alone, A and B exist together, and B exists alone. The character " / " generally means that the associated objects before and after are in an "or" relationship. The terms "first", "second", "third", and the like in the present application are merely to distinguish similar objects, and do not represent a specific order of the objects.

[0048] The embodiment of the present application provides a gateway Token-based security authentication method, Figure 1 is a step flow chart of the gateway Token-based security authentication method according to the embodiment of the present application, as shown in Figure 1As shown, the method comprises the following steps:

[0049] In step S102, the user information is acquired by the client, and a Token is requested from the authorization server via the gateway device;

[0050] It should be noted that the Token is a string of characters generated by the authorization server, which is a token for the client to request. When logging in for the first time, the server generates a Token and returns the Token to the client. In the future, the client only needs to bring this Token to request data, without the need to bring the username and password again, avoiding the problem that the username and password is easy to be stolen after suffering network attacks,

[0051] In step S104, the user information is verified by the authorization server, and the access token and the refresh token are returned to the gateway device after verification;

[0052] It should be noted that two Tokens are used in the embodiment of the application, namely access_token (access token): storing user encryption information, and providing only a short validity period; and refresh_token (refresh token): as an encryption certificate for refreshing and obtaining access_token, having a relatively long validity period, that is, after access_token expires or becomes invalid, refresh_token can be used to reacquire, and if refresh_token expires, the username and password need to be used for reauthorization to obtain.

[0053] Preferably, the authorization server is configured with an encryption algorithm, and the access token and the refresh token issued by the authorization server after verifying the user information are access tokens and refresh tokens encrypted by a private key of the encryption algorithm.

[0054] As can be seen, the configured encryption algorithm can be customized by the developer, and has high security.

[0055] In step S106, if the access token is valid through the gateway device, the corresponding business service in the application server is provided for the client via the gateway device;

[0056] Specifically, after receiving the access token (access_token) and the refresh token (refresh_token) issued by the authorization server, the access token is returned to the client; the business request carrying the access token is sent to the gateway device by the client; the gateway device verifies the access token in the business request, and if the access token is valid, the corresponding business service in the application server is provided for the client via the gateway device.

[0057] Step S108, if the access token is invalid through the gateway device, the gateway device calls the refresh token to request a new access token from the authorization server.

[0058] Specifically, after receiving the access token (access_token) and the refresh token (refresh_token) issued by the authorization server, the access token is returned to the client, and the refresh token is configured in the gateway device; the client sends a service request carrying the access token to the gateway device; the gateway device verifies the access token in the service request, if the access token is invalid, the gateway device calls the refresh token to request a new access token from the authorization server, and returns the new access token to the client to reinitiate the service request.

[0059] Therefore, it solves the problem that Token authentication needs to process Token update logic in each client, increases the complexity of client access to the authentication system, and realizes that the gateway side joins the automatic Token refresh mechanism, which can quickly access the user authentication system and reduce the complexity of client access.

[0060] Optionally, the access token (access_token) issued by the authorization server has a first validity period, and the refresh token (refresh_token) has a second validity period, wherein the first validity period is less than the second validity period; the client calls the refresh token through the gateway device to request a new access token from the authorization server within a preset time period before the access token expires.

[0061] Therefore, it realizes updating the access token in advance by calling the refresh token, avoids the waiting problem of updating the access token when the access token expires, and improves the efficiency of user information authentication.

[0062] Further, steps S106 and S108 are steps after the gateway device verifies that the access token is valid and invalid, respectively, wherein how the gateway device verifies the access token specifically includes:

[0063] The authorization server is configured with an encryption algorithm, and the access token (access_token) and the refresh token (refresh_token) issued by the authorization server after verifying the user information are access tokens and refresh tokens encrypted by the private key of the encryption algorithm;

[0064] The public key in the encryption algorithm configured by the authorization server is configured in the gateway device, and the access token is verified by the public key in the gateway device; the access token issued by the authorization server has a preset validity period, and the validity period of the access token is verified by the gateway device;

[0065] Only when the key checksum and the validity period pass the verification, the access token is a valid access token.

[0066] Therefore, the configured encryption algorithm can be customized by the developer, and has high security.

[0067] Through steps S102 to S108 in the embodiment of the present application, the problem that Token authentication needs to process Token update logic in each client, increasing the complexity of the client access authentication system, is solved, the automatic Token refreshing mechanism is added on the gateway side, the user authentication system can be quickly accessed, and the complexity of the client access is reduced; the problem that the user initiates a request to update in the case of an expired access token is avoided, and the efficiency of user information authentication is improved; the encryption algorithm can be customized by the developer, and has high security.

[0068] It should be noted that the steps shown in the above process or the flowchart of the accompanying drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0069] The embodiment of the present application provides a secure authentication system based on gateway Token, Figure 2 is a structural block diagram of the secure authentication system based on gateway Token according to the embodiment of the present application, as Figure 2 shown, the system includes a client module 21, a gateway device module 22, an authorization server module 23 and an application server module 24.

[0070] The client module 21 is configured to obtain user information and request a Token from the authorization server via the gateway device module.

[0071] The authorization server module 22 is configured to verify the user information, and return an access token and a refresh token to the gateway device module after the verification.

[0072] The gateway device module 23 is configured to verify whether the access token is valid, if yes, provide the corresponding business service in the application server for the client, if not, request a new access token from the authorization server module by calling the refresh token.

[0073] The application server module 24 is configured to provide the corresponding business service for the client module.

[0074] In some embodiments, the gateway device module 23 is further configured to:

[0075] After receiving the access token and the refresh token issued by the authorization server module, the access token is returned to the client module, and the refresh token is configured in the gateway device module;

[0076] When the client module sends a service request carrying the access token to the gateway device module, the access token in the service request is verified, if the access token is invalid, the refresh token is called to request a new access token from the authorization server, and the new access token is returned to the client module to reinitiate the service request.

[0077] Through the client module 21, the gateway device module 22, the authorization server module 23 and the application server module 24 in the embodiment of the application, the problem that Token authentication needs to process Token update logic in each client, increasing the complexity of the client access authentication system, is solved, the gateway side joins the automatic Token refresh mechanism, the user authentication system can be quickly accessed, and the complexity of the client access is reduced.

[0078] It should be noted that each of the above modules can be a functional module or a program module, which can be implemented by software or hardware. For the modules implemented by hardware, each of the above modules can be located in the same processor, or each of the above modules can be located in different processors in any combination.

[0079] The embodiment also provides an electronic device including a memory and a processor, the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the method embodiments.

[0080] Optionally, the electronic device can further include a transmission device and an input and output device, wherein the transmission device is connected with the processor, and the input and output device is connected with the processor.

[0081] It should be noted that the specific examples in the embodiment can refer to the examples described in the above embodiments and optional implementation manners, and the embodiment will not be described here.

[0082] In addition, in combination with the gateway Token-based security authentication method in the above embodiments, the embodiment of the application can provide a storage medium for implementation. The storage medium stores a computer program; the computer program is executed by a processor to implement any one of the gateway Token-based security authentication methods in the above embodiments.

[0083] In one embodiment, a computer device is provided, which can be a terminal. The computer device comprises a processor, a memory, a network interface, a display screen and an input device connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is configured to communicate with external terminals through network connections. The computer program is executed by the processor to implement a gateway token-based security authentication method. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0084] In one embodiment, Figure 3 is a schematic diagram of the internal structure of an electronic device according to an embodiment of the present application. As shown in Figure 3 , an electronic device is provided, which can be a server, and the internal structure diagram of the electronic device can be as shown in Figure 3 . The electronic device comprises a processor, a network interface, an internal memory and a non-volatile memory connected through an internal bus, wherein the non-volatile memory stores an operating system, a computer program and a database. The processor is configured to provide computing and control capabilities, the network interface is configured to communicate with external terminals through network connections, the internal memory is configured to provide an environment for running the operating system and the computer program, the computer program is executed by the processor to implement a gateway token-based security authentication method, and the database is configured to store data.

[0085] Those skilled in the art can understand that Figure 3 the structure shown in the above is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device can comprise more or fewer components than those shown in the diagram, or combine certain components, or have a different arrangement of components.

[0086] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, storage, databases, or other media in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0087] Those skilled in the art should understand that any combination of the technical features of the above-mentioned embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above-mentioned embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0088] The above-mentioned embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of the patent of the present application should be subject to the appended claims.

Claims

1. A gateway token based security authentication method, characterized by, The method comprises: obtaining user information through a client, requesting a Token from an authorization server via a gateway device; verifying the user information through the authorization server, and returning an access token and a refresh token to the gateway device after the verification is passed; if the access token is verified as valid through the gateway device, providing a corresponding service in an application server for the client via the gateway device; after receiving the access token and the refresh token issued by the authorization server, returning the access token to the client and configuring the refresh token in the gateway device; sending a service request carrying the access token to the gateway device through the client; verifying the access token in the service request through the gateway device, and if the access token is invalid, calling the refresh token through the gateway device to request a new access token from the authorization server, and returning the new access token to the client to reinitiate a service request.

2. The method of claim 1, wherein, The access token issued by the authorization server has a first validity period, and the refresh token has a second validity period, wherein the first validity period is less than the second validity period; The client calls the refresh token through the gateway device to request a new access token from the authorization server within a preset time period before the access token expires.

3. The method of claim 1, wherein, If the access token is verified as valid through the gateway device, the method further comprises: after receiving the access token and the refresh token issued by the authorization server, returning the access token to the client; sending a service request carrying the access token to the gateway device through the client; verifying the access token in the service request through the gateway device, and if the access token is valid, providing a corresponding service in an application server for the client via the gateway device.

4. The method of claim 1, wherein, The authorization server is configured with an encryption algorithm, and the access token and the refresh token issued by the authorization server after verifying the user information are access tokens and refresh tokens encrypted by a private key of the encryption algorithm.

5. The method of claim 4, wherein, Verifying the access token through the gateway device comprises: the public key in the encryption algorithm configured by the authorization server is configured in the gateway device, and the access token is verified by the public key in the gateway device; the access token issued by the authorization server has a preset validity period, and the validity period of the access token is verified through the gateway device; only when the key verification and the validity period verification are passed, the access token is a valid access token.

6. A gateway token based secure authentication system characterized in that, The system comprises a client module, a gateway device module, an authorization server module, and an application server module; the client module is configured to obtain user information and request a Token from an authorization server via a gateway device module; the authorization server module is configured to verify the user information, and return an access token and a refresh token to the gateway device module after the verification is passed; The gateway device module is configured to verify whether the access token is valid, and if so, provide the corresponding service of the application server for the client; if not, request a new access token from the authorization server module by calling the refresh token; The gateway device module is further configured to return the access token to the client module and configure the refresh token in the gateway device module after receiving the access token and the refresh token issued by the authorization server module; When the client module sends a service request carrying the access token to the gateway device module; the access token in the service request is verified, and if the access token is invalid, a new access token is requested from the authorization server by calling the refresh token, and the new access token is returned to the client module to reinitiate the service request; The application server module is configured to provide the corresponding service for the client module. 7.An electronic device comprising a memory and a processor, the electronic device characterized by, The memory stores a computer program, and the processor is configured to run the computer program to execute the method in any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method in any one of claims 1 to 5.

Images