Session control and authorization method, device and system based on encrypted token

Abstract

The present application provides a session control and authorization method, device and system based on encrypted tokens, which relates to the field of big data intelligent analysis technology and can be applied to the financial field and other fields; wherein the session control and authorization method comprises: obtaining authorized server information according to the received authorization request analysis, and randomly generating an authorization random value and a calculation random value; generating the authorization information of the corresponding server through a hash algorithm according to the authorization random value, the authorized server information and the identity authentication information of the corresponding server; generating the unauthorized information of the corresponding server through a hash algorithm according to the calculation random value, the unauthorized server information and the authorization random value; generating an authorization token through string concatenation according to the authorization information and the unauthorized information, and feeding the authorization token back to the initiator of the authorization request.

Description

Technical Field

[0001] The present application relates to the field of big data intelligent analysis technology, and can be applied to the financial field and other fields, and particularly refers to a session control and authorization method, device and system based on encrypted tokens. Background Art

[0002] There are generally two solutions for session retention. The first solution is to assign a session key to the user after the user logs in, and save the session key and the user's relationship in the server storage. Each subsequent time the user visits, the session key is brought with the server, and the server performs user association retrieval based on the session key. The second solution is similar to the JWT solution, in which an encrypted token is sent to the server. Each time the token is sent, the server decrypts the token and verifies its validity. The second solution does not require storage on the server, but it is difficult to have an effective solution for token expiration.

[0003] In response to the above technical problems, the existing technology mainly provides JWT: JsonWebToken solution and JWE: JsonWebEncryption solution. In the JWE and JWT solutions, it is still impossible to achieve confidentiality authorization of multiple servers. For example, there are three servers A, B, and C. After logging in from A, A hopes to provide B with valid access rights, but does not want to give C access rights to the user. This kind of refined control cannot be achieved simply using JWE and JWT solutions. It is necessary to rely on solutions such as oauth to authorize limited resources across systems. At the same time, if you do not want B and C to know whether the token contains authorization for B or C while giving authorization to B and C, the JWE and JWT solutions cannot be implemented.

[0004] Therefore, a method or device is urgently needed in the industry to overcome the above-mentioned defects. Summary of the invention

[0005] The purpose of this application is to provide a session control and authorization method, device and system based on encrypted tokens to solve the problems of session maintenance and reliable authorization after user identity authentication.

[0006] To achieve the above-mentioned purpose, the session control and authorization method based on encrypted tokens provided in the present application specifically includes: analyzing the authorized server information according to the received authorization request, and randomly generating an authorization random value and a calculation random value; generating the authorization information of the corresponding server through a hash algorithm according to the authorization random value, the authorized server information and the identity authentication information of the corresponding server; generating the unauthorized information of the corresponding server through a hash algorithm according to the calculation random value, the unauthorized server information and the authorization random value; generating an authorization token through string concatenation of the authorization information and the unauthorized information, and feeding the authorization token back to the initiator of the authorization request.

[0007] In the above-mentioned session control and authorization method based on encrypted tokens, optionally, the method further includes: constructing a public-private key pair through an asymmetric encryption algorithm, and providing the public key to multiple server ends; generating master control information based on prime numbers and random numbers shared with multiple server ends; providing the master control information to multiple server ends, and obtaining identity information provided by each server end; generating identity authentication information corresponding to each server end based on the identity information, the random number and the prime number.

[0008] In the above-mentioned session control and authorization method based on encrypted tokens, optionally, generating authorization information of the corresponding server through a hash algorithm according to the authorization random value, authorized server information and identity authentication information of the corresponding server includes: retrieving the identity authentication information of the authorized server according to the server information; and concatenating the identity authentication information and the authorization random value to generate authorization information of the corresponding server through a hash algorithm.

[0009] In the above-mentioned session control and authorization method based on encrypted tokens, optionally, generating an authorization token by string splicing according to the authorized information and the unauthorized information also includes: obtaining an authorization timestamp, generating string data by string splicing according to the authorization timestamp, the authorization information, the unauthorized information, the authorization random value and the authorization request initiator information; and encrypting the string data by a private key to generate an authorization token.

[0010] The present application also provides a session control method based on an encrypted token, the method comprising: obtaining an authorization token according to a received access request, parsing the authorization token to obtain an authorization random number, authorization information and unauthorized information; extracting corresponding authorization information or unauthorized information in the authorization information according to current server information, and obtaining verification information through hash calculation according to the authorization random number and the identity authentication information of the current server; obtaining access authorization authority of the initiator of the access request according to a comparison result between the verification information and the authorization information; or, obtaining a restriction instruction of the initiator of the access request according to a comparison result between the verification information and the unauthorized information; providing session service to the initiator of the access request or denying access according to the authorization authority or the restriction instruction.

[0011] In the above-mentioned session control method based on encrypted tokens, optionally, the method further includes: randomly generating a random number, generating identity information based on the random number and a prime number shared with the master control end, providing the identity information to the master control end, and obtaining the master control identity information provided by the master control end; generating the identity authentication information of the current server based on the master control identity information, the random number and the prime number.

[0012] In the above-mentioned session control method based on encrypted token, optionally, parsing the authorization token to obtain the authorization random number and authorization information also includes: parsing the authorization token through the public key provided by the master control end to obtain the authorization timestamp; performing validity verification according to the authorization timestamp and the current time, and extracting the authorization random number, authorization information and unauthorized information in the authorization token after the validity verification passes.

[0013] The present application also provides a session control and authorization device based on an encrypted token, the device comprising an analysis module, a generation module and a feedback module; the analysis module is used to analyze the authorized server information according to the received authorization request, and randomly generate an authorization random value and a calculation random value; the generation module is used to generate the authorization information of the corresponding server through a hash algorithm according to the authorization random value, the authorized server information and the identity authentication information of the corresponding server; the unauthorized information of the corresponding server is generated through a hash algorithm according to the calculation random value, the unauthorized server information and the authorization random value; the feedback module is used to generate an authorization token through string concatenation according to the authorization information and the unauthorized information, and feed the authorization token back to the initiator of the authorization request.

[0014] The present application also provides a session control device based on an encrypted token, the device comprising a parsing module, a calculation module and a verification module; the parsing module is used to obtain an authorization token according to a received access request, and parse the authorization token to obtain an authorization random number, authorization information and unauthorized information; the calculation module is used to extract the corresponding authorization information or unauthorized information in the authorization information according to the current server information, and obtain the verification information through hash calculation according to the authorization random number and the identity authentication information of the current server; the verification module is used to obtain the access authorization authority of the initiator of the access request according to the comparison result of the verification information and the authorization information; or, obtain the restriction instruction of the initiator of the access request according to the comparison result of the verification information and the unauthorized information; provide session service to the initiator of the access request or deny access according to the authorization authority or the restriction instruction.

[0015] The present application also provides a session control and authorization system based on encryption tokens, the system comprising a client, a master control end and a server; the master control end constructs a public-private key pair through an asymmetric encryption algorithm, and provides the public key to multiple servers; generates master control information based on prime numbers and random numbers shared with multiple servers; provides the master control information to multiple servers, and obtains identity information provided by each server; generates identity authentication information corresponding to each server based on the identity information, the random number and the prime number; the server randomly generates a random number, generates identity information based on the random number and the prime number shared with the master control end, provides the identity information to the master control end, and obtains the master control identity information provided by the master control end; generates identity authentication information of the current server based on the master control identity information, the random number and the prime number; the client generates an authorization request based on user instructions, and provides the authorization request to the master control end; the master control end analyzes the authorized server information based on the authorization request, and randomly generates an authorization random value and calculates a random value; based on the authorization random value, the authorized server The information and the identity authentication information of the corresponding server are used to generate the authorization information of the corresponding server through a hash algorithm; the unauthorized information of the corresponding server is generated through a hash algorithm according to the calculated random value, the unauthorized server information and the authorized random value; an authorization token is generated by string concatenation according to the authorized information and the unauthorized information, and the authorization token is fed back to the client; the client initiates an access request to the server through the authorization token, and the server parses the authorization token to obtain the authorization random number, authorization information and unauthorized information; the corresponding authorization information or unauthorized information in the authorization information is extracted according to the current server information, and the verification information is obtained through a hash calculation according to the authorization random number and the identity authentication information of the current server; the access authorization authority of the initiator of the access request is obtained according to the comparison result of the verification information and the authorization information; or, the restriction instruction of the initiator of the access request is obtained according to the comparison result of the verification information and the unauthorized information; the session service is provided to the initiator of the access request or the access is denied according to the authorization authority or the restriction instruction.

[0016] The present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0017] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method.

[0018] The present application also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0019] The beneficial technical effects of the present application are: achieving confidentiality and reliability of authorization through asymmetric encryption and hashing with private information; eliminating the trouble of server-side storage through the solution of saving tokens through the client; and eliminating the complex jump process of the verification link in the prior art through tokens, thereby increasing overall efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present application, constitute a part of the present application, and do not constitute a limitation of the present application. In the drawings:

[0021] Figure 1 A flowchart of a session control and authorization method based on an encrypted token provided in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of a process for obtaining identity verification information provided in an embodiment of the present application;

[0023] Figure 3 A schematic diagram of a process for obtaining authorization information provided in an embodiment of the present application;

[0024] Figure 4 A schematic diagram of a flow chart of generating an authorization token provided in an embodiment of the present application;

[0025] Figure 5 A flowchart of a session control method based on an encryption token provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of a process for obtaining identity verification information provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of a flow chart of authorization token verification provided in an embodiment of the present application;

[0028] Figure 8 A schematic diagram of the structure of a session control and authorization device based on an encryption token provided in an embodiment of the present application;

[0029] Fig. 9 A schematic diagram of the structure of a session control device based on an encryption token provided in an embodiment of the present application;

[0030] Fig.10 A schematic diagram of the structure of a session control and authorization system based on an encryption token provided in an embodiment of the present application;

[0031] Fig.11 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0032] The following will describe the implementation methods of the present application in detail in conjunction with the accompanying drawings and embodiments, so that the implementation process of how the present application applies technical means to solve technical problems and achieve technical effects can be fully understood and implemented accordingly. It should be noted that as long as there is no conflict, the various embodiments in the present application and the various features in the embodiments can be combined with each other, and the technical solutions formed are all within the protection scope of the present application.

[0033] In addition, the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be performed in an order different from that shown here.

[0034] Please refer to Figure 1 As shown, the session control and authorization method based on encrypted tokens provided in one embodiment of the present application specifically includes:

[0035] S101 analyzes the authorized server information according to the received authorization request, and randomly generates an authorization random value and a calculation random value;

[0036] S102 generates authorization information of the corresponding server through a hash algorithm according to the authorization random value, the authorized server information and the identity authentication information of the corresponding server;

[0037] S103 generates unauthorized information of the corresponding server through a hash algorithm according to the calculated random value, the unauthorized server information and the authorized random value;

[0038] S104 generates an authorization token by concatenating the authorization information and the unauthorized information, and feeds the authorization token back to the initiator of the authorization request.

[0039] Specifically, the present application adds the authorization status of different servers to the authorization token by hash encryption in the above-mentioned embodiments. Each server can only know whether it is authorized in the verification process. Without obtaining the identity authentication information of other servers, it is also impossible to determine whether other servers are authorized, thereby achieving confidentiality of authorization; at the same time, the above-mentioned identity information is distinguished by introducing calculation factors, which can also effectively improve the reliability of authorization information; furthermore, the authorization token is saved by the initiator, and each server does not need to save the access rights of each initiator. It only needs to verify whether the authorization token complies with the current server authority. The specific implementation details will be described in detail in the subsequent embodiments, and examples will not be given one by one here.

[0040] Please refer to Figure 2 As shown, in one embodiment of the present application, the method further comprises:

[0041] S201 constructs a public-private key pair through an asymmetric encryption algorithm, and provides the public key to multiple servers;

[0042] S202 generates master control information based on prime numbers and random numbers shared with multiple servers;

[0043] S203 provides the master control information to multiple service terminals, and obtains identity information provided by each service terminal;

[0044] S204 generates identity verification information corresponding to each server according to the identity information, the random number and the prime number.

[0045] In this embodiment, the master control end and the server end need to construct the identity information of different servers in advance according to the asymmetric encryption algorithm, and then generate the identity authentication information required for the subsequent verification link according to the identity information, so as to ensure the reliability of the subsequent authorization token in the verification link; specifically, take the master control server T, business servers A, B, C, and the master control T to authorize user Bob as an example. Assume that user Bob logs in from the T server, and authorizes Bob to access the B server and the C server, but does not authorize access to the server A. At this time, the above-mentioned identity authentication information generation process is as follows:

[0046] 1. The master control server generates encrypted asymmetric keys PrT and PbT, where Pr is the private key and Pb is the private key. And publishes the public key.

[0047] 2. The master control server T and the A, B, and C servers share a prime number p and the prime number p

[0048] 3. The server T generates a random number t and then calculates g t modp=Xt

[0049] 4. Servers A, B, and C generate random numbers a, b, and c, and then calculate g a modp=Xa,g b modp=Xb,g c modp=Xc

[0050] 5. The server sends Xa, Xb, and Xc to the master control server T, and the server T sends Xt to each server A, B, and C. This can be sent through public channels.

[0051] 6. The master control T and the server A calculate SA = Xa t modp,SA=Xt a modp. The master control T and the server B respectively calculate SB = Xb t modp,SB=Xt b modp. The master control T and the server C calculate SB = Xc tmodp,SC=Xt c modp. All servers shall properly store the private information SA, SB, and SC.

[0052] Please refer to Figure 3 As shown, in one embodiment of the present application, the authorization information of each server is generated by a hash algorithm according to the calculation factor, the identity authentication information of each server and the server information, including:

[0053] S301 retrieves the identity authentication information of the authorized server according to the server information;

[0054] S302 concatenates the identity authentication information and the authorization random value and generates authorization information of the corresponding server through a hash algorithm.

[0055] Specifically, based on the above embodiment, in actual work, the generation process of the above authorization information is as follows:

[0056] After user Bob logs in to the master control T, T intends to authorize Bob to access the servers B and C. Then T performs the following process each time it authorizes:

[0057] 1. Random generation factors r0, ra;

[0058] 2. Calculate AuthA = Hash(ra||r0);

[0059] 3. Calculate AuthB = Hash(SB||r0);

[0060] 4. Calculate AuthC = Hash(SC||r0);

[0061] Among them, r0 and ra are the authorization random value and the calculated random value. For the authorized server, the identity authentication information plus the authorization random value is used when calculating the authorization data, such as B and C mentioned above; for the unauthorized server, the authorization random value and the calculated random value are used, such as A mentioned above.

[0062] Please refer to Figure 4 As shown, in one embodiment of the present application, generating an authorization token by string concatenation according to the authorization information further includes:

[0063] S401 obtains an authorization timestamp, and generates string data by string concatenation according to the authorization timestamp, the authorization information, the unauthorized information, the authorization random value, and the authorization request initiator information;

[0064] S402 encrypts the string data using a private key to generate an authorization token.

[0065] Specifically, in the above embodiment, after obtaining the authorization information, the token combination can be realized by string splicing. The actual application process is as follows: string splicing, the master control terminal T uses the private key PrT to sign the spliced ​​string S = SIGN (Bob||r0||AuthA||AuthB||AuthC||timestamp), where timestamp is the timestamp; S, i.e. the authorization token, is returned to Bob as the credential for Bob's login.

[0066] Please refer to Figure 5 As shown, in one embodiment of the present application, a session control method based on an encryption token is also provided, the method comprising:

[0067] S501 obtains an authorization token according to the received access request, and parses the authorization token to obtain an authorization random number, authorization information, and unauthorized information;

[0068] S502 extracts the corresponding authorized information or unauthorized information in the authorization information according to the current server information, and obtains verification information through hash calculation according to the authorization random number and the identity verification information of the current server;

[0069] S503: obtaining the access authorization authority of the initiator of the access request according to the comparison result of the verification information and the authorization information; or obtaining the restriction instruction of the initiator of the access request according to the comparison result of the verification information and the unauthorized information;

[0070] S504 provides session services to the access request initiator or denies access according to the authorization authority or the restriction instruction.

[0071] In this embodiment, the server mainly completes the verification of the authorization token. In this link, the verification information is obtained by hash calculation through the current identity authentication information and the identity information provided by the main control end. When the verification information is consistent with the authorization information, it means that the current server is authorized to access; when the comparison result is inconsistent, it means that it is not authorized; in this process, the authorization data and identification data both represent a hash value. When the server does not perform hash calculation, it cannot be determined whether the data is authorization data or identification data. In order to facilitate distinction, different terms are used for limitation, and there is no requirement for the actual form of expression.

[0072] For further information, please refer to Figure 6 As shown, the above embodiment may also include:

[0073] S601 randomly generates a random number, generates identity information according to the random number and a prime number shared with the master control terminal, provides the identity information to the master control terminal, and obtains the master control identity information provided by the master control terminal;

[0074] S602 generates identity authentication information of the current server according to the master control identity information, the random number and the prime number.

[0075] like Figure 7 As shown, parsing the authorization token to obtain the authorization random number and authorization information may also include:

[0076] S701 parses the authorization token through the public key provided by the master control terminal to obtain the authorization timestamp;

[0077] S702 performs validity verification based on the authorization timestamp and the current time, and extracts the authorization random number and authorization information in the authorization token when the validity verification passes.

[0078] Specifically, taking the above-mentioned embodiment as an example, the authorization verification environment of the above-mentioned server is described as follows:

[0079] For example, Bob uses his credentials to log in to server B. Bob sends the token to server B:

[0080] 1. Server B first uses the master control key PbT to verify the signature

[0081] 2. Confirm the validity of the timestamp

[0082] 3. Use r0 to concatenate private information SB for hash calculation, auth = Hash (SB || r0)

[0083] 4. Determine whether auth is equal to AuthB. If they are equal, authorization is obtained.

[0084] Assume that Bob uses the credentials to access server A. The process is as follows:

[0085] 1. Server A first uses the master control key PbT to verify the signature

[0086] 2. Confirm the validity of the timestamp

[0087] 3. Use r0 to concatenate private information SA for hash calculation, auth = Hash (SA || r0)

[0088] 4. Determine whether auth is equal to AuthA. Since ra is not equal to SA, auth and AuthA are not equal, and authorization is not obtained.

[0089] Since SA, SB, and SC are private information stored by each server, only its own Auth string information can be calculated, so the authorization information is kept confidential between each server.

[0090] Please refer to Figure 8As shown, the present application also provides a session control and authorization device based on an encrypted token, the device comprising an analysis module, a generation module and a feedback module; the analysis module is used to analyze the authorized server information according to the received authorization request, and randomly generate an authorization random value and a calculation random value; the generation module is used to generate the authorization information of the corresponding server through a hash algorithm according to the authorization random value, the authorized server information and the identity authentication information of the corresponding server; the unauthorized information of the corresponding server is generated through a hash algorithm according to the calculation random value, the unauthorized server information and the authorization random value; the feedback module is used to generate an authorization token through string concatenation according to the authorization information and the unauthorized information, and feed the authorization token back to the initiator of the authorization request.

[0091] Please refer to Fig. 9 As shown, the present application also provides a session control device based on an encrypted token, the device comprising a parsing module, a calculation module and a verification module; the parsing module is used to obtain an authorization token according to a received access request, and parse the authorization token to obtain an authorization random number, authorization information and unauthorized information; the calculation module is used to extract the corresponding authorization information or unauthorized information in the authorization information according to the current server information, and obtain the verification information through hash calculation according to the authorization random number and the identity authentication information of the current server; the verification module is used to obtain the access authorization authority of the initiator of the access request according to the comparison result of the verification information and the authorization information; or, obtain the restriction instruction of the initiator of the access request according to the comparison result of the verification information and the unauthorized information; provide session service to the initiator of the access request or deny access according to the authorization authority or the restriction instruction.

[0092] Please refer to Fig.10As shown, the present application also provides a session control and authorization system based on encryption tokens, the system comprising a client, a master control end and a server; the master control end constructs a public-private key pair through an asymmetric encryption algorithm, and provides the public key to multiple servers; generates master control information based on prime numbers and random numbers shared with multiple servers; provides the master control information to multiple servers, and obtains identity information provided by each server; generates identity verification information corresponding to each server based on the identity information, the random number and the prime number; the server randomly generates a random number, generates identity information based on the random number and the prime number shared with the master control end, provides the identity information to the master control end, and obtains the master control identity information provided by the master control end; generates identity verification information of the current server based on the master control identity information, the random number and the prime number; the client generates an authorization request based on a user instruction, and provides the authorization request to the master control end; the master control end analyzes the authorized server information based on the authorization request, and randomly generates an authorization random value and calculates a random value; The server information and the corresponding server identity authentication information are used to generate the corresponding server authorization information through a hash algorithm; the corresponding server unauthorized information is generated through a hash algorithm according to the calculated random value, the unauthorized server information and the authorized random value; an authorization token is generated by string concatenation according to the authorized information and the unauthorized information, and the authorization token is fed back to the client; the client initiates an access request to the server through the authorization token, and the server parses the authorization token to obtain the authorization random number, authorization information and unauthorized information; the corresponding authorization information or unauthorized information in the authorization information is extracted according to the current server information, and the verification information is obtained through a hash calculation according to the authorization random number and the current server identity authentication information; the access authorization authority of the initiator of the access request is obtained according to the comparison result of the verification information and the authorization information; or, the restriction instruction of the initiator of the access request is obtained according to the comparison result of the verification information and the unauthorized information; the session service is provided to the initiator of the access request or the access is denied according to the authorization authority or the restriction instruction.

[0093] The beneficial technical effects of the present application are: achieving confidentiality and reliability of authorization through asymmetric encryption and hashing with private information; eliminating the trouble of server-side storage through the solution of saving tokens through the client; and eliminating the complex jump process of the verification link in the prior art through tokens, thereby increasing overall efficiency.

[0094] The present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0095] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method.

[0096] The present application also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0097] like Fig.11 As shown, the electronic device 600 may further include: a communication module 110, an input unit 120, an audio processing unit 130, a display 160, and a power supply 170. It is worth noting that the electronic device 600 does not necessarily have to include Fig.11 In addition, the electronic device 600 may also include Fig.11 For components not shown, reference may be made to the prior art.

[0098] like Fig.11 As shown, the central processor 100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor devices and / or logic devices. The central processor 100 receives inputs and controls the operations of various components of the electronic device 600.

[0099] The memory 140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 100 may execute the program stored in the memory 140 to implement information storage or processing.

[0100] The input unit 120 provides input to the CPU 100. The input unit 120 is, for example, a key or a touch input device. The power supply 170 is used to provide power to the electronic device 600. The display 160 is used to display display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0101] The memory 140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 140 may also be some other type of device. The memory 140 includes a buffer memory 141 (sometimes referred to as a buffer). The memory 140 may include an application / function storage unit 142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 600 through the central processor 100.

[0102] The memory 140 may also include a data storage unit 143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 144 of the memory 140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0103] The communication module 110 is a transmitter / receiver 110 that transmits and receives signals via an antenna 111. The communication module (transmitter / receiver) 110 is coupled to the central processor 100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0104] Based on different communication technologies, multiple communication modules 110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless LAN module. The communication module (transmitter / receiver) 110 is also coupled to a speaker 131 and a microphone 132 via an audio processor 130 to provide an audio output via the speaker 131 and receive an audio input from the microphone 132, thereby realizing a common telecommunication function. The audio processor 130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 130 is also coupled to the central processor 100, so that the sound can be recorded on the local machine through the microphone 132, and the sound stored on the local machine can be played through the speaker 131.

[0105] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0106] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0109] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A session control and authorization method based on encrypted tokens, characterized in that: The method comprises: Analyze the authorized server information according to the received authorization request, and randomly generate the authorization random value and the calculation random value; Generate authorization information of the corresponding server through a hash algorithm according to the authorization random value, the authorized server information and the identity verification information of the corresponding server; Generate unauthorized information of the corresponding server through a hash algorithm according to the calculated random value, the unauthorized server information and the authorized random value; An authorization token is generated by concatenating the authorization information and the unauthorized information, and the authorization token is fed back to the initiator of the authorization request.

2. The session control and authorization method based on encrypted token according to claim 1, characterized in that: The method further comprises: Build a public-private key pair through an asymmetric encryption algorithm and provide the public key to multiple servers; Generate master control information based on prime numbers and random numbers shared with multiple servers; Providing the master control information to multiple service terminals and obtaining identity information provided by each service terminal; The identity verification information corresponding to each server is generated according to the identity information, the random number and the prime number.

3. The session control and authorization method based on encrypted token according to claim 2, characterized in that: The authorization information of the corresponding server is generated by a hash algorithm according to the authorization random value, the authorized server information and the identity verification information of the corresponding server, including: Retrieve the identity authentication information of the authorized server according to the server information; The identity verification information and the authorization random value are concatenated and then the authorization information of the corresponding server is generated through a hash algorithm.

4. The session control and authorization method based on encrypted token according to claim 3, characterized in that: Generating an authorization token by string concatenation of the authorization information and the unauthorized information further comprises: Obtain an authorization timestamp, and generate string data by string concatenation according to the authorization timestamp, the authorization information, the unauthorized information, the authorization random value, and the authorization request initiator information; The string data is encrypted by a private key to generate an authorization token.

5. A session control method based on encrypted tokens, characterized in that: The method comprises: Obtaining an authorization token according to the received access request, parsing the authorization token to obtain an authorization random number, authorization information, and unauthorized information; Extract the corresponding authorized information or unauthorized information in the authorization information according to the current server information, and obtain the verification information through hash calculation according to the authorization random number and the identity verification information of the current server; Obtaining the access authorization authority of the initiator of the access request according to the comparison result of the verification information and the authorization information; or, obtaining a restriction instruction of the initiator of the access request according to a comparison result between the verification information and the unauthorized information; Provide session services to the access request initiator or deny access according to the authorization authority or the restriction instruction.

6. The session control method based on encryption token according to claim 5, characterized in that: The method further comprises: Randomly generate a random number, generate identity information according to the random number and a prime number shared with the master control terminal, provide the identity information to the master control terminal, and obtain the master control identity information provided by the master control terminal; The identity verification information of the current server is generated according to the master control identity information, the random number and the prime number.

7. The session control method based on encryption token according to claim 5, characterized in that: Parsing the authorization token to obtain the authorization random number and authorization information also includes: Parsing the authorization token using the public key provided by the master control terminal to obtain the authorization timestamp; The validity is verified based on the authorization timestamp and the current time, and when the validity is verified, the authorization random number, authorization information and unauthorized information in the authorization token are extracted.

8. A session control and authorization device based on an encrypted token, characterized in that: The device comprises an analysis module, a generation module and a feedback module; The analysis module is used to analyze the authorized server information according to the received authorization request, and randomly generate an authorization random value and calculate a random value; The generation module is used to generate authorization information of the corresponding server through a hash algorithm according to the authorization random value, the authorized server information and the identity authentication information of the corresponding server; Generate unauthorized information of the corresponding server through a hash algorithm according to the calculated random value, the unauthorized server information and the authorized random value; The feedback module is used to generate an authorization token by string concatenation according to the authorization information and the unauthorized information, and feed back the authorization token to the initiator of the authorization request.

9. A session control device based on encryption token, characterized in that: The device comprises an analysis module, a calculation module and a verification module; The parsing module is used to obtain an authorization token according to the received access request, and parse the authorization token to obtain an authorization random number, authorization information and unauthorized information; The calculation module is used to extract the corresponding authorized information or unauthorized information in the authorization information according to the current server information, and obtain the verification information through hash calculation according to the authorization random number and the identity verification information of the current server; The verification module is used to obtain the access authorization authority of the initiator of the access request based on the comparison result of the verification information and the authorization information; or, to obtain the restriction instruction of the initiator of the access request based on the comparison result of the verification information and the unauthorized information; and to provide session service to the initiator of the access request or deny access based on the authorization authority or the restriction instruction.

10. A session control and authorization system based on encrypted tokens, characterized in that: The system includes a client, a master control terminal and a server; The master control terminal constructs a public-private key pair through an asymmetric encryption algorithm, and provides the public key to multiple service terminals; generates master control information based on prime numbers and random numbers shared with multiple service terminals; Providing the master control information to multiple service terminals and obtaining identity information provided by each service terminal; Generate identity authentication information corresponding to each server according to the identity information, the random number and the prime number; The server randomly generates a random number, generates identity information according to the random number and a prime number shared with the master control terminal, provides the identity information to the master control terminal, and obtains the master control identity information provided by the master control terminal; Generate identity authentication information of the current server according to the master control identity information, the random number and the prime number; The client generates an authorization request according to a user instruction, and provides the authorization request to the master control terminal; The master control end analyzes the authorized server information according to the authorization request, and randomly generates an authorization random value and a calculation random value; generates the authorization information of the corresponding server through a hash algorithm according to the authorization random value, the authorized server information and the identity verification information of the corresponding server; Generate unauthorized information of the corresponding server through a hash algorithm according to the calculated random value, the unauthorized server information and the authorized random value; Generate an authorization token by concatenating the authorization information and the unauthorized information, and feed the authorization token back to the client; The client initiates an access request to the server through the authorization token, and the server parses the authorization token to obtain an authorization random number, authorization information, and unauthorized information; Extract the corresponding authorized information or unauthorized information in the authorization information according to the current server information, and obtain the verification information through hash calculation according to the authorization random number and the identity verification information of the current server; Obtaining the access authorization authority of the initiator of the access request based on the comparison result of the verification information and the authorization information; or obtaining the restriction instruction of the initiator of the access request based on the comparison result of the verification information and the unauthorized information; providing session service to the initiator of the access request or denying access based on the authorization authority or the restriction instruction.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for causing a computer to execute the method according to any one of claims 1 to 7.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images