Token generation method and device, electronic device and storage medium

Abstract

The present application provides a token generation method and device, an electronic device and a storage medium. The present application receives a target total code and a first target scheme identifier sent by a server, the first target scheme identifier is used to identify a first target data hiding scheme, the first target data hiding scheme is a data hiding scheme in the current cycle determined from multiple candidate schemes existing in the data hiding scheme according to a preset cycle, the target total code includes a subcode corresponding to the first target data hiding scheme, by executing the target total code, respectively assigning values ​​to the fields involved in generating the token, and based on the first target data hiding scheme, using a corresponding hiding method to perform a hiding operation on the assignment information corresponding to the hidden field in the first target data hiding scheme, generating a token based on the obtained hiding processing result, and sending the request content, the token and the first target scheme identifier to the server, thereby improving the security of the token.

Description

[Technical field]

[0001] The present application relates to network security technology, and in particular to a token generation method and device, an electronic device and a storage medium. [Background technology]

[0002] With the development of Internet technology, more and more data and resources are stored and provided through the network. At the same time, the network security issues caused by this are becoming increasingly serious. At present, network security threats are becoming increasingly serious, and various applications are in urgent need of better technologies to ensure security. How to protect the security of data and resources stored on the network is becoming more and more important.

[0003] The common method at present is that the client generates a token as a temporary key and sends it to the server. The token is equivalent to the account name and password, which is used to decide whether to allow the request and to determine which user the request belongs to. It allows the client to access network data and system resources without providing a password or other credentials. The server verifies whether the token is correct and determines whether the client can access network data and system resources.

[0004] In the process of implementing the present application, the inventor discovered through research that the code used by the client to generate tokens can be easily reverse-engineered by attackers. After that, attackers can use automated tools to automatically generate tokens using these codes and send them to the server. However, it is difficult for the server to distinguish whether the received token is sent by a user with access rights through the client or by an attacker. As a result, attackers can access network data and system resources through the token, or further tamper with network data and system resources or implant viruses, which may cause great losses to users. [Summary of the invention]

[0005] Multiple aspects of the present application provide a token generation method and device, an electronic device and a storage medium to improve the security of the token.

[0006] In one aspect of the present application, a token generation method is provided, which is applied to a client and includes:

[0007] Receive a target total code and a first target solution identifier sent by a service end; wherein the first target solution identifier is used to identify a first target data hiding solution, and the first target data hiding solution is a data hiding solution in a current period determined from a plurality of candidate solutions existing in a data hiding solution according to a preset period; the data hiding solution includes: a hidden field and a hiding method corresponding to the hidden field, and the hidden field is a field to be hidden; the target total code includes a subcode corresponding to the first target data hiding solution;

[0008] By executing the target total code, the fields involved in generating the token are assigned values ​​respectively, and based on the first target data hiding scheme, the assignment information corresponding to the hidden fields in the first target data hiding scheme is subjected to hiding operation processing using a corresponding hiding method to obtain a hiding processing result;

[0009] generating a token based on the hidden processing result;

[0010] The request content, the token and the first target scheme identifier are sent to the server.

[0011] Another aspect of the present application provides another token generation method, which is applied to a server, and the method includes:

[0012] Adjusting the data hiding scheme according to a preset period, wherein the data hiding scheme is a scheme for hiding all or part of the fields involved in generating a token, and there are multiple candidate schemes for the data hiding scheme; the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, wherein the hidden field is a field to be hidden;

[0013] In response to reaching a preset trigger condition, a data hiding scheme in the current cycle is obtained as a second target data hiding scheme, and a scheme identifier of the second target data hiding scheme is obtained as a third target scheme identifier; wherein each scheme identifier is used to uniquely identify a data hiding scheme, and the third target scheme identifier is used to identify the second target data hiding scheme; the second target data hiding scheme includes: a second hidden field and a second hiding mode corresponding to the second hidden field;

[0014] Recording the correspondence between the third target solution identifier and the expiration time information of the second target data hiding solution in a correspondence table;

[0015] Based on the subcode corresponding to the second target data hiding scheme, a total code for generating tokens is updated to obtain a target total code for generating tokens in the current cycle, wherein the target total code includes the subcode corresponding to the second target data hiding scheme;

[0016] The target total code and the third target scheme identifier are sent to the client, so that the client generates a token processed by a hiding operation based on the second target data hiding scheme by executing the target total code.

[0017] In another aspect of the present application, a token generation device is provided, which is applied to a client, comprising:

[0018] A receiving module, used for receiving a target total code and a first target scheme identifier sent by a server; wherein the first target scheme identifier is used for identifying a first target data hiding scheme, and the first target data hiding scheme is a data hiding scheme in a current period determined from a plurality of candidate schemes existing in a data hiding scheme according to a preset period; the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, and the hidden field is a field to be hidden; the target total code includes a subcode corresponding to the first target data hiding scheme;

[0019] a hiding module, configured to respectively assign values ​​to the fields involved in generating the token by executing the target general code, and based on the first target data hiding scheme, perform a hiding operation on the value information corresponding to the hidden fields in the first target data hiding scheme using a corresponding hiding method to obtain a hiding processing result;

[0020] A generating module, used for generating a token based on the hidden processing result;

[0021] The first sending module is used to send the request content, the token and the first target scheme identifier to the server.

[0022] In another aspect of the present application, another token generation device is provided, which is applied to a server, including:

[0023] An adjustment module, used for adjusting a data hiding scheme according to a preset period, wherein the data hiding scheme is a scheme for hiding all or part of the fields involved in generating a token, and there are multiple candidate schemes for the data hiding scheme; the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, wherein the hidden field is a field to be hidden;

[0024] an acquisition module, configured to acquire, in response to reaching a preset trigger condition, a data hiding scheme in the current cycle as a second target data hiding scheme, and acquire a scheme identifier of the second target data hiding scheme as a third target scheme identifier; wherein each scheme identifier is used to uniquely identify a data hiding scheme, and the third target scheme identifier is used to identify the second target data hiding scheme; the second target data hiding scheme includes: a second hidden field and a second hiding mode corresponding to the second hidden field;

[0025] A recording module, used for recording the correspondence between the third target scheme identifier and the expiration time information of the second target data hiding scheme in a correspondence table;

[0026] An updating module, configured to update a total code for generating a token based on a subcode corresponding to the second target data hiding scheme, and obtain a target total code for generating a token in a current cycle, wherein the target total code includes a subcode corresponding to the second target data hiding scheme;

[0027] The second sending module is used to send the target total code and the third target scheme identifier to the client, so that the client can generate a token after the hiding operation is performed based on the second target data hiding scheme by executing the target total code.

[0028] In another aspect of the present application, an electronic device is provided, the electronic device comprising:

[0029] one or more processors;

[0030] a storage device for storing one or more programs,

[0031] When the one or more programs are executed by the one or more processors, the one or more processors implement the token generation method provided in the above aspect.

[0032] According to another aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the token generation method provided in the above aspect is implemented.

[0033] It can be seen from the above technical solution that a data hiding scheme for hiding data in the token is introduced, and there are multiple candidate schemes for the data hiding scheme. The server can adjust the data hiding scheme according to the preset period and generate the target total code thereby, thereby ensuring that the total code sent by the server to the client for generating the token changes dynamically and periodically, so that the token generated by the client also changes dynamically and periodically, which greatly increases the difficulty of the code for generating the token being reverse analyzed by the attacker, and effectively prevents the code for generating the token from being reverse analyzed by the attacker, so that the attacker cannot integrate the code for generating the token into the automated tool to automatically generate the token, thereby improving the security of the token. In addition, since the data hiding scheme is periodically and dynamically adjusted and the adjusted data hiding scheme has a corresponding expiration time, even if the attacker spends a lot of time reversely analyzing part of the total code used to generate the token, this part of the code has expired and is invalid, and it is meaningless to integrate it into the automated tool to automatically generate the token, thereby improving the security of the token.

[0034] In addition, based on the technical solution provided in the present application, the server can send the target total code for generating the token together with the third target scheme identifier to the client. After the client generates the token based on the target total code, it can return the request content, the generated token and the received third target scheme identifier to the server. In this way, the server can obtain valid data from the token based on the first target data hiding scheme identified by the third target scheme identifier, thereby improving the recognizability and security of the token.

[0035] In addition, based on the technical solution provided in this application, it is possible to prevent attackers from using automated tools to automatically generate tokens using reverse analysis codes to access network data and system resources, or further tamper with or implant viruses into network data and system resources, thereby effectively ensuring the security of network data and system resources.

Brief Description of the Drawings

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0037] Figure 1 A flowchart of a token generation method provided in one embodiment of the present application;

[0038] Figure 2 A flowchart of a token generation method provided in another embodiment of the present application;

[0039] Figure 3 A flowchart of a token generation method provided in yet another embodiment of the present application;

[0040] Figure 4 A flowchart of a token generation method provided in yet another embodiment of the present application;

[0041] Figure 5 A schematic diagram of the structure of a token generation device provided in one embodiment of the present application;

[0042] Figure 6 A schematic diagram of the structure of a token generation device provided in another embodiment of the present application;

[0043] Figure 7 A schematic diagram of the structure of a token generation system provided in one embodiment of the present application;

[0044] Figure 8 FIG. 1 is a schematic block diagram of an exemplary electronic device that can be used to implement embodiments of the present application. [Specific implementation method]

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] It should be noted that the terminals involved in the embodiments of the present application may include but are not limited to mobile phones, personal digital assistants (PDAs), wireless handheld devices, tablet computers, personal computers (PCs), MP3 players, MP4 players, wearable devices (for example, smart glasses, smart watches, smart bracelets, etc.), etc.

[0047] Those skilled in the art can understand that the terms "first", "second", etc. in the embodiments of the present disclosure are only used to distinguish different steps, devices, modules, objects, information, etc., and do not represent any specific technical meaning, nor do they indicate the necessary logical order between them, nor do they indicate whether the first object and the second object are necessarily the same or different.

[0048] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0049] In the related art, the client generates a token with a fixed data format by executing a fixed code. In this way, the code generated by the client for the token can be easily reverse analyzed by an attacker. After that, the attacker can use automated tools to automatically generate tokens using these codes, or crack the data format of the token to forge a token and send it to the server. The server cannot distinguish whether the received token is sent by a user with access rights through the client or by an attacker, which may cause the attacker to access network data and system resources through the token, or further tamper with network data and system resources or implant viruses, which may cause great losses to users.

[0050] Therefore, there is an urgent need to provide a token generation method and device, an electronic device and a computer-readable storage medium to improve the security of the token.

[0051] The design idea of ​​the present application is to introduce a data hiding scheme for hiding the data in the token, and there are multiple candidate schemes for the data hiding scheme. The server can adjust the data hiding scheme according to the preset period and generate the target total code thereby, so as to ensure that the total code sent by the server to the client for generating the token changes dynamically periodically, so that the token generated by the client also changes dynamically periodically, so as to increase the difficulty of the code for generating the token to be reverse analyzed by the attacker, and effectively prevent the code for generating the token from being reverse analyzed by the attacker, so that the attacker cannot integrate the code for generating the token into the automated tool to automatically generate the token, thereby improving the security of the token. A corresponding expiration time is set for the data hiding scheme in each cycle. Even if the attacker spends a lot of time reversely analyzing part of the total code used to generate the token at a certain time, this part of the code has expired and is invalid. It is meaningless to integrate it into the automated tool to automatically generate the token, thereby improving the security of the token.

[0052] The embodiments of the present application can be applied to various electronic devices with a client-server (C / S) architecture.

[0053] Figure 1 A flowchart of a token generation method provided in an embodiment of the present application is shown in FIG. Figure 1 shown.

[0054] 101, adjusting the data hiding scheme according to a preset period.

[0055] Among them, the data hiding scheme is a scheme for hiding all or part of the fields involved in generating the token, and there are multiple candidate schemes for the data hiding scheme. Each candidate scheme has a corresponding scheme identifier (ID), wherein each scheme identifier is used to uniquely identify a data hiding scheme, which can be pre-assigned by the server. The scheme identifier can be, for example, the scheme name of the data hiding scheme, the scheme number of the data hiding scheme that is globally unique on the server, or both the scheme name and the scheme number that is globally unique on the server, etc. The implementation of this application does not limit the specific composition of the scheme identifier. Each data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, wherein the hidden field is a field that needs to be hidden, which can be for all fields, or for one or several fields, and can be determined according to specific needs.

[0056] The duration of the preset cycle can be set according to actual needs and can be updated as needed, for example, it can be 30 seconds, 2 minutes, 1 hour, etc.

[0057] 102 . In response to reaching a preset trigger condition, a data hiding scheme in a current cycle is obtained as a second target data hiding scheme, and a scheme identifier of the second target data hiding scheme is obtained as a third target scheme identifier.

[0058] Each scheme identifier is used to uniquely identify a data hiding scheme, and the third target scheme identifier is used to identify a second target data hiding scheme. The second target data hiding scheme includes: a second hidden field and a second hiding mode corresponding to the second hidden field.

[0059] In the embodiment of the present application, the preset trigger condition is a condition preset by the server for triggering the generation of a target total code for generating a token, so that the client can generate a token based on the target total code. The preset trigger condition can be set according to actual needs. For example, in a specific implementation, the server can use real-time, random or idle time as a preset trigger condition to trigger the generation of a target total code for generating a token, perform operations 102-104 of this embodiment, and perform operation 105 when the client needs it later. For example, in another specific implementation, some preset user events can be used as preset trigger conditions, and the server can monitor preset user events through the client, such as whether there is a mouse input signal or a keyboard input signal generated by a user operation. When the client monitors these user events, it will trigger the server to generate a code for generating a token and perform operations 102-105 of this embodiment. For example, in another specific implementation, the server can set a preset period as a preset trigger condition, generate a target total code for generating a token through periodic triggering of a timer, execute operations 102-104 of this embodiment, and execute operation 105 when the client needs it later; or directly execute operations 101-105 of this embodiment.

[0060] Thereafter, operations 103 and 104 may be performed respectively.

[0061] 103. Record the correspondence between the third target solution identifier and the expiration time information of the second target data hiding solution in a correspondence table.

[0062] Optionally, the corresponding relationship may also include a second target data hiding solution, or a separate table may be used to record the corresponding relationship between the second target data hiding solution and the third target solution identifier, which is not limited in the embodiment of the present application.

[0063] Among them, the expiration time information of the second target data hiding scheme may include a starting time and a valid duration. In a specific implementation, the time when the server obtains the second target data hiding scheme can be used as the starting time, and the duration of the preset period can be used as the valid duration. In another specific implementation, the start time of the preset period can be used as the starting time, and the duration of the preset period can be used as the valid duration. Alternatively, a duration not greater than the preset period can be randomly selected as the valid duration, and the size of the valid duration can be updated as needed, for example, it can be 30 seconds, 2 minutes, 5 minutes, etc.

[0064] Therefore, the server can record what kind of data is hidden in the token generated by the code used to generate the token in the current cycle through the third target solution identifier.

[0065] 104. Update the total code for generating the token based on the subcode corresponding to the second target data hiding scheme to obtain the target total code for generating the token in the current cycle, wherein the target total code includes the subcode corresponding to the second target data hiding scheme.

[0066] Therefore, the target total code has a one-to-one correspondence with the second target data hiding scheme.

[0067] 105, sending the target total code and the third target scheme identifier to the client, so that the client can generate a token after the hiding operation is performed based on the second target data hiding scheme by executing the target total code.

[0068] In actual applications, the server can send the target total code and the third target scheme identifier to the client when the client needs to send the request content of the business request to the server, or it can send the target total code and the third target scheme identifier to the client in advance, so that the client can generate the corresponding token by executing the target total code before sending the request content of the business request to the server.

[0069] In this way, a data hiding scheme for hiding data in the token is introduced, and there are multiple candidate schemes for the data hiding scheme. The server can adjust the data hiding scheme according to the preset period and generate the target total code thereby, thereby ensuring that the total code sent by the server to the client for generating the token changes dynamically periodically, so that the token generated by the client also changes dynamically periodically, greatly increasing the difficulty of the code for generating the token being reverse analyzed by the attacker, effectively preventing the code for generating the token from being reverse analyzed by the attacker, so that the attacker cannot integrate the code for generating the token into the automated tool to automatically generate the token, thereby improving the security of the token. In addition, since the data hiding scheme is periodically and dynamically adjusted and the adjusted data hiding scheme has a corresponding expiration time, even if the attacker spends a lot of time reversely analyzing part of the total code used to generate the token, this part of the code has expired and is invalid, and it is meaningless to integrate it into the automated tool to automatically generate the token, thereby improving the security of the token. In addition, it can prevent the attacker from using the automated tool to automatically generate the token using the reverse analyzed code to access the network data and system resources, or further tamper with the network data and system resources or implant viruses, effectively ensuring the security of the network data and system resources.

[0070] Figure 2 A flowchart of a token generation method provided in another embodiment of the present application is shown in FIG. Figure 2 As shown, in Figure 1 Based on the embodiment shown, the following may also be included:

[0071] 201, in response to receiving the request content, the token and the first target scheme identifier sent by the client.

[0072] The request content refers to the content that the client requests the server to process. For example, the request content can be a network data access request, a system resource access request, a user personal information update request, etc. The implementation of this disclosure does not limit the specific business type and specific content corresponding to the request content.

[0073] In the embodiments of the present application, "first" and "second" are only used to distinguish between different or possibly different referents. The first target solution identifier is the target solution identifier sent by the client to the server, which may be the untampered session key sent by the server to the client. In this case, the first target solution identifier is the third target solution identifier; in addition, the first target solution identifier may also be the target solution identifier that has been tampered with after being sent by the server. In this case, the first target solution identifier is different from the third target solution identifier, and the target total code that may be sent at the same time as the third target solution identifier has also been tampered with.

[0074] 202. Obtain expiration time information corresponding to the first target solution identifier from the correspondence table.

[0075] The expiration time information corresponding to the first target solution identifier is obtained, that is, the expiration time information of the first target data hiding solution identified by the first target solution identifier.

[0076] In response to obtaining the expiration time information corresponding to the first target solution identifier from the correspondence table, it means that the first target solution identifier exists, and operation 203 is executed; otherwise, if the expiration time information corresponding to the first target solution identifier is not obtained from the correspondence table, it can be considered that the first target solution identifier does not exist, and the third target solution identifier sent to the client has been tampered with, and the subsequent process of this embodiment is not executed, or a response message requiring identity authentication is further fed back to the client.

[0077] 203 , in response to obtaining the expiration time information corresponding to the first target solution identifier from the correspondence table, confirm whether the first target data hiding solution is expired based on the expiration time information corresponding to the first target solution identifier.

[0078] Among them, the expiration time information corresponding to the first target scheme identifier may include a starting time and a valid duration. In a specific implementation, the time when the server generates the first target data hiding scheme can be used as the starting time, and the duration of the preset period can be used as the valid duration. In another specific implementation, the start time of the preset period can be used as the starting time, and the duration of the preset period can be used as the valid duration. Alternatively, a duration not greater than the preset period can be randomly selected as the valid duration, and the size of the valid duration can be updated as needed, for example, it can be 30 seconds, 2 minutes, 5 minutes, etc.

[0079] For example, based on the start time and validity period in the expiration time information corresponding to the first target scheme identifier, the time when the server receives the token can be taken as the current time, and it can be determined whether the current time is within the above-mentioned validity period from the above-mentioned start time. If it is within the above-mentioned validity period, it is confirmed that the first target data hiding scheme has not expired; otherwise, if it is not within the above-mentioned validity period, it is confirmed that the first target data hiding scheme has expired.

[0080] In response to the first target data hiding solution not being expired, operation 204 is started; otherwise, operation 204 and its subsequent processes are not performed, or a response message requiring identity authentication is further fed back to the client.

[0081] 204. In response to the first target data hiding scheme not being expired, the token is decoded, decrypted and verified in sequence to obtain a first processing result.

[0082] Optionally, in some of the implementations, in operation 204, the token may be decoded, decrypted and verified in sequence by a preset coding algorithm, a preset encryption algorithm and a preset verification algorithm to obtain a first processing result. The preset verification algorithm, the preset encryption algorithm and the preset coding algorithm are the verification algorithm, the coding algorithm and the encryption algorithm used by the client when generating the token. The target total code includes the subcode corresponding to the preset verification algorithm, the subcode corresponding to the preset encryption algorithm and the subcode corresponding to the preset coding algorithm. The client generates the token processed based on the preset verification algorithm, the preset encryption algorithm and the preset coding algorithm by the subcode corresponding to the preset verification algorithm, the subcode corresponding to the preset encryption algorithm and the subcode corresponding to the preset coding algorithm.

[0083] 205. According to the first hidden field in the first target data hiding scheme and the first hiding method corresponding to the first hidden field, respectively perform a restoration operation corresponding to the first hiding method on the data corresponding to the first hidden field in the first processing result to obtain a second processing result.

[0084] 206. Obtain valid data from the second processing result.

[0085] The valid data therein is the assigned value of each valid field (i.e., the fields that the token needs to include in the preset rules, such as token version number, token ID, token type, token source, token attributes, client current time, optional data, etc.), wherein the token version number (specific assignment) is assigned by the server to the token used for generation this time according to a preset allocation method (such as random allocation, sequential allocation), and the token version number can be an integer, a decimal, a floating point number, or a string composed of numbers, letters, or a combination of numbers and letters, etc. The token version number can be sent to the client together with the target total code and the second target scheme identifier when the server sends it to the client, or the token version number can be carried in the second target scheme identifier and sent to the client. The embodiment of the present application does not limit the allocation method and composition of the token version number, and the specific method of sending it to the client. The values ​​of valid fields such as token ID, token type, token source, token attributes, client current time (client current time), optional data, etc. are obtained and uploaded by the client. Depending on the application business, the optional data may include user input data, mouse movement data, keyboard input statistics, and environment-related data (such as window size, current operating system, CPU model, etc.). The embodiments of the present application do not impose any restrictions on this.

[0086] 207 , in response to obtaining valid data from the second processing result, processing the request content.

[0087] In response to obtaining valid data from the second processing result, it indicates that the second processing result is readable and valid, and operation 207 is executed; otherwise, operation 207 and subsequent processes are not executed, or a response message requiring identity authentication is further fed back to the client.

[0088] Based on this embodiment, the server can periodically adjust the data hiding scheme, and send the target total code for generating the token together with the second target scheme identifier to the client. After the client generates the token based on the target total code, it can return the request content, the generated token and the received first target scheme identifier to the server. In this way, the server can obtain the corresponding first target data hiding scheme based on the first target scheme identifier to restore the data in the token, and then obtain valid data from the token, thereby improving the identifiability and security of the token; and, each time the server sends the second target data hiding scheme to the client, it has a corresponding expiration time. Even if the attacker spends a lot of time reverse analyzing part of the code used to generate the token, this part of the code has expired and is invalid. It is meaningless to integrate it into the automation tool to automatically generate tokens, thereby improving the security of the token.

[0089] Optionally, in some of the implementations, the hiding method may include, but is not limited to, any one or more of the following: XOR, encryption and decryption, encoding and decoding, splitting, negation, shifting, addition, subtraction, etc.

[0090] Through the data hiding scheme, each hidden field involved in generating the token can be subjected to a hiding operation (such as encryption and decryption, encoding and decoding, negation, XOR, shifting, addition, subtraction, etc.) based on the data hiding method corresponding to each hidden field to hide the specific information (i.e., assignment) of each hidden field. After receiving the token sent by the client, the server can use the corresponding restoration operation to restore the data corresponding to the hidden field in the token based on the first target data hiding scheme identified by the first target scheme identifier, thereby obtaining the specific information of each hidden field.

[0091] As shown in Table 1 below, the optional data hiding methods of the data hiding scheme in the embodiment of the present application, as well as the hiding operations, restoration operations and applicable scopes applicable to hidden fields (i.e., the data forms that can be used as hidden fields) corresponding to each data hiding method are shown.

[0092] Table 1

[0093]

[0094]

[0095] For example, in a specific example, taking the above-mentioned redundant data insertion scheme 1 as an example, several candidate schemes of the corresponding data hiding scheme may be:

[0096] Data hiding scheme 1: data[0] = random number ^ 0x11, data[1] = random number ^ 0x22, data[2] = random number ^ 0x33, data[3] = random number ^ 0x44, data[4] = token version number ^ 0x55, data[5] = token ID ^ 0x66, data[6] = token type ^ 0x77, data[7] = token source ^ 0x88, data[8] = token attribute ^ 0x99, data[9] = client current time ^ 0xAA, ...

[0097] Restore operation: Token version number = data[4]^0x55, token ID = data[5]^0x66, token type = data[6]^0x77, token source = data[7]^0x88, token attribute = data[8]^0x99, client current time = data[9]^0xAA, ...

[0098] Data hiding scheme 2: data[0] = random number + 0x11, data[1] = random number + 0x22, data[2] = random number + 0x33, data[3] = random number + 0x44, data[4] = token version number + 0x55, data[5] = token ID + 0x66, data[6] = token type + 0x77, data[7] = token source + 0x88, data[8] = token attribute + 0x99, data[9] = client current time + 0xAA, ...

[0099] Restore operation: Token version number = data[4]-0x55, token ID = data[5]-0x66, token type = data[6]-0x77, token source = data[7]-0x88, token attribute = data[8]-0x99, client current time = data[9]-0xAA, ...

[0100] Data hiding scheme 3: data[0] = random number ^ 0x11, data[1] = random number + 0x22, data[2] = random number << 1, data[3] = random number ^ 0xFF, data[4] = ~token version number, data[5] = token ID ^ 0x66, data[6] = token type + 0x77, data[7] = token source << 2, data[8] = token attribute ^ 0x99, data[9] = ~client current time, ...

[0101] Restore operation: Token version number = ~data[4], token ID = data[5]^0x66, token type = data[6]-0x77, token source = data[7]>>2, token attribute = data[8]^0x99, client current time = ~data[9], …

[0102] …

[0103] Data hiding scheme N:…

[0104] Among them, in data hiding scheme 1, the data hiding method is XOR (XOR operator ^). In data hiding scheme 2, the data hiding method is addition (addition operator +, subtraction operator -). In data hiding scheme 3, the data hiding methods also include XOR (XOR operator ^), addition (addition operator +, subtraction operator -), shift (left shift operator <<, right shift operator >>), and negation (negation operator ~). In practical applications, the data hiding scheme can use the above data hiding methods alone or in combination.

[0105] Figure 3 A flowchart of a token generation method provided by another embodiment of the present application is shown below. This embodiment is applied to the server, such as Figure 3 shown.

[0106] 301, adjusting the data hiding scheme and the data structure scheme according to a preset period.

[0107] Among them, the data structure scheme is used to determine the data structure of the token, and the data structure scheme includes any one or more of the following: a data storage location scheme, and a redundant data insertion scheme.

[0108] Among them, the data storage location scheme is used to determine the position of the valid fields in the fields involved in generating the token in the data structure of the token, wherein the valid fields involved in generating the token may include, but are not limited to: token version number, token identifier, token type, token source, token attributes, client current time, at least one preset optional data, etc. There are multiple candidate schemes for the data storage location scheme, and each candidate scheme has a corresponding scheme identifier, which can be pre-assigned by the server. The scheme identifier can be, for example, the scheme name of the data storage location scheme, the scheme number of the data storage location scheme that is globally unique to the server, or both the scheme name and the scheme number that is globally unique to the server, etc. The implementation of this application does not limit the specific composition of the scheme identifier. In different data storage location schemes, the positions of the fields involved in generating the token in the data structure of the token are different or not completely the same, and even the position of the same field in the data structure of the token is different.

[0109] After the server receives the request content, token, and second target scheme identifier sent by the client, it can determine the position of each valid field in the data structure of the token based on the target data storage location scheme identified by the scheme identifier of the target data storage location scheme in the second target scheme identifier, thereby extracting the specific information of each valid field from the corresponding position (i.e., assigning a value).

[0110] For example, in a specific example, taking the valid fields involved in generating a token including the token version number, token ID, token type, token source, token attributes, client current time, etc. as an example, in the following different data storage location schemes, the positions of each field in the data structure of the token are as follows:

[0111] Data storage location scheme 1: data[0] = token version number, data[1] = token ID, data[2] = token type, data[3] = token source, data[4] = token attributes, data[5] = client current time, ...;

[0112] Data storage location scheme 2: data[0] = token ID, data[1] = token version number, data[2] = token type, data[3] = client current time, data[4] = token attributes, data[5] = token source, ...;

[0113] Data storage location scheme 3: data[0] = client current time, data[1] = token source, data[2] = token ID, data[3] = token type, data[4] = token attributes, data[5] = token version number, ...;

[0114] …

[0115] Data storage location scheme N:…

[0116] Among them, data[] indicates the position of each field in the data structure of the token. For example, data[0] = token version number indicates that the field "token version number" is at the 0th position in the data structure of the token, data[1] = token ID indicates that the field "token ID" is at the 1st position in the data structure of the token, and so on. Depending on the application business, optional data may include user input data, mouse movement data, keyboard input statistics, and environment-related data (such as window size, current operating system, CPU model, etc.).

[0117] Among them, the redundant data insertion scheme is a scheme for inserting redundant data into the data structure of the token. There are multiple candidate schemes for the redundant data insertion scheme, and each candidate scheme has a corresponding scheme identifier. The scheme identifier can be pre-allocated by the server. The scheme identifier can be, for example, the scheme name of the redundant data insertion scheme, the globally unique scheme number of the redundant data insertion scheme on the server, or both the scheme name and the globally unique scheme number on the server, etc. The implementation of this application does not limit the specific composition of the scheme identifier. Each redundant data insertion scheme includes: the number of invalid fields inserted, the position of each invalid field in the data structure of the token, and the redundant data assigned to each invalid field. According to the redundant data insertion scheme, different numbers of redundant data of invalid fields can be inserted into different positions in the fields involved in generating the token (for example, before or after the nth position in the data structure of the token).

[0118] To facilitate distinction, in an embodiment of the present application, the fields involved in generating tokens can be divided into valid fields and invalid fields, where the valid fields are the fields that the token needs to include in the preset rules, such as token version number, token ID, token type, token source, token attributes, client current time, and some optional data. The specific information (i.e., assignment) of these valid fields can be called valid data; the invalid fields are fields inserted in the implementation of this application in addition to the valid fields specified based on the above-mentioned preset rules, which are used to increase the difficulty of reverse analysis of the code for generating tokens by attackers and to improve the security of tokens. The specific information (i.e., assignment) of these invalid fields can be called redundant data (i.e., invalid data).

[0119] For example, in a specific example, the following redundant data insertion scheme may be provided as a candidate scheme:

[0120] Insert redundant data scheme 1: data[0] = random number, data[1] = random number, data[2] = random number, data[3] = random number, data[4] = token version number, data[5] = token ID, data[6] = token type, data[7] = token source, data[8] = token attribute, data[9] = client current time, ...;

[0121] Insert redundant data scheme 2: data[0] = token ID, data[1] = token version number, data[2] = token type, data[3] = client current time, data[4] = token attribute, data[5] = token source, data[6] = random number, data[7] = random number, data[8] = random number, ...;

[0122] Insert redundant data scheme 3: data[0] = client current time, data[1] = random number, data[2] = token source, data[3] = random number, data[4] = token ID, data[5] = token type, data[6] = random number, data[7] = token attribute, data[8] = token version number, ...;

[0123] …

[0124] Insert redundant data scheme N:…

[0125] The random number may be selected by the server according to a preset rule. For example, an integer greater than 0 and less than 255 may be selected as the random number. The random numbers at different positions may be partially or completely the same, or may be different.

[0126] The random number may be set by the server according to a preset rule, for example, may be set to an integer greater than 0 and less than 255.

[0127] After the server receives the request content, token, and second target scheme identifier sent by the client, it can determine the specific position of each valid field in the data structure of the token based on the scheme identifier of the target data storage location scheme in the second target scheme identifier and the target data storage location scheme and the target insertion redundant data scheme identified by the scheme identifier of the target data insertion redundant data scheme, and only extract valid data (that is, the specific information or values ​​of each valid field other than redundant data) from the corresponding position in the token; in addition, it can also detect whether the total code sent to the client has been tampered with by comparing the redundant data at each position in the target insertion redundant data scheme with the redundant data at the corresponding position in the token returned by the client. Alternatively, based on the above-mentioned preset rule setting, if the value at each invalid field position in the token is 0 or 255, it can be directly determined that the total code sent to the client has been tampered with.

[0128] Optionally, in some of the implementations, the number of hidden fields targeted by each data hiding scheme may be consistent with or inconsistent with the total number of valid fields and invalid fields, and the embodiments of the present application do not limit this. For example, in a specific implementation, when the data hiding scheme targets certain preset fields involved in generating a token, if the number of hidden fields is greater than the total number of valid fields and invalid fields, only the valid fields and invalid fields involved in the hidden fields may be hidden; if the number of hidden fields is less than the total number of valid fields and invalid fields, only the corresponding hidden fields in the valid fields and invalid fields may be hidden.

[0129] 302. In response to reaching a preset trigger condition, a data hiding scheme within the current cycle is obtained as a second target data hiding scheme, and a scheme identifier of the second target data hiding scheme is obtained as a third target scheme identifier; and a data structure scheme within the current cycle is obtained as a second target data structure scheme, and a scheme identifier of the second target data structure scheme is obtained as a fourth target scheme identifier.

[0130] The fourth target scheme identifier is used to identify the second target data structure scheme. According to the second target data structure scheme including the target data storage location scheme and / or the target redundant data insertion scheme, the fourth target scheme identifier correspondingly includes the scheme identifier of the target data storage location scheme and / or the scheme identifier of the target redundant data insertion scheme.

[0131] 303 , recording the correspondence between the third target solution identifier, the fourth target solution identifier, and the second target data hiding solution and the expiration time information of the second target data structure solution in a correspondence table.

[0132] 304. Update the total code for generating the token based on the subcode corresponding to the second target data structure scheme and the subcode corresponding to the second target data hiding scheme, and obtain the target total code for generating the token in the current cycle, wherein the target total code includes the subcode corresponding to the second target data structure scheme and the subcode corresponding to the second target data hiding scheme.

[0133] According to the second target data structure scheme including the target data storage location scheme and / or the target redundant data insertion scheme, the target total code correspondingly includes the sub-code corresponding to the target data storage location scheme and / or the sub-code corresponding to the target redundant data insertion scheme.

[0134] 305, sending the target total code, the third target scheme identifier and the fourth target scheme identifier to the client, so that the client can generate a token having a data structure determined by the second target data structure scheme and after the hiding operation is processed based on the second target data hiding scheme by executing the target total code.

[0135] 306 , in response to receiving the request content, the token, the first target solution identifier and the second target solution identifier sent by the client, obtaining expiration time information corresponding to the second target solution identifier and the fourth target solution identifier from the correspondence table.

[0136] In response to obtaining the expiration time information corresponding to the first target solution identifier and the second target solution identifier from the correspondence table, it means that the first target solution identifier exists, and operation 307 is executed; otherwise, if the expiration time information corresponding to the first target solution identifier and the second target solution identifier is not obtained from the correspondence table, it can be considered that the first target solution identifier and / or the second target solution identifier does not exist, and the third target solution identifier and / or the fourth target solution identifier sent to the client have been tampered with, and the subsequent process of this embodiment is not executed, or a response message requiring identity authentication is further fed back to the client.

[0137] 307, in response to obtaining the expiration time information corresponding to the first target solution identifier and the second target solution identifier from the correspondence table, confirm whether the first target data hiding solution and the first target data structure solution identified by the first target solution identifier and the second target solution identifier are expired based on the expiration time information corresponding to the first target solution identifier and the second target solution identifier.

[0138] In response to the first target data hiding scheme and the first target data structure scheme not being expired, operation 308 is started; otherwise, operation 308 and subsequent processes are not performed, or a response message requiring identity authentication is further fed back to the client.

[0139] 308. In response to the first target data hiding scheme and the first target data structure scheme not being expired, the token is decoded, decrypted and verified in sequence to obtain a first processing result.

[0140] In a specific implementation, the encoding algorithm, encryption algorithm and verification algorithm used in the token generation process can be used to decode, decrypt and verify the token in sequence. The encoding algorithm, encryption algorithm and verification algorithm used in the token generation process are embodied by the sub-code corresponding to the encoding algorithm, the sub-code corresponding to the encryption algorithm and the sub-code corresponding to the verification algorithm in the target total code sent from the server to the client.

[0141] 309, according to the first hidden field in the first target data hiding scheme and the first hiding method corresponding to the first hidden field, respectively perform a restoration operation corresponding to the first hiding method on the data corresponding to the first hidden field in the first processing result to obtain a second processing result.

[0142] 310 , obtaining valid data from the second processing result based on the first target data structure solution.

[0143] Optionally, in some of the implementations, the redundant data at each position in the target redundant data insertion scheme in the first target data structure scheme can be compared with the redundant data at the corresponding position in the token returned by the client to detect whether the total code sent to the client has been tampered with, or, based on the above-mentioned preset rule setting, if the value at each invalid field position in the token is 0 or 255, it can be directly determined that the total code sent to the client has been tampered with. If it is detected that the total code sent to the client has not been tampered with, based on the target data storage position scheme and the target redundant data insertion scheme in the first target data structure scheme, the specific position of each valid field in the data structure of the token is determined, and valid data (i.e., the specific information or assignment of each valid field other than redundant data) is extracted from the position of the valid field in the second processing result.

[0144] 311 , in response to obtaining valid data from the second processing result, processing the request content.

[0145] Based on this embodiment, the candidate schemes of the data structure scheme and the data hiding scheme can be periodically adjusted, and the corresponding sub-codes can be obtained to update the total code used to generate the token, so that the total code used to generate the token, and the data structure scheme and data representation form of the generated token can change dynamically and periodically, further increasing the difficulty of the total code for generating the token to be reverse analyzed by attackers, effectively preventing the total code for generating the token from being reverse analyzed by attackers, making it impossible for attackers to integrate the code for generating the token into the automated tool to automatically generate the token, and can also make the data structure and data representation form of the token generated by the client change dynamically and periodically, thereby improving the security of the token.

[0146] Optionally, in some of the implementations, the candidate schemes of the data hiding scheme and the subcodes corresponding to the candidate schemes may be preset; or, the candidate schemes of the data hiding scheme and the subcodes corresponding to the candidate schemes may be further updated. When the data hiding scheme is adjusted according to a preset period, a candidate scheme may be selected sequentially or randomly from the candidate schemes corresponding to the data hiding scheme according to the preset period as the data hiding scheme in the current period.

[0147] Optionally, in some of the implementations, the data storage location scheme and the candidate schemes for inserting redundant data schemes, and the subcodes corresponding to the candidate schemes can be preset; or, the data storage location scheme, the candidate schemes for inserting redundant data schemes and the data hiding scheme, and the subcodes corresponding to the candidate schemes can be further updated. When the data structure scheme is adjusted according to a preset period, when the data structure scheme includes the data storage location scheme, a candidate scheme can be selected from the candidate schemes corresponding to the data storage location scheme in sequence or randomly according to the preset period as the data storage location scheme in the current period; when the data structure scheme includes the redundant data insertion scheme, a candidate scheme can be selected from the candidate schemes corresponding to the redundant data insertion scheme in sequence or randomly according to the preset period as the redundant data insertion scheme in the current period.

[0148] Optionally, in some of the implementations, in operation 302, a data hiding scheme within the current cycle can be obtained as a second target data hiding; a data structure scheme within the current cycle can be obtained as a second target data structure scheme, including a target data storage location scheme and a target redundant data insertion scheme; thereafter, the sub-codes corresponding to the target data storage location scheme, the target redundant data insertion scheme and the second target data hiding scheme can be obtained from the pre-set candidate schemes of the data storage location scheme, the redundant data insertion scheme and the data hiding scheme, and the sub-codes corresponding to each candidate scheme, so that in operation 304, the total code for generating the token can be updated based on the sub-codes corresponding to the second target data structure scheme (including the sub-codes corresponding to the target data storage location scheme and the target redundant data insertion scheme) and the sub-codes corresponding to the second target data hiding scheme.

[0149] Optionally, in some of the implementations, in operation 105 or 305 of any of the above embodiments, a pre-acquired client key may also be sent to the client, where the client key is used to encrypt the client token. The client key may be generated by the server in a preset manner, such as randomly generated or generated using a preset algorithm, and the embodiments of the present application do not limit this.

[0150] The client key may be a fixed key, or a key that changes according to a preset period, or a key that is temporarily generated for each client. If the client key is a fixed key, the server can keep the key uniformly. If the client key is a key that changes according to a preset period, the server can record the client key in each period, so that the corresponding client key can be determined based on the period to which the current moment belongs. If the client key is a key that is temporarily generated for each client, when the server sends the pre-acquired client key to the client, the corresponding relationship between the client key and the client identification (ID) of the client can be recorded, so that the client key sent to the client can be determined based on the corresponding relationship, where the client ID is used to uniquely identify a client.

[0151] Accordingly, in operation 201 or 308, the token sent by the client is specifically an encrypted token. Accordingly, before operation 204 or 308, the corresponding client key can be obtained first, and then the encrypted token can be decrypted using the client key to obtain the token. Then, through operation 204 or 308, the token is decoded, decrypted and verified in sequence.

[0152] Based on this embodiment, the server sends the target total code and the third target scheme identifier to the client while sending the client key. In this way, after the client generates a token, it can directly use the client key to encrypt the token, which helps to improve the confidentiality and security of the token.

[0153] Optionally, in some of the implementations, before operation 104, a total code for generating a token may be generated in advance based on a subcode corresponding to a preset data structure scheme, a subcode corresponding to a preset data hiding scheme, and a subcode corresponding to a preset algorithm-related scheme. The preset algorithm-related scheme is a corresponding algorithm scheme used in the verification, encryption, encoding, and other links when generating a token, and is used to perform data processing such as verification, encryption, and encoding. The preset algorithm-related scheme may include a preset validation algorithm scheme, a preset encryption algorithm scheme, and a preset encoding algorithm scheme, which are respectively used in the verification link, encryption link, and encoding link in the token generation process.

[0154] The preset verification algorithm scheme may be, for example, MD5, SHA-1, SHA-2, CRC32, CRC16, CRC8, LRC, SM3 or other verification algorithms. The preset encryption algorithm scheme may be, for example, AES128, AES256, 3DES, SM4, RC5, RC6 or other encryption algorithms and other candidate schemes. The preset encoding algorithm scheme may be, for example, Base81, Base56, Base64 or other encoding schemes. The embodiments of the present disclosure do not limit the specific algorithm schemes used in the preset verification algorithm scheme, the preset encryption algorithm scheme and the preset encoding algorithm scheme.

[0155] Optionally, in some of the implementations, after the server generates a total code for generating a token based on the sub-code corresponding to the preset data structure scheme, the sub-code corresponding to the preset data hiding scheme, and the sub-code corresponding to the preset algorithm-related scheme, the server may also update the preset algorithm-related scheme (including any one or more of the preset verification algorithm scheme, the preset encryption algorithm scheme, and the preset encoding algorithm scheme) and its corresponding sub-code in the total code according to a preset period, so that the sub-code corresponding to the algorithm-related scheme in the total code used to generate the token also changes periodically, further increasing the difficulty of the target total code for generating the token being reverse analyzed by the attacker, effectively preventing the target total code for generating the token from being reverse analyzed by the attacker, making it impossible for the attacker to integrate the target total code for generating the token into the automation tool to automatically generate the token, thereby further improving the security of the token.

[0156] Figure 4 A flowchart of a token generation method provided by another embodiment of the present application is shown below. This embodiment is applied to a client, such as Figure 4 shown.

[0157] 401, receiving a target total code and a first target solution identifier sent by a server.

[0158] Among them, the first target scheme identifier is used to identify the first target data hiding scheme, and the first target data hiding scheme is a data hiding scheme in the current cycle determined by the server from multiple candidate schemes existing in the data hiding scheme according to a preset cycle, for example, a data hiding scheme that can be determined by operations 101-102 in the above embodiment. The data hiding scheme is a scheme for hiding all or part of the fields involved in generating a token, and the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, and the hidden field is a field that needs to be hidden. The target total code is obtained by updating the total code used to generate the token based on the sub-code corresponding to the first target data hiding scheme, and the target total code includes the sub-code corresponding to the first target data hiding scheme.

[0159] 402, by executing the target general code, respectively assigning values ​​to the fields involved in generating the token, and based on the first target data hiding scheme, performing hiding operation processing on the assignment information corresponding to the hidden field in the first target data hiding scheme using the corresponding hiding method to obtain the hiding processing result.

[0160] 403: Generate a token based on the hidden processing result.

[0161] 404, sending the request content, the token and the first target scheme identifier to the server.

[0162] The request content refers to the content that the client requests the server to process. For example, the request content can be a network data access request, a system resource access request, a user personal information update request, etc. The implementation of this disclosure does not limit the specific business type and specific content corresponding to the request content.

[0163] The client receives the target total code and the first target scheme identifier sent by the server, generates a token based on the most recently received target total code before sending each request content to the server, and then sends the request content, the generated token and the first target scheme identifier to the server.

[0164] In this way, a data hiding scheme for hiding data in the token is introduced, and there are multiple candidate schemes for the data hiding scheme. The server can adjust the data hiding scheme according to the preset period and generate the target total code thereby, thereby ensuring that the total code sent by the server to the client for generating the token changes dynamically periodically, so that the token generated by the client also changes dynamically periodically, greatly increasing the difficulty of the code for generating the token being reverse analyzed by the attacker, effectively preventing the code for generating the token from being reverse analyzed by the attacker, so that the attacker cannot integrate the code for generating the token into the automated tool to automatically generate the token, thereby improving the security of the token. In addition, since the data hiding scheme is periodically and dynamically adjusted and the adjusted data hiding scheme has a corresponding expiration time, even if the attacker spends a lot of time reversely analyzing part of the total code used to generate the token, this part of the code has expired and is invalid, and it is meaningless to integrate it into the automated tool to automatically generate the token, thereby improving the security of the token. In addition, it can prevent the attacker from using the automated tool to automatically generate the token using the reverse analyzed code to access the network data and system resources, or further tamper with the network data and system resources or implant viruses, effectively ensuring the security of the network data and system resources.

[0165] Optionally, in some of the implementations, the hiding method may include, but is not limited to, any one or more of the following: XOR, encryption and decryption, encoding and decoding, splitting, negation, shifting, addition, subtraction, etc.

[0166] Optionally, in some of the implementations, in operation 403, the hidden processing result can be verified, encrypted and encoded in sequence to generate a token by executing the sub-codes corresponding to the verification algorithm scheme, encryption algorithm scheme and encoding algorithm scheme in the target overall code in sequence.

[0167] Optionally, in some of the implementations, in operation 401, the target total code, the first target scheme identifier and the second target scheme identifier sent by the service end may be specifically received, wherein the second target scheme identifier is used to identify the first target data structure scheme, and the first target data structure scheme is a data structure scheme within the current period determined from multiple candidate schemes existing in the data structure scheme according to a preset period. The data structure scheme may include, but is not limited to, any one or more of the following: a data storage location scheme, an insert redundant data scheme. The data storage location scheme is used to determine the position of the valid fields in the fields participating in the generation of the token in the data structure of the token, wherein the valid fields participating in the generation of the token may include, but are not limited to: a token version number, a token identifier, a token type, a token source, a token attribute, the current time of the client, at least one preset optional data, and the like. There are multiple candidate schemes for the data storage location scheme, and in different data storage location schemes, the positions of the fields participating in the generation of the token in the data structure of the token are different or not completely the same, and even the positions of the same field in the data structure of the token are different. Among them, the token version number (specific assignment) can be assigned to the token generated this time by the server according to a preset assignment method (such as random assignment, sequential assignment). The token version number can be an integer, a decimal, a floating point number, or a number, a letter, or a string composed of numbers and letters, etc. The token version number can be sent to the client together with the target total code and the third target scheme identifier when the server sends it to the client in operation 105, or the token version number can be carried in the third target scheme identifier and sent to the client. The embodiment of the present application does not limit the assignment method and composition of the token version number. The assignment of valid fields such as token ID, token type, token source, token attributes, client current time, optional data, etc. is specifically obtained by the client and uploaded and assigned to each valid field. According to the application business, the optional data may include user input data, mouse movement data, keyboard input statistics, environment-related data (such as window size, current operating system, CPU model, etc.), and the embodiment of the present application does not limit this.

[0168] The redundant data insertion scheme is a scheme for inserting redundant data into the data structure of the token, and there are multiple candidate schemes for the redundant data insertion scheme. Each redundant data insertion scheme includes: the number of invalid fields inserted, the position of each invalid field in the data structure of the token, and the redundant data assigned to each invalid field. According to the redundant data insertion scheme, different numbers of redundant data of invalid fields can be inserted into different positions in the fields involved in generating the token (for example, before or after a certain position in the data structure of the token). Accordingly, the first target data structure scheme includes the sub-code corresponding to the first target data structure scheme.

[0169] Correspondingly, in operation 402, by executing the sub-code corresponding to the first target data structure scheme, each valid field involved in generating the token can be assigned a value; then, by executing the sub-code corresponding to the first target data hiding scheme, the assignment information corresponding to the hidden field in the first target data hiding scheme is hidden in a corresponding hiding manner to obtain a hiding result, and then, by executing the sub-code corresponding to the verification algorithm scheme, the sub-code corresponding to the encryption algorithm scheme and the sub-code corresponding to the encoding algorithm scheme in the target total code, the hiding result or the specified information including the hiding result (all information or part of the specified information) is verified, encrypted and encoded in turn, so as to generate a token having a data structure determined by the first target data structure scheme and after hiding processing by the first target data hiding scheme.

[0170] Among them, regarding the data structure scheme and its specific implementation method of adjusting it according to the preset period, as well as the specific content and implementation method of the data storage location scheme, the redundant data insertion scheme and the data hiding scheme, please refer to the relevant records of the above embodiments of the present disclosure and will not be repeated here.

[0171] Optionally, in some of the implementations, in operation 401, the target total code, the first target scheme identifier and the client key sent by the server may be received. Accordingly, after the token is generated in operation 403, the token may be encrypted using the client key to obtain an encrypted token; then, in operation 404, the request content, the encrypted token and the first target scheme identifier may be sent to the server.

[0172] Optionally, in some of the implementations, before executing the embodiments of the present application, a preset method, such as Transport Layer Security (TLS) or a similar method, may be used between the server and the client to perform two-way authentication to ensure that the target total code and the second target scheme identifier used to generate the token can be sent to a legitimate client, thereby improving data security.

[0173] Optionally, in some of the implementations, in operation 105, the third target solution identifier may be encrypted using a preset encryption algorithm and a confidential server key (serverkey) to obtain an encrypted third target solution identifier, and the encrypted third target solution identifier may be sent to the client. The server key may be generated by the server in a preset manner, such as randomly generated or generated using a preset algorithm, and this embodiment of the present application does not limit this.

[0174] The preset encryption algorithm may be an encryption algorithm with higher encryption strength, such as AES256 or other encryption algorithms with encryption strength not less than AES256. The preset encryption algorithm and the confidential server key are only stored on the server and will not be spread or transmitted to the client, so as to improve the confidentiality and security of the second target solution identifier.

[0175] Accordingly, in operation 201, in response to receiving the request content, token, and encrypted first target scheme identifier sent by the client, the encrypted first target scheme identifier can be decrypted using the preset encryption algorithm and the server key, and in response to obtaining the first target scheme identifier through decryption, operation 202 is started; otherwise, if the first target scheme identifier is not decrypted, it means that the encrypted first target scheme identifier sent by the client is not the encrypted third target scheme identifier previously sent by the server to the client, which means that the encrypted third target scheme identifier sent by the server to the client may be tampered with or is forged information, and operation 202 and its subsequent processes are not performed, or a response message requiring identity authentication is further fed back to the client.

[0176] Based on this embodiment, the client uses a preset encryption algorithm and a confidential server key to encrypt the third target scheme identifier and then sends the encrypted third target scheme identifier and the target total code to the client. Since the preset encryption algorithm and the confidential server key are only stored on the server and only the server can know them, the confidentiality and security of the third target scheme identifier can be improved.

[0177] The following uses a specific application as an example to further illustrate the token generation method of the embodiment of the present application:

[0178] S1, the server adjusts the data hiding scheme and data structure scheme according to the preset period

[0179] The data structure scheme includes a data storage location scheme and a redundant data insertion scheme. There are multiple candidate schemes for the data storage location scheme, the redundant data insertion scheme and the data hiding scheme.

[0180] S2, in response to reaching the preset trigger condition, the server obtains the data hiding scheme within the current period (i.e., the data hiding scheme within the current period obtained by adjusting S1) as the second target data hiding scheme, and obtains the scheme identifier of the second target data hiding scheme as the third target scheme identifier; and obtains the data structure scheme within the current period (i.e., the data structure scheme within the current period obtained by adjusting S1) as the second target data structure scheme, and obtains the scheme identifier of the second target data structure scheme as the fourth target scheme identifier.

[0181] The second target data structure scheme includes a target data storage location scheme and a target redundant data insertion scheme. Accordingly, the fourth target scheme identifier includes a scheme identifier of the target data storage location scheme and a scheme identifier of the target redundant data insertion scheme.

[0182] S3, the server records the correspondence between the third target solution identifier, the fourth target solution identifier, and the second target data hiding solution and the expiration time information of the second target data structure solution in a correspondence table.

[0183] S4, the server updates the total code for generating the token based on the sub-code corresponding to the target data storage location scheme in the second target data structure scheme, the sub-code corresponding to the target redundant data insertion scheme, and the sub-code corresponding to the second target data hiding scheme, and obtains the target total code for generating the token in the current cycle, the target total code including the sub-code corresponding to the target data storage location scheme, the sub-code corresponding to the target redundant data insertion scheme, and the sub-code corresponding to the second target data hiding scheme.

[0184] S5, the server sends the target total code, the third target scheme identifier and the fourth target scheme identifier, and the pre-acquired client key to the client.

[0185] S6, the client receives the target total code, the first target scheme identifier and the second target scheme identifier, and the client key sent by the server.

[0186] Among them, the first target scheme identifier is used to identify the first target data hiding scheme. According to whether the third target scheme identifier and the fourth scheme identifier sent by the server are tampered with, the first target scheme identifier received by the client is different from or the same as the third target scheme identifier sent by the server, and the second target scheme identifier is different from or the same as the fourth target scheme identifier sent by the server. If the third target scheme identifier sent by the server has not been tampered with, the first target scheme identifier received by the client is the third target scheme identifier sent by the server, and the first target data hiding scheme is the second target data hiding scheme; otherwise, if the third target scheme identifier sent by the server has been tampered with, the first target scheme identifier received by the client is no longer the second target scheme identifier sent by the server, and the first target data hiding scheme is different from the second target data hiding scheme. Similarly, if the fourth target scheme identifier sent by the server has not been tampered with, the second target scheme identifier received by the client is the fourth target scheme identifier sent by the server, and the first target data structure scheme is the second target data structure scheme; otherwise, if the fourth target scheme identifier sent by the server has been tampered with, the first target scheme identifier received by the client is no longer the fourth target scheme identifier sent by the server, and the first target data structure scheme is different from the second target data structure scheme.

[0187] S7, the client executes the target general code to assign values ​​to the fields involved in generating the token respectively, and based on the first target data hiding scheme, uses the corresponding hiding method to perform hiding operation processing on the assignment information corresponding to the hidden field in the first target data hiding scheme to obtain the hiding processing result.

[0188] Specifically, the client first executes the sub-code corresponding to the target data storage location scheme in the target general code, and assigns values ​​to each valid field involved in generating the token (i.e., passing valid data to the corresponding position of the valid field). Then, by executing the sub-code corresponding to the first target data hiding scheme in the target general code, the assignment information of the hidden field (such as valid data and invalid data in the target general code) is hidden using the corresponding data hiding method to obtain the hiding processing result.

[0189] S8, the client generates a token based on the hidden processing result.

[0190] Specifically, the client executes the sub-code corresponding to the verification algorithm scheme, the sub-code corresponding to the encryption algorithm scheme, and the sub-code corresponding to the encoding algorithm scheme in the target total code in sequence, thereby verifying, encrypting and encoding the hidden processing result or the specified information including the hidden result (all information or part of the specified information), thereby generating a token.

[0191] S9, the client encrypts the token using the client key to obtain an encrypted token.

[0192] S10, the client sends the request content, the encrypted token, the first target scheme identifier and the second target scheme identifier to the server.

[0193] S11, in response to receiving the request content, the encrypted token and the first target solution identifier sent by the client, the server obtains the expiration time information corresponding to the first target solution identifier from the correspondence table.

[0194] S12, in response to obtaining the expiration time information corresponding to the first target solution identifier and the second target solution identifier from the correspondence table, the server confirms whether the first target data hiding solution and the first target data structure solution identified by the first target solution identifier and the second target solution identifier are expired based on the expiration time information corresponding to the first target solution identifier and the second target solution identifier.

[0195] Otherwise, if the expiration time information corresponding to the first target solution identifier is not obtained, it means that the first target solution identifier and / or the second target solution identifier does not exist, and the subsequent process is not executed.

[0196] S13, in response to the first target data hiding scheme and the first target data structure scheme not being expired, the server uses the client key to decrypt the encrypted token to obtain the token.

[0197] Otherwise, if the first target data hiding solution and the first target data structure solution have expired, the subsequent process will not be performed.

[0198] S14, the server decodes, decrypts and verifies the token in sequence based on the encoding algorithm scheme, encryption algorithm scheme and verification algorithm scheme corresponding to the target total code to obtain a processing result.

[0199] For example, in one implementation, the server uses a corresponding decoding algorithm to decode data according to the encoding algorithm scheme corresponding to the target total code, uses a corresponding decryption algorithm to decrypt data according to the encryption algorithm scheme corresponding to the target total code, and uses a corresponding verification algorithm to verify data according to the verification algorithm scheme corresponding to the target total code.

[0200] S15, the server performs a restoration operation corresponding to the first hiding method on the data corresponding to the first hidden field in the first processing result according to the first hidden field in the first target data hiding scheme and the first hiding method corresponding to the first hidden field, to obtain a second processing result, which includes specific information of each hidden field.

[0201] S16, the server obtains valid data from the second processing result based on the first target data structure solution.

[0202] Specifically, the server deletes redundant data based on the target redundant data insertion scheme identified by the scheme identifier of the target redundant data insertion scheme in the first target scheme identifier, and then finds the storage location of the valid data and extracts the valid data based on the target data storage location scheme identified by the scheme identifier of the target data storage location scheme in the first target scheme identifier.

[0203] S17, in response to obtaining valid data, the server processes the request content.

[0204] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described action sequence, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0205] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0206] Figure 5 This is a schematic diagram of the structure of a token generation device provided in one embodiment of the present application. The token generation device of this embodiment is applied to the server and can be used to implement the various token generation method embodiments implemented by the server mentioned above in the present application. Figure 5 As shown, the token generation device of this embodiment includes: an adjustment module 501, an acquisition module 502, a recording module 503, an update module 504 and a second sending module 505. Among them:

[0207] The adjustment module 501 is used to adjust the data hiding scheme according to a preset period. The data hiding scheme is a scheme for hiding all or part of the fields involved in generating tokens. There are multiple candidate schemes for the data hiding scheme; the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, and the hidden field is a field that needs to be hidden.

[0208] The acquisition module 502 is used to obtain the data hiding scheme in the current cycle as the second target data hiding scheme in response to reaching a preset trigger condition, and obtain the scheme identifier of the second target data hiding scheme as the third target scheme identifier; wherein each scheme identifier is used to uniquely identify a data hiding scheme, and the third target scheme identifier is used to identify the second target data hiding scheme; the second target data hiding scheme includes: a second hidden field and a second hiding method corresponding to the second hidden field.

[0209] The recording module 503 is used to record the correspondence between the third target solution identifier and the expiration time information of the second target data hiding solution in a correspondence table.

[0210] The updating module 504 is used to update the total code used to generate the token based on the sub-code corresponding to the second target data hiding scheme, and obtain the target total code used to generate the token in the current cycle, wherein the target total code includes the sub-code corresponding to the second target data hiding scheme.

[0211] The second sending module 505 is used to send the target total code and the third target scheme identifier to the client, so that the client can generate a token after the hiding operation is performed based on the second target data hiding scheme by executing the target total code.

[0212] For the detailed implementation and specific operations of each module in the token generation device of this embodiment, please refer to the embodiments of the token generation method implemented by the above-mentioned server of this application, which will not be repeated here.

[0213] Figure 6 This is a schematic diagram of the structure of a token generation device provided in another embodiment of the present application. The token generation device of this embodiment is applied to a client and can be used to implement the various token generation method embodiments implemented by the client mentioned above in the present application. Figure 6 As shown, the token generation device of this embodiment includes: Figure 6 As shown, the token generation device of this embodiment includes: a receiving module 601, a hiding module 602, a generating module 603 and a first sending module 604. Among them:

[0214] The receiving module 601 is used to receive a target total code and a first target scheme identifier sent by a server; wherein the first target scheme identifier is used to identify a first target data hiding scheme, and the first target data hiding scheme is a data hiding scheme within a current period determined from a plurality of candidate schemes existing in a preset period; the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, and the hidden field is a field that needs to be hidden; the target total code includes a subcode corresponding to the first target data hiding scheme.

[0215] The hiding module 602 is used to assign values ​​to the fields involved in generating the token respectively by executing the target general code, and based on the first target data hiding scheme, perform hiding operation processing on the assignment information corresponding to the hidden field in the first target data hiding scheme using the corresponding hiding method to obtain the hiding processing result.

[0216] The generating module 603 is used to generate a token based on the hiding processing result.

[0217] The first sending module 604 is configured to send the request content, the token and the first target scheme identifier to the server.

[0218] The detailed implementation and specific operations of each module in the token generation device of this embodiment can be found in the various token generation method embodiments implemented by the client side of this application, and will not be repeated here.

[0219] Figure 7 This is a schematic diagram of the structure of a token generation system provided in one embodiment of the present application. The token generation system of this embodiment can be used to implement the token generation method of each of the above embodiments of the present application. Figure 7 As shown, the token generation system of this embodiment includes: a server 701 and a client 702. Among them:

[0220] The server 701 is used to adjust the data hiding scheme according to a preset period, wherein the data hiding scheme is a scheme for hiding all or part of the fields involved in generating a token, and there are multiple candidate schemes for the data hiding scheme; the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, and the hidden field is a field that needs to be hidden; in response to reaching a preset trigger condition, the data hiding scheme in the current period is obtained as a second target data hiding scheme, and the scheme identifier of the second target data hiding scheme is obtained as a third target scheme identifier; wherein each scheme identifier is used to uniquely identify a data hiding scheme, and the third target scheme identifier is used to identify the second target data hiding scheme ; The second target data hiding scheme includes: a second hidden field and a second hiding method corresponding to the second hidden field; recording the correspondence between the third target scheme identifier and the expiration time information of the second target data hiding scheme in a correspondence table; updating the total code used to generate the token based on the sub-code corresponding to the second target data hiding scheme, and obtaining the target total code used to generate the token in the current cycle, wherein the target total code includes the sub-code corresponding to the second target data hiding scheme; sending the target total code and the third target scheme identifier to the client, so that the client generates a token after the hiding operation is processed based on the second target data hiding scheme by executing the target total code.

[0221] The client 702 is used to receive the target total code and the first target scheme identifier sent by the server 701; wherein the first target scheme identifier is used to identify the first target data hiding scheme, and the first target data hiding scheme is a data hiding scheme in the current period determined from multiple candidate schemes existing in the data hiding scheme according to a preset period; the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, and the hidden field is a field to be hidden; the target total code includes a sub-code corresponding to the first target data hiding scheme; by executing the target total code, the fields involved in generating the token are assigned values ​​respectively, and based on the first target data hiding scheme, the assignment information corresponding to the hidden field in the first target data hiding scheme is hidden by using the corresponding hiding method to obtain a hiding processing result; a token is generated based on the hiding processing result; the request content, the token and the first target scheme identifier are sent to the server 701.

[0222] In the embodiments of the present application, the specific implementation of the server 701 and the client 702 can refer to the devices of the token generation method in the above-mentioned corresponding embodiments of the present application, and will not be repeated here.

[0223] In addition, an embodiment of the present application further provides an electronic device, the electronic device comprising:

[0224] one or more processors;

[0225] a storage device for storing one or more programs,

[0226] When the one or more programs are executed by the one or more processors, the one or more processors implement the token generation method described in any of the above embodiments of the present application.

[0227] In addition, an embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the token generation method described in any of the above embodiments of the present application is implemented.

[0228] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0229] like Figure 8 As shown, the electronic device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the electronic device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0230] Multiple components in the electronic device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the electronic device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0231] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as the detection method of a Webshell file. For example, in some embodiments, the detection method of a Webshell file may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the detection method of the Webshell file described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform the detection method of a Webshell file by any other appropriate means (e.g., by means of firmware).

[0232] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0233] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0234] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0235] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0236] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0237] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0238] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0239] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A token generation method, characterized in that: Applied to the client, including: Receive a target total code and a first target solution identifier sent by a server; wherein the first target solution identifier is used to identify a first target data hiding solution, the first target data hiding solution being a data hiding solution for a current period determined from a plurality of candidate data hiding solutions according to a preset period; the data hiding solution comprising: a hidden field and a hiding method corresponding to the hidden field, wherein the hidden field is a field to be hidden; and the target total code includes a subcode corresponding to the first target data hiding solution; By executing the target general code, respectively assigning values ​​to the fields involved in generating the token, and based on the first target data hiding scheme, performing a hiding operation on the assigned value information corresponding to the hidden fields in the first target data hiding scheme using a corresponding hiding method, thereby obtaining a hiding result; generating a token based on the hidden processing result; Send the request content, the token and the first target scheme identifier to the server.

2. The method according to claim 1, characterized in that The hiding method includes any one or more of the following: XOR, encryption and decryption, encoding and decoding, splitting, negation, shifting, addition, and subtraction.

3. The method according to any one of claims 1-2, characterized in that The generating of a token based on the hidden processing result includes: By executing the target total code, the hidden processing result is verified, encrypted and encoded in sequence to generate a token.

4. The method according to any one of claims 1-2, characterized in that The receiving of the target total code and the first target solution identifier sent by the server includes: Receive the target total code, the first target scheme identifier and the second target scheme identifier sent by the service end; wherein, the second target scheme identifier is used to identify the first target data structure scheme; the first target data structure scheme is a data structure scheme within the current period determined from multiple candidate schemes existing in the data structure scheme according to a preset period; the data structure scheme includes any one or more of the following: a data storage location scheme, an insertion redundant data scheme; the data storage location scheme is used to determine the position of the valid fields in the fields participating in generating the token in the data structure of the token, and there are multiple candidate schemes for the data storage location scheme; the insertion redundant data scheme is a scheme for inserting redundant data into the data structure of the token, and there are multiple candidate schemes for the insertion redundant data scheme; the insertion redundant data scheme includes: the number of invalid fields inserted, the position of each invalid field in the data structure of the token, and the redundant data assigned to each invalid field; the first target data structure scheme includes a subcode corresponding to the first target data structure scheme; The target total code is executed to assign values ​​to the fields involved in generating the token respectively, and based on the first target data hiding scheme, the value information corresponding to the hidden fields in the first target data hiding scheme is hidden using a corresponding hiding method, including: By executing the subcode corresponding to the first target data structure solution, assigning values ​​to each valid field involved in generating the token; By executing the subcode corresponding to the first target data hiding scheme, the assignment information corresponding to the hidden field in the first target data hiding scheme is subjected to hiding operation processing using the corresponding hiding method.

5. The method according to any one of claims 1-2, characterized in that: The receiving of the target total code and the first target solution identifier sent by the server includes: Receiving the target total code, the first target solution identifier and the client key sent by the server; After generating a token based on the hidden processing result, the method further includes: Encrypting the token using the client key to obtain an encrypted token; The sending the request content, the token, and the first target solution identifier to the server includes: The request content, the encrypted token and the first target scheme identifier are sent to the server.

6. A token generation method, characterized in that: Applied to the server, including: Adjusting a data hiding scheme according to a preset period, wherein the data hiding scheme is a scheme for hiding all or part of the fields involved in generating a token, and there are multiple candidate schemes for the data hiding scheme; the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, wherein the hidden field is the field to be hidden; In response to a preset trigger condition being met, a data hiding scheme within the current period is obtained as a second target data hiding scheme, and a scheme identifier of the second target data hiding scheme is obtained as a third target scheme identifier; wherein each scheme identifier is used to uniquely identify a data hiding scheme, and the third target scheme identifier is used to identify the second target data hiding scheme; the second target data hiding scheme includes: a second hidden field and a second hiding mode corresponding to the second hidden field; Recording the correspondence between the third target solution identifier and the expiration time information of the second target data hiding solution in a correspondence table; updating a total code for generating tokens based on the subcode corresponding to the second target data hiding scheme, to obtain a target total code for generating tokens in the current cycle, wherein the target total code includes the subcode corresponding to the second target data hiding scheme; The target total code and the third target scheme identifier are sent to the client, so that the client generates a token after performing a hiding operation based on the second target data hiding scheme by executing the target total code.

7. The method according to claim 6, characterized in that The hiding method includes any one or more of the following: XOR, encryption and decryption, encoding and decoding, splitting, negation, shifting, addition, and subtraction.

8. The method according to any one of claims 6-7, characterized in that: Also includes: In response to receiving the request content, the token and the first target solution identifier sent by the client; Obtaining expiration time information corresponding to the first target solution identifier from the correspondence table; In response to acquiring the expiration time information corresponding to the first target solution identifier from the correspondence table, confirming whether the first target data hiding solution is expired based on the expiration time information corresponding to the first target solution identifier; In response to the first target data hiding scheme not being expired, sequentially decoding, decrypting, and verifying the token to obtain a first processing result; performing a restoration operation corresponding to the first hiding method on the data corresponding to the first hidden field in the first processing result according to the first hidden field in the first target data hiding scheme, to obtain a second processing result; Acquiring valid data from the second processing result; In response to obtaining valid data from the second processing result, the request content is processed.

9. The method according to claim 8, characterized in that Also includes: Adjust the data structure scheme according to the preset period; wherein the data structure scheme is used to determine the data structure of the token, and the data structure scheme includes any one or more of the following: a data storage location scheme, an insertion redundant data scheme; the data storage location scheme is used to determine the position of the valid fields among the fields participating in generating the token in the data structure of the token, and there are multiple candidate schemes for the data storage location scheme; the insertion redundant data scheme is a scheme for inserting redundant data into the data structure of the token, and there are multiple candidate schemes for the insertion redundant data scheme; the insertion redundant data scheme includes: the number of invalid fields inserted, the position of each invalid field in the data structure of the token, and the redundant data assigned to each invalid field; In response to the preset trigger condition being met, obtaining a data structure solution in the current cycle as a second target data structure solution, and obtaining a solution identifier of the second target data structure solution as a fourth target solution identifier, wherein the fourth target solution identifier is used to identify the second target data structure solution; The recording of the correspondence between the third target solution identifier and the expiration time information of the second target data hiding solution in the correspondence table includes: Recording the correspondence between the third target solution identifier, the fourth target solution identifier, and the expiration time information of the second target data hiding solution and the second target data structure solution in a correspondence table; The updating of the total code for generating the token based on the sub-code corresponding to the second target data hiding scheme to obtain the target total code for generating the token in the current cycle includes: updating a total code for generating tokens based on the subcode corresponding to the second target data structure scheme and the subcode corresponding to the second target data hiding scheme, to obtain a target total code for generating tokens in the current cycle, wherein the target total code also includes the subcode corresponding to the second target data structure scheme; The sending of the target total code and the third target scheme identifier to the client, so that the client generates a token after performing a hiding operation based on the second target data hiding scheme by executing the target total code, includes: The target total code, the third target scheme identifier and the fourth target scheme identifier are sent to the client, so that the client generates a token having a data structure determined by the second target data structure scheme and after a hiding operation is performed based on the second target data hiding scheme by executing the target total code.

10. The method according to claim 9, characterized in that The response to receiving the request content, the token and the first target solution identifier sent by the client includes: In response to receiving the request content, the token, the first target solution identifier and the second target solution identifier sent by the client; The acquiring the expiration time information corresponding to the first target solution identifier from the correspondence table includes: Acquire expiration time information corresponding to the second target solution identifier and the fourth target solution identifier from the correspondence table; In response to acquiring the expiration time information corresponding to the first target solution identifier from the correspondence table, confirming whether the first target data hiding solution is expired based on the expiration time information corresponding to the first target solution identifier includes: In response to obtaining expiration time information corresponding to the first target solution identifier and the second target solution identifier from the correspondence table, confirming whether the first target data hiding solution and the first target data structure solution are expired based on the expiration time information corresponding to the first target solution identifier and the second target solution identifier; In response to the first target data hiding scheme not being expired, sequentially decoding, decrypting, and verifying the token to obtain a first processing result includes: In response to the first target data hiding scheme and the first target data structure scheme not being expired, the token is sequentially decoded, decrypted, and verified to obtain a first processing result.

11. The method according to any one of claims 9-10, characterized in that: The obtaining of valid data from the second processing result includes: Valid data is obtained from the second processing result based on the first target data structure scheme.

12. The method according to claim 11, characterized in that The obtaining valid data from the second processing result based on the first target data structure scheme includes: Based on the first target data structure solution, the assignment values ​​of each valid field are extracted from the position of each valid field in the second processing result.

13. The method according to any one of claims 9-10, characterized in that: The step of adjusting the data hiding scheme according to the preset period includes: Selecting a candidate solution from the candidate solutions corresponding to the data hiding solution in sequence or randomly according to the preset period as the data hiding solution in the current period; The scheme for adjusting the data structure according to the preset period includes: In response to the data structure scheme including a data storage location scheme, selecting a candidate scheme from candidate schemes corresponding to the data storage location scheme in sequence or randomly according to the preset period as the data storage location scheme in the current period; In response to the data structure scheme including a redundant data insertion scheme, a candidate scheme is selected sequentially or randomly from candidate schemes corresponding to the redundant data insertion scheme according to the preset period as the redundant data insertion scheme in the current period.

14. The method according to claim 8, characterized in that The sending the target total code and the third target solution identifier to the client includes: The target total code, the third target scheme identifier, and a pre-acquired client key are sent to the client; wherein the client key is used by the client to encrypt the token.

15. The method according to claim 14, characterized in that The response to receiving the request content, the token and the first target solution identifier sent by the client includes: In response to receiving the request content, the encrypted token and the first target scheme identifier sent by the client; Before sequentially decoding, decrypting and verifying the token, the method further includes: The encrypted token is decrypted using the client key to obtain the token.

16. The method according to any one of claims 6-7, characterized in that: Before updating the total code for generating the token based on the sub-code corresponding to the second target data hiding scheme, the method further includes: A total code for generating a token is generated based on a sub-code corresponding to a preset data structure scheme, a sub-code corresponding to a preset data hiding scheme, and a sub-code corresponding to a preset algorithm-related scheme; wherein the preset algorithm-related scheme includes a preset verification algorithm scheme, a preset encryption algorithm scheme, and a preset encoding algorithm scheme.

17. A token generation device, characterized in that: Applied to the client, including: A receiving module, configured to receive a target total code and a first target solution identifier sent by a server; wherein the first target solution identifier is used to identify a first target data hiding solution, the first target data hiding solution being a data hiding solution for a current period determined from a plurality of candidate data hiding solutions according to a preset period; the data hiding solution comprising: a hidden field and a hiding method corresponding to the hidden field, wherein the hidden field is a field to be hidden; and the target total code including a subcode corresponding to the first target data hiding solution; a hiding module, configured to assign values ​​to the fields involved in generating the token respectively by executing the target general code, and based on the first target data hiding scheme, perform a hiding operation on the assigned value information corresponding to the hidden fields in the first target data hiding scheme using a corresponding hiding method to obtain a hiding result; A generating module, configured to generate a token based on the hidden processing result; The first sending module is configured to send the request content, the token and the first target solution identifier to the server.

18. A token generation device, characterized in that: Applied to the server, including: An adjustment module is configured to adjust a data hiding scheme according to a preset period, wherein the data hiding scheme is a scheme for hiding all or part of the fields involved in generating a token, and there are multiple candidate data hiding schemes; the data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, wherein the hidden field is the field to be hidden; an acquisition module, configured to, in response to a preset trigger condition being met, acquire a data hiding scheme within a current period as a second target data hiding scheme, and acquire a scheme identifier of the second target data hiding scheme as a third target scheme identifier; wherein each scheme identifier is used to uniquely identify a data hiding scheme, and the third target scheme identifier is used to identify the second target data hiding scheme; the second target data hiding scheme includes: a second hidden field and a second hiding method corresponding to the second hidden field; a recording module, configured to record in a correspondence table a correspondence between the third target solution identifier and the expiration time information of the second target data hiding solution; an updating module, configured to update a total code for generating tokens based on the subcode corresponding to the second target data hiding scheme, to obtain a target total code for generating tokens in a current cycle, wherein the target total code includes the subcode corresponding to the second target data hiding scheme; The second sending module is used to send the target total code and the third target scheme identifier to the client, so that the client generates a token after the hiding operation is performed based on the second target data hiding scheme by executing the target total code.

19. An electronic device, characterized in that: The electronic device comprises: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 16.

20. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 16 is implemented.

Images