Token generation method and apparatus, electronic device, and storage medium

Abstract

The application provides a token generation method and device, electronic equipment and a storage medium. By receiving a target total code and a first target scheme identifier sent by a server, the first target scheme identifier identifies a first target algorithm related scheme, which is obtained by the server adjusting an algorithm related scheme for generating a token according to a preset period, the algorithm related scheme including an encoding algorithm scheme, an encryption algorithm scheme and a verification algorithm scheme, the target total code including a sub-code corresponding to a target encoding algorithm scheme in the first target algorithm related scheme, a sub-code corresponding to a target encryption algorithm scheme and a sub-code corresponding to a target verification algorithm scheme; by executing the target total code, the assignment information of a field participating in the generation of the token is processed based on the first target algorithm related scheme, a token is obtained, and the request content, the token and the first target scheme identifier are sent to the server. In this way, the security of the token is improved.

Description

[Technical Field]

[0001] This application relates to network security technology, and more particularly to a token generation method and apparatus, electronic device and storage medium. [Background Technology]

[0002] With the development of internet technology, the amount of data and resources stored and provided through the network is increasing, and the resulting cybersecurity issues are becoming increasingly serious. Currently, cybersecurity threats are growing, and various applications urgently need better technologies to ensure security. Therefore, protecting the security of data and resources stored on the network is becoming increasingly important.

[0003] The common approach involves the client generating a token as a temporary key and sending it to the server. This token acts like a username and password, determining whether the request is allowed and identifying the user making the request. It allows the client to access network data and system resources without providing a password or other credentials. The server verifies the token's validity to determine if the client is authorized to access network data and system resources.

[0004] In the process of developing this application, the inventors discovered that the code for generating tokens on the client side is easily reverse-engineered and thoroughly analyzed by attackers. Subsequently, attackers can use automated tools to automatically generate tokens using this code and send them to the server. The server has difficulty distinguishing whether the received token was sent by a user with access rights through the client or by an attacker. As a result, attackers can use the token to access network data and system resources, or further tamper with network data and system resources or implant viruses, which may cause great losses to users. [Summary of the Invention]

[0005] This application provides a token generation method and apparatus, electronic device and storage medium, among other things, to improve the security of tokens.

[0006] One aspect of this application provides a token generation method applied to a client, the method comprising:

[0007] The system receives a target total code and a first target scheme identifier sent by the server. The first target scheme identifier identifies a first target algorithm-related scheme, which is an algorithm-related scheme for the current period obtained by the server adjusting the algorithm-related schemes participating in token generation according to a preset period. The algorithm-related scheme includes an encoding algorithm scheme, an encryption algorithm scheme, and a verification algorithm scheme. Each of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme has multiple candidate schemes. The first target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. The target total code includes sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme within the first target algorithm-related scheme.

[0008] By executing the target code, the assignment information of the fields involved in generating the token is processed accordingly based on the first target algorithm related scheme to obtain the token. The token includes data obtained by processing the assignment information of the fields involved in generating the token according to the first target algorithm related scheme.

[0009] The request content, the token, and the identifier of the first target scheme are sent to the server.

[0010] Another aspect of this application provides an alternative token generation method for use on a server side, including:

[0011] According to a preset cycle, the algorithm-related schemes involved in generating tokens are adjusted; wherein, the algorithm-related schemes include encoding algorithm schemes, encryption algorithm schemes, and verification algorithm schemes; each of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme has multiple candidate schemes;

[0012] In response to the achievement of a preset trigger condition, the algorithm-related schemes within the current period are acquired as the second target algorithm-related schemes, and the scheme identifiers of the second target algorithm-related schemes are acquired as the second target scheme identifiers. Each scheme identifier is used to identify an algorithm-related scheme, and the scheme identifiers include the algorithm identifiers of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme. The second target scheme identifier is used to identify the second target algorithm-related scheme, which includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. The second target scheme identifier includes the algorithm identifiers of the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme.

[0013] Record the correspondence between the identifier of the second target scheme and the expiration time information of the schemes related to the second target algorithm in the correspondence table;

[0014] Based on the sub-code corresponding to the second target algorithm scheme, update the total code used to generate tokens to obtain the target total code used to generate tokens in the current period. The target total code includes the sub-code corresponding to the target encoding algorithm scheme, the sub-code corresponding to the target encryption algorithm scheme, and the sub-code corresponding to the target verification algorithm scheme.

[0015] The target total code and the second target scheme identifier are sent to the client so that the client can generate a token based on the second target algorithm related scheme by executing the target total code.

[0016] Another aspect of this application provides a token generation device for use on a client, comprising:

[0017] A receiving module is used to receive a target total code and a first target scheme identifier sent by the server. The first target scheme identifier identifies a first target algorithm-related scheme, which is an algorithm-related scheme for the current period obtained by the server adjusting the algorithm-related schemes participating in token generation according to a preset period. The algorithm-related scheme includes an encoding algorithm scheme, an encryption algorithm scheme, and a verification algorithm scheme. Each of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme has multiple candidate schemes. The first target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. The target total code includes sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme within the first target algorithm-related scheme.

[0018] The generation module is used to execute the target general code and process the assignment information of the fields participating in the generation of the token according to the relevant scheme of the first target algorithm to obtain the token. The token includes data obtained by processing the assignment information of the fields participating in the generation of the token according to the relevant scheme of the first target algorithm.

[0019] The first sending module is used to send the request content, the token, and the first target scheme identifier to the server.

[0020] Another aspect of this application provides a different token generation device for use on a server, comprising:

[0021] The adjustment module is used to adjust the algorithm-related schemes involved in token generation according to a preset period; wherein, the algorithm-related schemes include encoding algorithm schemes, encryption algorithm schemes, and verification algorithm schemes; each of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme has multiple candidate schemes;

[0022] The acquisition module is used to, in response to reaching a preset trigger condition, acquire algorithm-related schemes within the current period as second target algorithm-related schemes, and acquire the scheme identifier of the second target algorithm-related scheme as a second target scheme identifier; wherein, each scheme identifier is used to identify an algorithm-related scheme, and the scheme identifier includes the algorithm identifier of the encoding algorithm scheme, the algorithm identifier of the encryption algorithm scheme, and the algorithm identifier of the verification algorithm scheme; the second target scheme identifier is used to identify the second target algorithm-related scheme, the second target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme, and the second target scheme identifier includes the algorithm identifier of the target encoding algorithm scheme, the algorithm identifier of the target encryption algorithm scheme, and the algorithm identifier of the target verification algorithm scheme;

[0023] The recording module is used to record the correspondence between the identifier of the second target scheme and the expiration time information of the related schemes of the second target algorithm in the correspondence table;

[0024] The update module updates the total code used to generate tokens based on the sub-codes corresponding to the second target algorithm related scheme, to obtain the target total code used to generate tokens in the current period. The target total code includes the sub-codes corresponding to the target encoding algorithm scheme, the sub-codes corresponding to the target encryption algorithm scheme, and the sub-codes corresponding to the target verification algorithm scheme.

[0025] The second sending module is used to send the target total code and the second target scheme identifier to the client, so that the client can generate a token based on the second target algorithm related scheme by executing the target total code.

[0026] In another aspect, this application provides an electronic device, the electronic device comprising:

[0027] One or more processors;

[0028] Storage device for storing one or more programs.

[0029] When the one or more programs are executed by the one or more processors, the one or more processors implement the token generation method provided in the above-described aspect.

[0030] In another aspect of this application, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the token generation method provided in the preceding aspect.

[0031] As described in the above technical solution, the server can adjust the algorithm-related schemes involved in token generation according to a preset period. Since these schemes include encoding, encryption, and verification algorithms, and each of these algorithms has multiple candidate schemes, the number of possible combinations of algorithm-related schemes involved in token generation can reach dozens, hundreds, or even tens of millions. This ensures that the code sent from the server to the client for token generation changes periodically and dynamically. This also dynamically changes the tokens generated by the client, greatly increasing the difficulty for attackers to reverse engineer the token generation code. This effectively prevents attackers from integrating the token generation code into automated tools to automatically generate tokens, thus improving token security. Furthermore, because the algorithm-related schemes involved in token generation are periodically and dynamically adjusted, and the target algorithm-related schemes all have corresponding expiration times, even if an attacker spends a significant amount of time reverse engineering a portion of the code used to generate a token, that portion has already expired and is invalid. Integrating it into an automated tool to automatically generate tokens would be meaningless, further enhancing token security.

[0032] In addition, based on the technical solution provided in this application, the server can send the target total code for generating the token and the second target scheme identifier together to the client. After the client generates the token based on the target total code, it can return the request content, the generated token and the received first target scheme identifier to the server. In this way, the server can obtain the corresponding first target algorithm related scheme based on the first target scheme identifier to process the token, thereby improving the token's identifiability and security.

[0033] In addition, based on the technical solution provided in this application, attackers can be prevented from using automated tools to automatically generate tokens to access network data and system resources using reverse-analyzed code, or from further tampering with network data and system resources or implanting viruses, thus effectively ensuring the security of network data and system resources. [Attached Image Description]

[0034] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 A schematic flowchart illustrating a token generation method provided in an embodiment of this application;

[0036] Figure 2A flowchart illustrating a token generation method provided in another embodiment of this application;

[0037] Figure 3 A schematic flowchart illustrating a token generation method provided in yet another embodiment of this application;

[0038] Figure 4 This is a schematic diagram of the structure of a token generation device provided in an embodiment of this application;

[0039] Figure 5 This is a schematic diagram of the structure of a token generation device provided in another embodiment of this application;

[0040] Figure 6 This is a schematic diagram of the structure of a token generation system provided in an embodiment of this application;

[0041] Figure 7 This is a schematic block diagram of an example electronic device that can be used to implement embodiments of this application.

Detailed Implementation Methods

[0042] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0043] It should be noted that the terminals involved in the embodiments of this application may include, but are not limited to, mobile phones, personal digital assistants (PDAs), wireless handheld devices, tablet computers, personal computers (PCs), MP3 players, MP4 players, wearable devices (e.g., smart glasses, smartwatches, smart bracelets, etc.).

[0044] Those skilled in the art will understand that the terms "first" and "second" in the embodiments of this disclosure are only used to distinguish different steps, devices, modules, objects, information, etc., and do not represent any specific technical meaning, nor do they indicate the necessary logical order between them, nor do they indicate whether the first object and the second object are necessarily the same or different.

[0045] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0046] In related technologies, clients generate tokens based on fixed code. For example, in one related technology, the client executes fixed code, receives data for generating the token, and sequentially verifies, encrypts, and encodes the data using a fixed verification algorithm, encryption algorithm, and encoding algorithm.

[0047] Because in related technologies, the client generates tokens based on fixed code, the code used by the client to generate the tokens can be easily reverse-engineered and thoroughly analyzed by attackers. Then, attackers can use automated tools to automatically generate tokens using this code and send them to the server. The server has difficulty distinguishing whether the received token was sent by a user with access rights through the client or by an attacker. As a result, attackers can use the token to access network data and system resources, or further tamper with network data and system resources or implant viruses, which may cause great losses to users.

[0048] Therefore, there is an urgent need to provide a method and apparatus for dynamically generating tokens, electronic devices, and computer-readable storage media to improve token security.

[0049] The design concept of this application is that the server can adjust the algorithm-related schemes involved in token generation according to a preset period, including encoding algorithm schemes, encryption algorithm schemes, and verification algorithm schemes. This ensures that the code sent by the server to the client for token generation changes periodically and dynamically. In this way, the tokens generated by the client also change dynamically, which greatly increases the difficulty for attackers to reverse engineer the token generation code and effectively prevents attackers from reverse engineering the token generation code. In addition, since the algorithm-related schemes involved in token generation are dynamically adjusted and the second target algorithm-related schemes sent to the client have corresponding expiration times, even if an attacker spends a lot of time reverse engineering a part of the code used to generate a token, this part of the code has expired and is invalid. Therefore, attackers cannot integrate the token generation code into automated tools to automatically generate tokens, thereby improving the security of the token.

[0050] The embodiments of this application can be applied to various electronic devices with a client-server (C / S) architecture.

[0051] Figure 1 This is a flowchart illustrating a token generation method provided in one embodiment of this application. This embodiment is applied to a server, such as... Figure 1 As shown.

[0052] 101. Adjust the algorithm-related schemes involved in token generation according to the preset cycle.

[0053] The algorithm-related schemes refer to the corresponding algorithm schemes used in the token generation process to process data (e.g., verification, encryption, encoding, etc.), which may include encoding algorithm schemes, encryption algorithm schemes, and verification algorithm schemes. Each of the encoding, encryption, and verification algorithm schemes has multiple candidate schemes, and each candidate scheme has a corresponding algorithm identifier (ID). Each algorithm identifier is used to uniquely identify an algorithm and can be pre-assigned by the server. This algorithm identifier can be, for example, the algorithm name, a server-side globally unique algorithm number, or a combination of both. This application does not limit the specific composition of the algorithm identifier.

[0054] In the algorithm-related schemes, multiple candidate schemes are provided for the verification, encryption and encoding stages in the token generation process, for selection each time.

[0055] For example, the verification algorithm used in the verification stage may include multiple candidate schemes such as MD5, SHA-1, SHA-2, CRC32, CRC16, CRC8, LRC, SM3, or other verification algorithms, and each candidate scheme can be assigned a corresponding algorithm identifier (ID). The encryption algorithm used in the encryption stage may include multiple candidate schemes such as AES128, AES256, 3DES, SM4, RC5, RC6, or other encryption algorithms, and each candidate scheme can be assigned a corresponding algorithm identifier. The encoding algorithm used in the encoding stage may include, but is not limited to, multiple candidate schemes such as Base81, Base56, Base64, or other encoding schemes, and each candidate scheme can be assigned a corresponding algorithm identifier.

[0056] The preset period duration can be set according to actual needs and can be updated as needed, for example, it can be 30 seconds, 2 minutes, 1 hour, etc.

[0057] 102. In response to the achievement of a preset triggering condition, obtain the algorithm-related scheme within the current period as the second target algorithm-related scheme, and obtain the scheme identifier of the second target algorithm-related scheme as the first target scheme identifier.

[0058] The second target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. Each scheme identifier is used to identify an algorithm-related scheme, and this scheme identifier includes the algorithm identifiers of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme. Correspondingly, the second target scheme identifier is used to identify the second target algorithm-related scheme, and the second target scheme identifier includes the algorithm identifiers of the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme.

[0059] In this embodiment, the preset trigger condition is a condition pre-set by the server to trigger the generation of the general code for generating tokens, so that the client can generate tokens based on the general code. This preset trigger condition can be set according to actual needs. For example, in one specific implementation, the server can use real-time, random, or idle time as the preset trigger condition to trigger the generation of the general code for generating tokens, executing operations 102-104 of this embodiment, and then executing operation 105 when the client needs it later. As another example, in another specific implementation, some preset user events can be used as preset trigger conditions. The server can listen to preset user events through the client, such as whether there are mouse or keyboard input signals generated by user operations. When the client listens to these user events, it will trigger the server to generate the general code for generating tokens, executing operations 102-105 of this embodiment. For example, in another specific implementation, the server can preset a period as a preset trigger condition, and periodically trigger the generation of the main code for generating tokens through a timer, execute operations 102-104 in this embodiment, and execute operation 105 when the client needs it later; or directly execute operations 101-105 in this embodiment.

[0060] Then, operations 103 and 104 can be performed respectively.

[0061] 103. Record the correspondence between the second target algorithm related schemes, the second target scheme identifier and the expiration time information of the second target algorithm related schemes in the correspondence table.

[0062] Optionally, the correspondence may also include a second target algorithm related scheme, or the correspondence between the second target algorithm related scheme and the second target scheme identifier may be recorded in a separate table. This application embodiment does not limit this.

[0063] The expiration time information for the second target algorithm-related scheme can include a start time and a valid duration. In one specific implementation, the start time can be the time when the server obtains the second target algorithm-related scheme, and the valid duration can be the duration of the preset period. In another specific implementation, the start time of the preset period can be used as the start time, and the valid duration can be the duration of the preset period. Alternatively, a duration not exceeding the preset period can be randomly selected as the valid duration, and the size of the valid duration can be updated as needed, for example, it can be 30 seconds, 2 minutes, 5 minutes, etc.

[0064] Therefore, the server can use the second target scheme identifier to record which algorithm-related scheme is used to generate tokens in the current period.

[0065] 104. Based on the sub-code corresponding to the second target algorithm scheme, update the total code used to generate tokens to obtain the target total code used to generate tokens in the current period.

[0066] The target master code includes sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme. This target master code has a one-to-one correspondence with the related schemes of the second target algorithm.

[0067] Operations 103 and 104 can be executed simultaneously or in any order; this application embodiment does not impose any restrictions on this.

[0068] 105. Send the target total code and the second target scheme identifier to the client so that the client can generate a token based on the second target algorithm related scheme by executing the target total code.

[0069] In practical applications, the server can send the target master code and the second target scheme identifier to the client when the client needs to send the request content of the business request to the server, or it can send the target master code and the second target scheme identifier to the client in advance, so that the client can generate a token by executing the target master code before sending the request content of the business request to the server.

[0070] In this way, the server can adjust the algorithm-related schemes involved in token generation according to a preset period. Since the algorithm-related schemes include encoding, encryption, and verification algorithms, and each of these schemes has multiple candidate schemes, the number of possible combinations of algorithm-related schemes involved in token generation can reach dozens, hundreds, or even tens of millions. This ensures that the code sent by the server to the client for token generation changes periodically and dynamically. This also means that the tokens generated by the client change dynamically, greatly increasing the difficulty for attackers to reverse engineer the token generation code. This effectively prevents attackers from integrating the token generation code into automated tools to automatically generate tokens, thus improving token security. Furthermore, because the algorithm-related schemes involved in token generation are periodically and dynamically adjusted, and the target algorithm-related schemes sent to the client all have corresponding expiration times, even if an attacker spends a lot of time reverse engineering a portion of the code used to generate a token, that portion of code has already expired and is invalid. Integrating it into an automated tool to automatically generate tokens would be meaningless, thus further improving token security. In addition, it can prevent attackers from using automated tools to automatically generate tokens to access network data and system resources using reverse-engineered code, or from further tampering with network data and system resources or implanting viruses, thus effectively ensuring the security of network data and system resources.

[0071] Optionally, in some implementations, in operation 101, a candidate scheme can be selected sequentially or randomly from the candidate schemes corresponding to the encoding algorithm scheme according to a preset period as the encoding algorithm scheme for the current period; a candidate scheme can be selected sequentially or randomly from the candidate schemes corresponding to the encryption algorithm scheme as the encryption algorithm scheme for the current period; and a candidate scheme can be selected sequentially or randomly from the candidate schemes corresponding to the verification algorithm scheme as the verification algorithm scheme for the current period.

[0072] Based on this embodiment, the target encoding algorithm scheme, target encryption algorithm scheme, and target verification algorithm scheme corresponding to the encoding algorithm scheme, encryption algorithm scheme, and verification algorithm scheme in the algorithm-related scheme can be dynamically determined. This makes the algorithm-related schemes involved in token generation change dynamically, greatly increasing the difficulty for attackers to reverse engineer the token generation code. This effectively prevents attackers from reverse engineering the token generation code, thus preventing attackers from integrating the token generation code into automated tools to automatically generate tokens.

[0073] Optionally, in some implementations, candidate schemes for encoding algorithms, encryption algorithms, and verification algorithms, as well as the corresponding sub-codes for each candidate scheme, can be pre-set; or, the candidate schemes for encoding algorithms, encryption algorithms, and verification algorithms, as well as the corresponding sub-codes for each candidate scheme, can be further updated.

[0074] Based on this embodiment, the algorithm-related schemes involved in token generation can be dynamically updated, thereby further increasing the difficulty for attackers to reverse engineer the token generation scheme or code.

[0075] Optionally, in some implementations, after obtaining the target encoding algorithm scheme, target encryption algorithm scheme, and target verification algorithm scheme in operation 102, the sub-codes corresponding to the target encoding algorithm scheme, target encryption algorithm scheme, and target verification algorithm scheme can be obtained from the pre-set candidate schemes for encoding algorithm scheme, candidate schemes for encryption algorithm scheme, and candidate schemes for verification algorithm scheme, as well as the sub-codes corresponding to each candidate scheme.

[0076] Figure 2 A flowchart illustrating a token generation method provided in another embodiment of this application is shown below. Figure 2 As shown, in Figure 1 Based on the illustrated embodiment, it may also include:

[0077] 201, responds to receiving the request content, token, and first target scheme identifier sent by the client.

[0078] The request content refers to the content that the client requests the server to process. For example, the request content may be a network data access request, a system resource access request, a user's personal information update request, etc. This disclosure does not restrict the specific business type and specific content corresponding to the request content.

[0079] In this embodiment of the application, "first" and "second" are used only to distinguish different or potentially different referents. The first target scheme identifier is the target scheme identifier sent by the client to the server, which may be an unaltered session key issued by the server to the client. In this case, the first target scheme identifier is the second target scheme identifier. Alternatively, the first target scheme identifier may also be a target scheme identifier that has been tampered with after being issued by the server. In this case, the first target scheme identifier is different from the second target scheme identifier, and the target total code issued at the same time as the second target scheme identifier may also have been tampered with.

[0080] 202. Obtain the expiration time information corresponding to the first target scheme identifier from the correspondence table.

[0081] Specifically, the first target algorithm-related scheme and expiration time information corresponding to the first target scheme identifier are obtained, that is, the expiration time information of the first target algorithm-related scheme identified by the first target scheme identifier.

[0082] If the expiration time information corresponding to the first target scheme identifier is obtained from the correspondence table, it indicates that the first target scheme identifier exists, and operation 203 is executed; otherwise, if the expiration time information corresponding to the first target scheme identifier is not obtained from the correspondence table, it can be considered that the first target scheme identifier does not exist, and the second target scheme identifier sent to the client has been tampered with. The subsequent process of this embodiment is not executed, or a response message requiring identity authentication is further sent to the client.

[0083] 203. In response to obtaining the expiration time information corresponding to the first target scheme identifier from the correspondence table, confirm whether the first target algorithm related scheme identified by the first target scheme identifier has expired based on the expiration time information corresponding to the first target scheme identifier.

[0084] The expiration time information corresponding to the first target scheme identifier can include a start time and a valid duration. In one specific implementation, the start time can be the time when the server generates the relevant scheme for the first target algorithm, and the valid duration can be the duration of the preset period. In another specific implementation, the start time of the preset period can be used as the start time, and the valid duration can be the duration of the preset period. Alternatively, a duration not exceeding the preset period can be randomly selected as the valid duration, and the size of the valid duration can be updated as needed, for example, it can be 30 seconds, 2 minutes, 5 minutes, etc.

[0085] If the solution related to the first target algorithm has not expired, operation 204 is executed; otherwise, if the solution related to the first target algorithm has expired, operation 204 and its subsequent processes are not executed, or a response message requiring authentication is sent to the client.

[0086] For example, based on the start time and validity period in the expiration time information corresponding to the first target scheme identifier, the time when the server receives the token can be used as the current time to determine whether the current time is within the validity period. If the current time is within the validity period, it is confirmed that the scheme related to the first target algorithm has not expired; otherwise, if the current time is not within the validity period, it is confirmed that the scheme related to the first target algorithm has expired.

[0087] 204. The token is processed based on the relevant scheme of the first objective algorithm to obtain the processing result.

[0088] Optionally, in some implementations, in operation 204, the token can be sequentially decoded, decrypted, and verified based on the target encoding algorithm, target encryption algorithm, and target verification algorithm in the first target algorithm-related scheme. If the verification passes, operation 205 is executed. Otherwise, if the verification fails, the subsequent processes of this embodiment are not executed, or a response message indicating that authentication is required is further sent to the client.

[0089] For example, in some specific implementations, in operation 102 of the above embodiment, a preset verification algorithm can be used to perform verification calculations on the second target scheme identifier, which includes the algorithm identifiers of the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme, to obtain a second verification value. Accordingly, the second target scheme identifier also includes the second verification value. Then, in operation 204, the token can be decoded based on the target encoding algorithm scheme in the first target algorithm related scheme to obtain a decoding result; then, based on the target encryption algorithm scheme in the first target algorithm related scheme, the decoding result is decrypted to obtain a decryption result; furthermore, based on the target verification algorithm scheme in the first target algorithm related scheme, verification calculations are performed on each algorithm identifier in the first target scheme identifier in the decryption result to obtain a third verification value. The third verification value is compared with the first verification value in the first target scheme identifier. If the third verification value is the same as the first verification value, the verification passes; otherwise, if the third verification value is different from the first verification value, the verification fails.

[0090] 205. Based on the data structure scheme corresponding to the token, obtain valid data from the processing results.

[0091] The data structure scheme is used to determine the data structure of the token. The data structure scheme is a scheme for the data structure (e.g., position, hiding method, etc.) of each part of the data (i.e., fields) involved in generating the token within the token.

[0092] The valid data consists of the values ​​assigned to each valid field (i.e., the fields that the token must include in the preset rules, such as token version number, token ID, token type, token source, token attributes, client current time, optional data, etc.). The token version number (specifically assigned) is assigned by the server to the version number of the token used for this generation according to a preset allocation method (e.g., random allocation, sequential allocation). The token version number can be an integer, decimal, floating-point number, or a string composed of numbers, letters, or a combination of numbers and letters, etc. The token version number can be sent to the client by the server along with the target total code and the second target scheme identifier, or it can be sent to the client with the token version number carried in the second target scheme identifier. This application embodiment does not limit the allocation method and composition of the token version number, or the specific method of sending it to the client. The client obtains and uploads the values ​​of valid fields such as token ID, token type, token source, token attributes, client current time, and optional data. Depending on the application's business, optional data may include user input data, mouse movement data, keyboard input statistics, and environment-related data (such as window size, current operating system, CPU model, etc.). This application embodiment does not impose any restrictions on this.

[0093] If valid data is obtained from the processing result, indicating that the processing result is readable and valid, operation 206 is executed; otherwise, if valid data is not obtained from the processing result, operation 206 and its subsequent processes are not executed, or a response message requiring authentication is further sent to the client.

[0094] 206. Process the request content sent by the client.

[0095] Based on this embodiment, the server can dynamically adjust the algorithm-related schemes involved in token generation, sending the target total code for token generation along with the second target scheme identifier to the client. After the client generates a token based on the target total code, it can return the request content, the generated token, and the received first target scheme identifier to the server. In this way, the server can obtain the corresponding first target algorithm-related scheme based on the first target scheme identifier to process the token, thereby improving the token's identifiability and security. Furthermore, each second target algorithm-related scheme sent by the server to the client has a corresponding expiration time. Even if an attacker spends a lot of time reverse engineering and analyzing a portion of the code used to generate a token, this portion of code has already expired and is invalid. Integrating it into an automated tool to automatically generate tokens would be meaningless, thus improving token security.

[0096] Optionally, in some implementations, the data structure scheme corresponding to the token is a pre-defined data structure scheme. Accordingly, the target general code includes sub-code corresponding to this pre-defined data structure scheme.

[0097] In this way, by executing the target code, the client assigns values ​​to each field involved in generating the token, and processes the assigned values ​​of each field according to the relevant scheme of the first target algorithm (such as verification, encryption and encoding), thus generating a token with a data structure determined by a pre-set data structure scheme and processed by the relevant scheme of the first target algorithm.

[0098] Optionally, in some implementations, the data structure scheme corresponding to the token is the first target data structure scheme corresponding to the third target scheme identifier. Accordingly, the token generation method in this embodiment may further include: adjusting the data structure scheme according to the preset period, wherein there are multiple candidate schemes for the data structure scheme; in response to reaching the preset triggering condition, obtaining the data structure scheme within the current period as the second target data structure scheme, and obtaining the scheme identifier of the second target data structure scheme as the fourth target scheme identifier, wherein the fourth target scheme identifier is used to identify the second target data structure scheme. Accordingly, in operation 103, the correspondence between the second target scheme identifier, the fourth target scheme identifier, and the expiration time information of the second target algorithm-related scheme and the second target data structure scheme is specifically recorded in the correspondence table. In operation 104, the total code used to generate the token is updated based on the sub-code corresponding to the second target algorithm-related scheme and the sub-code corresponding to the second target data structure scheme, to obtain the target total code used to generate the token within the current period, which simultaneously includes the sub-code corresponding to the second target algorithm-related scheme and the sub-code corresponding to the second target data structure scheme. In operation 105, the target total code, the second target scheme identifier, and the fourth target scheme identifier are sent to the client. This allows the client to execute the target total code, generate a token with a data structure determined by the second target data structure scheme, and process it based on the second target algorithm-related scheme. Based on this embodiment, the fields involved in generating the token can use different data structures within the token, allowing the generated token to have different data structures and be processed by different algorithm-related schemes, further improving token security.

[0099] Optionally, in some implementations, operation 201 may specifically involve receiving a request content, a token, a first target scheme identifier, and a third target scheme identifier sent by the client. Correspondingly, in operation 202, the expiration time information corresponding to the first target scheme identifier and the third target scheme identifier can be obtained from the correspondence table. In response to obtaining the expiration time information corresponding to the first target scheme identifier and the third target scheme identifier from the correspondence table, in operation 203, it is confirmed whether the first target algorithm-related scheme and the first target data structure scheme have expired based on the expiration time information corresponding to the first target scheme identifier and the third target scheme identifier. In response that the first target algorithm-related scheme and the first target data structure scheme have not expired, operation 204 is executed to process the token based on the first target algorithm-related scheme to obtain the processing result.

[0100] Optionally, in some implementations, before operation 101, the main code for generating the token can be generated based on a preset data structure scheme and a preset algorithm-related scheme. For example, the main code for generating the token can be generated based on the sub-code corresponding to the preset data structure scheme and the sub-code corresponding to each algorithm scheme in the preset algorithm-related scheme.

[0101] Optionally, in some implementations, sub-code corresponding to a preset data structure scheme can be pre-set, or the sub-code corresponding to the preset data structure scheme can be further updated.

[0102] Optionally, in any of the above embodiments, the data structure scheme includes a data storage location scheme, which is used to determine the position of each field involved in generating the token within the token's data structure. The fields involved in generating the token may include, but are not limited to, the following valid fields: token version number, token identifier, token type, token source, token attribute, client current time, at least one preset optional data, etc. Multiple candidate data storage location schemes exist. In different data storage location schemes, the positions of each field involved in generating the token within the token's data structure are different or not entirely the same; even the same field may have different positions within the token's data structure. Correspondingly, the fourth target scheme identifier includes the sub-scheme identifier of the target data storage location scheme, and the target total code includes the sub-code corresponding to the target data storage location scheme.

[0103] After receiving the request content, token, first target scheme identifier and third target scheme identifier sent by the client, the server can determine the position of each field in the data structure of the token based on the target data storage location scheme identified by the sub-scheme identifier of the target data storage location scheme in the third target scheme identifier, and thus extract the specific information (i.e., assign values) of each field from the corresponding position.

[0104] For example, in a specific example, taking the fields involved in generating the token, including token version number, token ID, token type, token source, token attributes, client current time, etc., the positions of each field in the token's data structure under the following different data storage location schemes are as follows:

[0105] Data storage location scheme 1: data[0] = token version number, data[1] = token ID, data[2] = token type, data[3] = token source, data[4] = token attribute, data[5] = client current time, ...;

[0106] Data storage location scheme 2: data[0] = token ID, data[1] = token version number, data[2] = token type, data[3] = client current time, data[4] = token attribute, data[5] = token source, ...;

[0107] Data storage location scheme 3: data[0] = client current time, data[1] = token source, data[2] = token ID, data[3] = token type, data[4] = token attribute, data[5] = token version number, ...;

[0108] …

[0109] Data storage location scheme N:…

[0110] Wherein, data[] represents the position of each field in the token's data structure. For example, data[0] = token version number means that the field "token version number" is in the 0th position of the token's data structure, data[1] = token ID means that the field "token ID" is in the 1st position of the token's data structure, and so on. Depending on the application's business, optional data may include user input data, mouse movement data, keyboard input statistics, and environment-related data (such as window size, current operating system, CPU model, etc.).

[0111] Optionally, in some implementations, the data structure scheme may further include a redundant data insertion scheme, which is a scheme for inserting redundant data into the token's data structure. Multiple candidate schemes exist for this redundant data insertion scheme. Each redundant data insertion scheme may include: the number of invalid fields to be inserted, the position of each invalid field in the token's data structure, and the redundant data assigned to each invalid field. Depending on the redundant data insertion scheme, different numbers of redundant data for invalid fields can be inserted at different positions in the fields involved in generating the token (e.g., before or after a certain position in the token's data structure). Correspondingly, the fourth target scheme identifier also includes a sub-scheme identifier for the target redundant data insertion scheme, and the target total code also includes the sub-code corresponding to the target redundant data insertion scheme.

[0112] For ease of distinction, in this embodiment, the fields involved in generating the token can be divided into valid fields and invalid fields. Valid fields are those that the token must include according to the preset rules, such as token version number, token ID, token type, token source, token attributes, client current time, and some optional data. The specific information (i.e., the values) of these valid fields can be called valid data. Invalid fields are those inserted in this implementation, in addition to the valid fields specified by the above-mentioned preset rules, to increase the difficulty of reverse engineering the code that generates the token and to improve the security of the token. The specific information (i.e., the values) of these invalid fields can be called redundant data (i.e., invalid data).

[0113] Based on the target data storage location scheme and target insertion redundancy data scheme in the first target data structure scheme corresponding to the third target scheme identifier, the server can determine the specific position of each valid field in the token's data structure, thereby extracting the specific information of each valid field from the corresponding position; and by comparing whether the redundant data at each position in the target insertion redundancy data scheme is consistent with the redundant data at the corresponding position in the token returned by the client, the server can detect whether the total code sent to the client has been reverse-engineered or tampered with.

[0114] For example, in a specific case, the following scheme for inserting redundant data could be provided as a candidate scheme:

[0115] Scheme 1 for inserting redundant data: data[0] = random number, data[1] = random number, data[2] = random number, data[3] = random number, data[4] = token version number, data[5] = token ID, data[6] = token type, data[7] = token source, data[8] = token attribute, data[9] = client current time, ...;

[0116] Scheme 2 for inserting redundant data: data[0] = token ID, data[1] = token version number, data[2] = token type, data[3] = client current time, data[4] = token attribute, data[5] = token source, data[6] = random number, data[7] = random number, data[8] = random number, ...;

[0117] Scheme 3 for inserting redundant data: data[0] = current client time, data[1] = random number, data[2] = token source, data[3] = random number, data[4] = token ID, data[5] = token type, data[6] = random number, data[7] = token attribute, data[8] = token version number, ...;

[0118] …

[0119] Inserting redundant data scheme N:…

[0120] The random number can be selected by the server according to preset rules. For example, an integer greater than 0 and less than 255 can be selected as the random number. The random numbers in different positions can be partially or completely the same, or they can be different.

[0121] The random number can be set by the server according to preset rules, such as an integer greater than 0 and less than 255.

[0122] After receiving the request content, token, first target scheme identifier, and third target scheme identifier from the client, the server can determine the specific position of each valid field in the token's data structure based on the target data storage location scheme and the target redundant data insertion scheme identified by the sub-scheme identifiers of the target data storage location scheme and the target redundant data insertion scheme in the third target scheme identifier. Valid data (i.e., the specific information or values ​​of each valid field other than redundant data) is extracted only from the corresponding positions in the token. Additionally, the server can detect whether the total code sent to the client has been tampered with by comparing the redundant data at each position in the target redundant data insertion scheme with the corresponding redundant data at the corresponding positions in the token returned by the client. Alternatively, based on the aforementioned preset rules, if the value at each invalid field position in the token is 0 or 255, it can be directly determined that the total code sent to the client has been tampered with.

[0123] Optionally, in some implementations, when the data structure scheme includes a data storage location scheme and an insertion redundancy data scheme, in operation 205, specifically when it is determined that the target total code sent to the client has not been tampered with according to the target insertion redundancy data scheme, the target data storage location scheme and the target insertion redundancy data scheme identified by the sub-scheme identifier of the target data storage location scheme and the sub-scheme identifier of the target insertion redundancy data scheme in the third target scheme identifier are used to extract the values ​​of each valid field from the position of each valid field in the processing result.

[0124] Optionally, in some implementations, in operation 101, a candidate scheme can be selected sequentially or randomly from the candidate schemes corresponding to the data storage location scheme according to a preset period as the data storage location scheme for the current period; if the data structure scheme also includes a scheme for inserting redundant data, a candidate scheme can be selected sequentially or randomly from the candidate schemes corresponding to the scheme for inserting redundant data as the scheme for inserting redundant data for the current period.

[0125] Based on this embodiment, the data storage location scheme and the redundant data insertion scheme can be adjusted periodically, and the target master code for generating tokens can be generated accordingly. This not only greatly increases the difficulty for attackers to reverse engineer the token generation code, but also effectively prevents attackers from integrating the token generation code into automated tools to automatically generate tokens. Furthermore, it allows the data structure of the tokens generated by the client to change periodically and dynamically, thereby improving the security of the tokens.

[0126] Optionally, in some implementations, the data structure scheme may further include a data hiding scheme, which is a scheme to hide all fields or a preset subset of fields involved in generating the token. Each data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, wherein the hidden field is the field to be hidden, which may target all fields or one or several fields, depending on specific requirements. The number of hidden fields targeted by each data hiding scheme may be the same as or different from the total number of valid and invalid fields, and this application embodiment does not impose any restrictions on this. For example, in a specific implementation, when the data hiding scheme targets certain preset fields involved in generating the token, if the number of hidden fields is greater than the total number of valid and invalid fields, the hiding process may only be performed on the valid and invalid fields involved in the hidden fields; if the number of hidden fields is less than the total number of valid and invalid fields, the hiding process may only be performed on the corresponding hidden fields among the valid and invalid fields. Accordingly, the fourth target data structure scheme also includes a target data hiding scheme, the fourth target scheme identifier also includes a sub-scheme identifier of the target data hiding scheme, and the target total code also includes the sub-code corresponding to the target data hiding scheme.

[0127] A data hiding scheme allows for the processing of each hidden field involved in token generation. This is achieved by performing hidden operations (such as encryption / decryption, encoding / decoding, inversion, XOR, shifting, etc.) on each field based on its corresponding data hiding method to conceal the specific information (i.e., assign values) of each field. Upon receiving the token from the client, the server, based on the target data hiding scheme identified by the sub-scheme identifier within the third target scheme identifier, can perform corresponding restoration operations to restore the hidden fields, thereby obtaining the specific information of each hidden field.

[0128] Table 1 below shows the optional data hiding methods of the data hiding scheme in the embodiments of this application, as well as the hiding operation, restoration operation and applicable scope (i.e., the data form that can be used as a hidden field) corresponding to each data hiding method.

[0129] Table 1

[0130]

[0131] For example, in a specific example, taking the above-mentioned scheme 1 for inserting redundant data as an example, several candidate schemes for the corresponding data hiding scheme could be:

[0132] Data hiding scheme 1: data[0] = random number^0x11, data[1] = random number^0x22, data[2] = random number^0x33, data[3] = random number^0x44, data[4] = token version number^0x55, data[5] = token ID^0x66, data[6] = token type^0x77, data[7] = token source^0x88, data[8] = token attribute^0x99, data[9] = client current time^0xAA, ...

[0133] Restore operation: Token version number = data[4]^0x55, Token ID = data[5]^0x66, Token type = data[6]^0x77, Token source = data[7]^0x88, Token attribute = data[8]^0x99, Client current time = data[9]^0xAA, ...

[0134] Data hiding scheme 2: data[0] = random number + 0x11, data[1] = random number + 0x22, data[2] = random number + 0x33, data[3] = random number + 0x44, data[4] = token version number + 0x55, data[5] = token ID + 0x66, data[6] = token type + 0x77, data[7] = token source + 0x88, data[8] = token attribute + 0x99, data[9] = client current time + 0xAA, ...

[0135] Restore operation: Token version number = data[4]-0x55, Token ID = data[5]-0x66, Token type = data[6]-0x77, Token source = data[7]-0x88, Token attribute = data[8]-0x99, Client current time = data[9]-0xAA, ...

[0136] Data hiding scheme 3: data[0] = random number^0x11, data[1] = random number +0x22, data[2] = random number <<1, data[3] = random number^0xFF, data[4] = ~token version number, data[5] = token ID^0x66, data[6] = token type +0x77, data[7] = token source <<2, data[8] = token attribute^0x99, data[9] = ~client current time, ...

[0137] Restore operation: Token version number = ~data[4], Token ID = data[5]^0x66, Token type = data[6]-0x77, Token source = data[7]>>2, Token attribute = data[8]^0x99, Client current time = ~data[9], ...

[0138] …

[0139] Data hiding scheme N: ...

[0140] In data hiding scheme 1, the data hiding method is XOR (XOR operator ^). In data hiding scheme 2, the data hiding method is addition (addition operator +, subtraction operator -). In data hiding scheme 3, the data hiding methods include XOR (XOR operator ^), addition (addition operator +, subtraction operator -), shift (left shift operator <<, right shift operator >>), and negation (negation operator ~). In practical applications, the above data hiding methods can be used individually or in combination.

[0141] When the data structure scheme includes a data hiding scheme, in some implementations, in operation 205, the target hidden field in the processing result can be restored according to the target hidden field and the data hiding method corresponding to the target hidden field identified by the sub-identifier of the target data hiding scheme in the third target scheme identifier, to obtain the restoration result; then, when it is determined that the target total code sent to the client has not been tampered with according to the target insertion redundancy data scheme, the values ​​of each valid field are extracted from the position of each valid field in the restoration result based on the target data storage location scheme and the target insertion redundancy data scheme identified by the sub-identifier of the target data storage location scheme in the third target scheme identifier and the sub-identifier of the target insertion redundancy data scheme.

[0142] Optionally, in some implementations, in operation 101, if the data structure scheme includes a data hiding scheme, a candidate scheme can be selected sequentially or randomly from the candidate schemes corresponding to the data hiding scheme according to a preset period as the data hiding scheme for the current period.

[0143] In the above implementation, when the data structure scheme includes a data storage location scheme, a redundant data insertion scheme, and a data hiding scheme, the second target data structure scheme may include a target data storage location scheme, a target redundant data insertion scheme, and a target data hiding scheme. Correspondingly, the fourth target scheme identifier includes a sub-scheme identifier of the target data storage location scheme, a sub-scheme identifier of the target redundant data insertion scheme, and a sub-scheme identifier of the target data hiding scheme, wherein the sub-scheme identifier is used to uniquely identify a sub-scheme.

[0144] Based on this embodiment, different data storage location schemes, redundant data insertion schemes, and data hiding schemes can be combined to periodically and dynamically adjust the data structure of the generated token, thereby enabling the generated token to have a dynamically changing data structure and further improving the security of the token.

[0145] Optionally, when the data structure scheme includes a data storage location scheme, a redundant data insertion scheme, and a data hiding scheme, in some implementations, in operation 101, the data structure scheme used to determine the token's data structure can be adjusted according to a preset period. Specifically, a candidate scheme can be selected sequentially or randomly from the candidate schemes for the data storage location scheme as the data storage location scheme for the current period; a candidate scheme can be selected sequentially or randomly from the candidate schemes for the redundant data insertion scheme as the redundant data insertion scheme for the current period; and a candidate scheme can be selected sequentially or randomly from the candidate schemes for the data hiding scheme as the data hiding scheme for the current period.

[0146] Optionally, in some implementations, candidate schemes for data storage location, redundant data insertion, and data hiding, as well as the corresponding sub-codes for each candidate scheme, can be pre-set; or, the candidate schemes for data storage location, redundant data insertion, and data hiding, as well as the corresponding sub-codes for each candidate scheme, can be further updated.

[0147] Optionally, in some implementations, in operation 102, a data structure scheme within the current period can be obtained as a second target data structure scheme, including a target data storage location scheme, a target redundant data insertion scheme, and a target data hiding scheme. Then, the sub-codes corresponding to the target data storage location scheme, the target redundant data insertion scheme, and the target data hiding scheme can be obtained from the candidate schemes of the pre-set data storage location scheme, the candidate schemes of the redundant data insertion scheme and the data hiding scheme, as well as the sub-codes corresponding to each candidate scheme.

[0148] Based on this embodiment, the target data storage location scheme, target redundant data insertion scheme, and target data hiding scheme, as well as their corresponding sub-codes, can be periodically adjusted for the candidate schemes of the data storage location scheme, redundant data insertion scheme, and data hiding scheme in the data structure scheme. This causes the data structure scheme and total code involved in token generation to change periodically and dynamically, further increasing the difficulty for attackers to reverse engineer the total code for token generation. This effectively prevents attackers from reverse engineering the total code for token generation, thus preventing attackers from integrating the token generation code into automated tools to automatically generate tokens.

[0149] Optionally, in some implementations, in operation 105 of any of the above embodiments, the target total code, the second target scheme identifier, and the pre-acquired client key can be sent to the client, wherein the client key is used as a client encryption token. The client key can be generated by the server according to a preset method, such as random generation or generation using a preset algorithm, and this application embodiment does not limit this.

[0150] The client key can be a fixed key, a key that changes according to a preset period, or a key temporarily generated for each client. If the client key is a fixed key, the server can maintain this key consistently. If the client key changes according to a preset period, the server can record the client keys for each period, thus determining the corresponding client key based on the current period. If the client key is a key temporarily generated for each client, when the server sends the target master code, the second target scheme identifier, and the pre-acquired client key to the client, it can record the correspondence between the client key and the client's client identifier (ID), thus determining the client key sent to that client based on this correspondence. The client ID is used to uniquely identify a client.

[0151] Accordingly, in operation 201, the client's request content, the encrypted token, and the identifier of the first target scheme can be received. Before operation 204, the corresponding client key can be obtained, and then the encrypted token can be decrypted using this key to obtain the token. Then, through operation 204, the token is processed based on the relevant scheme of the first target algorithm to obtain the processing result.

[0152] Based on this embodiment, when the server sends the target total code and the second target scheme identifier to the client, it also sends the client key. In this way, after the client generates a token, it can directly use the client key to encrypt the token, which helps to improve the confidentiality and security of the token.

[0153] Optionally, in some implementations, in operation 105, the second target scheme identifier can be encrypted using a preset encryption algorithm and a confidential server key. If a fourth target scheme identifier is sent simultaneously, both the second and fourth target scheme identifiers are encrypted to obtain the first identifier encrypted information. Then, the target total code and the first identifier encrypted information are sent to the client. The server key can be generated by the server according to a preset method, such as random generation or generation using a preset algorithm. This application embodiment does not impose any restrictions on this.

[0154] The preset encryption algorithm can be a high-strength encryption algorithm, such as AES256, or other encryption algorithms with a strength no lower than AES256. This preset encryption algorithm and the confidential server key are stored only on the server and will not be distributed or transmitted to the client, thereby improving the confidentiality and security of the target scheme identifier sent to the client.

[0155] Accordingly, in operation 201, specifically, the request content, token, and second identifier encrypted information sent by the client are received. After operation 201, the second identifier encrypted information can be decrypted using a preset encryption algorithm and the server key. In response to the decryption yielding the first target scheme identifier, or the first target scheme identifier and the third target scheme identifier, operation 202 is executed. Otherwise, if the first target scheme identifier, or the first target scheme identifier and the third target scheme identifier, are not decrypted, it indicates that the second identifier encrypted information sent by the client is not the first identifier encrypted information previously sent by the server to the client. This means that the encrypted first identifier encrypted information sent by the server to the client may have been tampered with or is forged. In this case, operation 202 and its subsequent processes are not executed, or a response message requiring authentication is further sent to the client.

[0156] Based on this embodiment, the server uses a preset encryption algorithm and a confidential server key to encrypt the second target scheme identifier, or the second target scheme identifier and the fourth target scheme identifier, before sending it to the client. Since the preset encryption algorithm and the confidential server key are only stored on the server and can only be known by the server, the confidentiality and security of the second target scheme identifier, or the second target scheme identifier and the fourth target scheme identifier, can be improved.

[0157] Figure 3 This is a flowchart illustrating a token generation method according to another embodiment of this application. This embodiment is applied to a client, such as... Figure 3 As shown.

[0158] 301, Receive the target total code and the first target scheme identifier sent by the server.

[0159] The first target scheme identifier identifies the first target algorithm-related scheme. This first target algorithm-related scheme is the algorithm-related scheme for the current period obtained by the server adjusting the algorithm-related schemes participating in token generation according to a preset period. The algorithm-related schemes include encoding algorithm schemes, encryption algorithm schemes, and verification algorithm schemes, each with multiple candidate schemes. The first target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. The target overall code includes sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme within the first target algorithm-related scheme.

[0160] 302. By executing the target general code, the assignment information of each field is processed accordingly based on the relevant scheme of the first target algorithm to obtain a token. The token includes data obtained by processing the assignment information of the fields involved in generating the token according to the relevant scheme of the first target algorithm.

[0161] 303, send the request content, token and first target scheme identifier to the server.

[0162] The request content refers to the content that the client requests the server to process. For example, the request content may be a network data access request, a system resource access request, a user's personal information update request, etc. This disclosure does not restrict the specific business type and specific content corresponding to the request content.

[0163] The client receives the target total code and the first target scheme identifier sent by the server. Before sending each request to the server, the client generates a token based on the most recently received target total code, and then sends the request content, the token and the first target scheme identifier together to the server.

[0164] In this way, because the code sent from the server to the client for generating tokens changes dynamically according to a preset period, the tokens generated by the client also change dynamically. This greatly increases the difficulty for attackers to reverse engineer the token-generating code, effectively preventing attackers from integrating the token-generating code into automated tools to automatically generate tokens, thus improving token security. Furthermore, because the algorithm-related schemes involved in token generation are dynamically adjusted, and the target algorithm-related schemes sent to the client all have corresponding expiration times, even if an attacker spends a lot of time reverse engineering a portion of the code used to generate a token, that portion has already expired and is invalid. Integrating it into an automated tool to automatically generate tokens is meaningless, thus improving token security. Additionally, this prevents attackers from using automated tools to automatically generate tokens from reverse-engineered code to access network data and system resources, or further tamper with or implant viruses into network data and system resources, effectively ensuring the security of network data and system resources.

[0165] Optionally, in some implementations, in operation 302, the target main code can be executed to assign values ​​to each field involved in generating the token. Then, the token can be verified, encrypted, and decoded sequentially by executing the sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme in the target main code.

[0166] Optionally, in some implementations, the target total code is obtained by updating the total code used to generate the token based on the sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme in the first target algorithm-related scheme. The total code used to generate the token is generated based on the sub-codes corresponding to a pre-set data structure scheme and the sub-codes corresponding to each algorithm scheme in the pre-set algorithm-related scheme. The data structure scheme is used to determine the data structure of the token. The data structure scheme is a scheme for the data structure (e.g., position, hiding method, etc.) of each part of the data (i.e., fields) participating in the token generation within the token.

[0167] Optionally, in some implementations, the sub-code corresponding to the data structure scheme included in the target total code is the sub-code corresponding to a pre-set data structure scheme.

[0168] Alternatively, in some implementations, in operation 301, specifically, the server sends a target total code, a first target scheme identifier, and a third target scheme identifier. The third target scheme identifier identifies the first target data structure scheme, which is the data structure scheme determined from multiple candidate schemes within the current period, adjusted according to a preset period. Correspondingly, the target total code also includes sub-code corresponding to the first target data structure scheme.

[0169] Optionally, in some implementations, the data structure scheme includes a data storage location scheme, which is used to determine the position of each field involved in generating the token within the token's data structure. Multiple candidate data storage location schemes exist. In different data storage location schemes, the positions of each field involved in generating the token within the token's data structure may differ or not be entirely the same; even the same field may have different positions within the token's data structure. For details, please refer to the descriptions in the above embodiments, which will not be repeated here.

[0170] Optionally, the data structure scheme may further include a redundant data insertion scheme, which is a scheme for inserting redundant data into the token's data structure. Multiple candidate schemes exist for this redundant data insertion scheme. Each redundant data insertion scheme may include: the number of invalid fields to be inserted, the position of each invalid field in the token's data structure, and the redundant data assigned to each invalid field. Depending on the redundant data insertion scheme, different numbers of redundant data for invalid fields can be inserted at different positions in the fields involved in generating the token (e.g., before or after a certain position in the token's data structure). For details, please refer to the description in the above embodiments; further elaboration is omitted here.

[0171] Accordingly, in operation 302, the sub-code corresponding to the data structure scheme in the target main code can be executed to assign values ​​to each valid field involved in generating the token.

[0172] Optionally, the data structure scheme may further include a data hiding scheme, which is a scheme to hide all fields or some preset fields involved in generating the token. Each data hiding scheme includes: a hidden field and a hiding method corresponding to the hidden field, wherein the hidden field is the field to be hidden, which can be all fields, or one or several fields, and can be determined according to specific needs. For details, please refer to the description in the above embodiments, which will not be repeated here.

[0173] Accordingly, in operation 302, after assigning values ​​to each valid field participating in token generation, the assignment information of the target hidden field in each field's assignment information can be processed using the data hiding method corresponding to the target hidden field, based on the target hidden field and the corresponding data hiding method in the data hiding scheme of the target total code, to obtain the hiding result. Then, the hiding result is processed accordingly based on the first target algorithm related scheme. For example, based on the target verification algorithm scheme, target encryption algorithm scheme, and target encoding algorithm scheme in the first target algorithm related scheme, the hiding result or the specified information (all information or part of the specified information) including the hiding result is verified, encrypted, and encoded to obtain the token.

[0174] The specific implementation methods of the data structure scheme and its adjustment according to a preset period, as well as the specific content and implementation methods of the data storage location scheme, the scheme for inserting redundant data, and the data hiding scheme, can be referred to the relevant records in the above embodiments of this disclosure, and will not be repeated here.

[0175] Optionally, in some implementations, operation 301 specifically involves receiving the target total code, the first target scheme identifier, and the client key sent by the server. Correspondingly, after obtaining the token through operation 302, the client key can be used to encrypt the token to obtain an encrypted token; then, in operation 303, the request content, the encrypted token, and the first target scheme identifier can be sent to the server.

[0176] Optionally, in some implementations, before executing the embodiments of this application, the server and the client may use a preset method, such as Transport Layer Security (TLS) or a similar method, to perform two-way authentication to ensure that the target total code used to generate the token and the second target scheme identifier can be sent to the legitimate client, thereby improving data security.

[0177] The token generation method of this application will be further explained below using a specific application example:

[0178] S1, the server adjusts the algorithm-related schemes and data structure schemes of the tokens according to a preset period.

[0179] Among them, the algorithm-related schemes include encoding algorithm schemes, encryption algorithm schemes, and verification algorithm schemes; each of the encoding algorithm scheme, encryption algorithm scheme, verification algorithm scheme, and data structure scheme has multiple candidate schemes.

[0180] S2, in response to the achievement of the preset triggering condition, the server obtains the algorithm-related schemes in the current period as the second target algorithm-related schemes, and obtains the scheme identifier of the second target algorithm-related schemes as the second target scheme identifier, and obtains the data structure schemes in the current period as the second target data structure schemes, and obtains the scheme identifier of the second target data structure schemes as the fourth target scheme identifier.

[0181] The second target algorithm-related schemes include a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. Each scheme identifier is used to identify an algorithm-related scheme, and the scheme identifiers include the algorithm identifiers for the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme. The second target scheme identifier is used to identify the second target algorithm-related schemes, and the second target scheme identifier includes the algorithm identifiers for the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme. The fourth target scheme identifier is used to identify the second target data structure scheme.

[0182] S3, the server records the correspondence between the second target scheme identifier, the fourth target scheme identifier, and the expiration time information of the second target algorithm related scheme and the second target data structure scheme in the corresponding relationship table.

[0183] S4, the server updates the total code used to generate tokens based on the sub-codes corresponding to the second target algorithm scheme and the second target data structure scheme, and obtains the target total code used to generate tokens in the current period. The target total code includes the sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, the target verification algorithm scheme, and the second target data structure scheme.

[0184] S5, the server sends the target total code, the second target scheme identifier and the fourth target scheme identifier, as well as the pre-acquired client key to the client.

[0185] S6, the client receives the target total code, the first target scheme identifier and the third target scheme identifier, and the client key sent by the server.

[0186] The first target scheme identifier is used to identify the first target algorithm-related scheme. The first target algorithm-related scheme is the algorithm-related scheme in the current period obtained by the server adjusting the algorithm-related schemes participating in token generation according to a preset period. The algorithm-related scheme includes an encoding algorithm scheme, an encryption algorithm scheme, and a verification algorithm scheme. There are multiple candidate schemes for each of the encoding algorithm scheme, encryption algorithm scheme, and verification algorithm scheme. The first target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. The target total code includes the sub-code corresponding to the target encoding algorithm scheme, the sub-code corresponding to the target encryption algorithm scheme, and the sub-code corresponding to the target verification algorithm scheme in the first target algorithm-related scheme.

[0187] At this point, depending on whether the second and fourth target scheme identifiers sent by the server have been tampered with, the first and second target scheme identifiers received by the client will be either different from or the same as the second and fourth target scheme identifiers sent by the server. If the second and fourth target scheme identifiers sent by the server have not been tampered with, the first and second target scheme identifiers received by the client will be the same as those sent by the server, the first target algorithm-related scheme will be the same as the second target algorithm-related scheme, and the first target data structure scheme will be the same as the second target data structure scheme. Otherwise, if the second and fourth target scheme identifiers sent by the server have been tampered with, the first and second target scheme identifiers received by the client will no longer be the same as those sent by the server, the first target algorithm-related scheme will be different from the second target algorithm-related scheme, and the first target data structure scheme will also be different from the second target data structure scheme.

[0188] S7, the client executes the target code and processes the assignment information of the fields involved in generating the token according to the relevant scheme of the first target algorithm to obtain the token.

[0189] For example, in one implementation, the client executes the sub-code corresponding to the target data structure scheme in the target main code, passing valid data to the appropriate location. This may involve executing sub-code corresponding to the target data hiding scheme to perform data hiding operations on the valid data and invalid data in the target main code. Then, following the execution order of the sub-codes for the target verification algorithm scheme, target encryption algorithm scheme, and target execution encoding algorithm scheme in the target main code, the client performs corresponding verification, encryption, and encoding by executing the sub-codes for these schemes. Thus, the client generates a token with the data structure determined by the first target data structure scheme and processed based on the relevant schemes of the first target algorithm.

[0190] S8, the client uses the client key to encrypt the token, thus obtaining the encrypted token.

[0191] S9, the client sends the request content, the encrypted token, the first target scheme identifier, and the third target scheme identifier to the server.

[0192] S10, in response to receiving the request content, encrypted token, first target scheme identifier and third target scheme identifier sent by the client, the server obtains the expiration time information corresponding to the first target scheme identifier and the third target scheme identifier from the correspondence table.

[0193] S11, in response to obtaining the expiration time information corresponding to the first target scheme identifier and the third target scheme identifier from the correspondence table, the server confirms whether the first target algorithm related scheme and the first target data structure scheme have expired based on the expiration time information.

[0194] Otherwise, if the expiration time information corresponding to the first target scheme identifier and the third target scheme identifier is not obtained, it means that the first target scheme identifier and / or the third target scheme identifier does not exist, and the subsequent process will not be executed.

[0195] S12, in response to the fact that the first target algorithm-related scheme and the first target data structure scheme have not expired, the server uses the client key to decrypt the encrypted token and obtain the token.

[0196] Otherwise, if the algorithm and data structure schemes for the first objective have expired, the subsequent processes will not be carried out.

[0197] S13, the server decodes, decrypts, and verifies the token based on the target encoding algorithm, target encryption algorithm, and target verification algorithm in the first target algorithm related scheme, and obtains the processing result.

[0198] S14, the server obtains valid data from the processing results based on the target data structure scheme corresponding to the third target scheme identifier.

[0199] For example, in one implementation, the server, based on the algorithm identifiers of the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme included in the first target scheme identifier, can determine the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme used in generating the token. It then uses the corresponding decoding algorithm to decode the data according to the target encoding algorithm scheme, the corresponding decryption algorithm to decrypt the data according to the target encryption algorithm scheme, and the corresponding verification algorithm to verify the data according to the target verification algorithm scheme. Based on the sub-scheme identifiers of the target data storage location scheme, the target redundant data insertion scheme, and the target data hiding scheme in the third target scheme identifier, the server can determine the target data storage location scheme, the target redundant data insertion scheme, and the target data hiding scheme of the token generated. It can then use the corresponding restoration operation to restore the hidden fields according to the target data hiding scheme, thereby obtaining the specific information of each hidden field. It can also delete redundant data according to the target redundant data insertion scheme and find the storage location of the valid data according to the target data storage location scheme to extract the valid data.

[0200] S15, in response to obtaining valid data from the processing result, the server processes the requested content.

[0201] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0202] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0203] Figure 4 This is a schematic diagram of a token generation apparatus provided in one embodiment of this application. The token generation apparatus of this embodiment is applied to a server and can be used to implement the various token generation method embodiments implemented by the server in the above-described application. Figure 4 As shown, the token generation device in this embodiment includes: an adjustment module 401, an acquisition module 402, a recording module 403, an update module 404, and a second sending module 405. Wherein:

[0204] The adjustment module 401 is used to adjust the algorithm-related schemes involved in generating the token according to a preset period; wherein, the algorithm-related schemes include an encoding algorithm scheme, an encryption algorithm scheme, and a verification algorithm scheme; the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme each have multiple candidate schemes.

[0205] The acquisition module 402 is used to, in response to reaching a preset trigger condition, acquire the algorithm-related scheme within the current period as the second target algorithm-related scheme, and acquire the scheme identifier of the second target algorithm-related scheme as the second target scheme identifier; wherein, the second target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme; each scheme identifier is used to identify an algorithm-related scheme, and the scheme identifier includes the algorithm identifier of the encoding algorithm scheme, the algorithm identifier of the encryption algorithm scheme, and the algorithm identifier of the verification algorithm scheme; the second target scheme identifier is used to identify the second target algorithm-related scheme, and the second target scheme identifier includes the algorithm identifier of the target encoding algorithm scheme, the algorithm identifier of the target encryption algorithm scheme, and the algorithm identifier of the target verification algorithm scheme.

[0206] The recording module 403 is used to record the correspondence between the second target scheme identifier and the expiration time information of the second target algorithm related scheme in the correspondence table.

[0207] The update module 404 is used to update the total code for generating tokens based on the sub-code corresponding to the second target algorithm related scheme, so as to obtain the target total code for generating tokens in the current period. The target total code includes the sub-code corresponding to the target encoding algorithm scheme, the sub-code corresponding to the target encryption algorithm scheme, and the sub-code corresponding to the target verification algorithm scheme.

[0208] The second sending module 405 is used to send the target total code and the second target scheme identifier to the client, so that the client can generate a token based on the second target algorithm related scheme by executing the target total code.

[0209] For detailed implementation and specific operations of each module in the token generation device of this embodiment, please refer to the token generation method embodiments implemented by the server in the above application, which will not be repeated here.

[0210] Figure 5 This is a schematic diagram of a token generation apparatus according to another embodiment of this application. The token generation apparatus of this embodiment is applied to a client and can be used to implement the various token generation method embodiments implemented by the client described above in this application. Figure 5 As shown, the token generation device in this embodiment includes: a receiving module 501, a generation module 502, and a first sending module 503. Wherein:

[0211] The receiving module 501 is used to receive the target total code and the first target scheme identifier sent by the server; wherein, the first target scheme identifier is used to identify the first target algorithm-related scheme, the first target algorithm-related scheme is the algorithm-related scheme in the current period obtained by the server adjusting the algorithm-related schemes participating in token generation according to a preset period, the algorithm-related scheme includes an encoding algorithm scheme, an encryption algorithm scheme, and a verification algorithm scheme; the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme each have multiple candidate schemes; the first target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme; the target total code includes the sub-code corresponding to the target encoding algorithm scheme, the sub-code corresponding to the target encryption algorithm scheme, and the sub-code corresponding to the target verification algorithm scheme in the first target algorithm-related scheme.

[0212] The generation module 502 is used to execute the target general code and process the assignment information of the fields participating in the generation of the token according to the first target algorithm related scheme to obtain the token. The token includes data obtained by processing the assignment information of the fields participating in the generation of the token according to the first target algorithm related scheme.

[0213] The first sending module 503 is used to send the request content, the token, and the first target scheme identifier to the server.

[0214] For detailed implementation and specific operations of each module in the token generation device of this embodiment, please refer to the token generation method embodiments implemented on the client side of this application, which will not be repeated here.

[0215] Figure 6 This is a schematic diagram of a token generation system provided in one embodiment of this application. The token generation system of this embodiment can be used to implement the token generation methods of the above embodiments of this application. Figure 6 As shown, the token generation system of this embodiment includes: a server 601 and a client 602. Wherein:

[0216] Server 601 is used to adjust the algorithm-related schemes participating in token generation according to a preset period. The algorithm-related schemes include encoding algorithm schemes, encryption algorithm schemes, and verification algorithm schemes. Each of the encoding algorithm scheme, encryption algorithm scheme, and verification algorithm scheme has multiple candidate schemes. In response to reaching a preset trigger condition, the server obtains the algorithm-related scheme within the current period as a second target algorithm-related scheme, and obtains the scheme identifier of the second target algorithm-related scheme as a second target scheme identifier. The second target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. Each scheme identifier is used to identify an algorithm-related scheme, and the scheme identifier includes the algorithm identifier of the encoding algorithm scheme, the algorithm identifier of the encryption algorithm scheme, and the algorithm identifier of the verification algorithm scheme. The second target scheme identifier is used to identify the first... The second target algorithm-related scheme has three identifiers: a target encoding algorithm, a target encryption algorithm, and a target verification algorithm. A correspondence table records the relationship between the second target scheme identifier and the expiration time information of the second target algorithm-related scheme. The total code used to generate the token is updated based on the sub-code corresponding to the second target algorithm-related scheme, resulting in the target total code used to generate the token within the current period. The target total code includes the sub-code corresponding to the target encoding algorithm, the target encryption algorithm, and the target verification algorithm. The target total code and the second target scheme identifier are sent to the client 602, so that the client 602 can generate a token processed based on the second target algorithm-related scheme by executing the target total code.

[0217] Client 602 is used to receive the target total code and the first target scheme identifier sent by server 601. The first target scheme identifier identifies a first target algorithm-related scheme, which is the algorithm-related scheme for the current period obtained by the server adjusting the algorithm-related schemes participating in token generation according to a preset period. The algorithm-related scheme includes an encoding algorithm scheme, an encryption algorithm scheme, and a verification algorithm scheme. Each of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme has multiple candidate schemes. The first target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. The target total code includes sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme within the first target algorithm-related scheme. By executing the target total code, the assignment information of the fields participating in token generation is processed accordingly based on the first target algorithm-related scheme to obtain a token. This token includes data obtained by processing the assignment information of the fields participating in token generation according to the first target algorithm-related scheme. The request content, the token, and the first target scheme identifier are sent to server 601.

[0218] In this embodiment of the application, the specific implementation of the server 601 and the client 602 can be referred to the apparatus of the token generation method in the corresponding embodiments of the above application, and will not be repeated here.

[0219] In addition, this application also provides an electronic device, which includes:

[0220] One or more processors;

[0221] Storage device for storing one or more programs.

[0222] When the one or more programs are executed by the one or more processors, the one or more processors implement the token generation method described in any of the above embodiments of this application.

[0223] In addition, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the token generation method described in any of the above embodiments of this application.

[0224] Figure 7A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of this application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the application described and / or claimed herein.

[0225] like Figure 7 As shown, the electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. The RAM 703 may also store various programs and data required for the operation of the electronic device 700. The computing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0226] Multiple components in electronic device 700 are connected to I / O interface 705, including: input unit 706, such as keyboard, mouse, etc.; output unit 707, such as various types of displays, speakers, etc.; storage unit 708, such as disk, optical disk, etc.; and communication unit 709, such as network card, modem, wireless transceiver, etc. Communication unit 709 allows electronic device 700 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0227] The computing unit 701 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as the method for detecting webshell files. For example, in some embodiments, the method for detecting webshell files may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of the method for detecting webshell files described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the method for detecting webshell files by any other suitable means (e.g., by means of firmware).

[0228] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0229] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0230] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0231] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0232] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet, and blockchain networks.

[0233] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server, or simply "VPS") services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0234] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, and this is not limited herein.

[0235] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A token generation method, characterized in that, Applied to the client side, including: The system receives a target total code and a first target scheme identifier sent by the server. The first target scheme identifier identifies a first target algorithm-related scheme, which is an algorithm-related scheme for the current period obtained by the server adjusting the algorithm-related schemes participating in token generation according to a preset period. The algorithm-related scheme includes an encoding algorithm scheme, an encryption algorithm scheme, and a verification algorithm scheme. Each of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme has multiple candidate schemes. The first target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. The target total code includes sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme within the first target algorithm-related scheme. By executing the target code, the assignment information of the fields involved in generating the token is processed accordingly based on the first target algorithm related scheme to obtain the token. The token includes data obtained by processing the assignment information of the fields involved in generating the token according to the first target algorithm related scheme. Send the request content, the token, and the first target scheme identifier to the server; The target total code is obtained by updating the total code used to generate the token based on the sub-codes corresponding to the target encoding algorithm scheme, the sub-codes corresponding to the target encryption algorithm scheme, and the sub-codes corresponding to the target verification algorithm scheme. The total code used to generate the token is generated based on the sub-codes corresponding to the pre-set data structure scheme and the sub-codes corresponding to each algorithm scheme in the pre-set algorithm-related scheme. The data structure scheme is used to determine the data structure of the token. The data structure scheme is adjusted according to the preset period and there are multiple candidate schemes. The data structure scheme includes: a scheme for inserting redundant data and / or a data hiding scheme.

2. The method according to claim 1, characterized in that, The step of executing the target master code and processing the assignment information of the fields involved in generating the token according to the first target algorithm-related scheme includes: By executing the target master code, values ​​are assigned to the fields involved in generating the token; By sequentially executing the sub-codes corresponding to the target verification algorithm scheme, the target encryption algorithm scheme, and the target encoding algorithm scheme in the target main code, the assignment information of the fields involved in generating the token is verified, encrypted, and encoded based on the target verification algorithm scheme, the target encryption algorithm scheme, and the target encoding algorithm scheme.

3. The method according to claim 1, characterized in that, The sub-codes corresponding to the data structure schemes included in the target total code are the sub-codes corresponding to the pre-set data structure schemes; or, The step of receiving the target total code and the first target scheme identifier sent by the server includes: receiving the target total code, the first target scheme identifier and the second target scheme identifier sent by the server; wherein, the second target scheme identifier is used to identify the first target data structure scheme, the first target data structure scheme is the data structure scheme in the current period obtained by the server adjusting the data structure scheme according to a preset period; the target total code also includes the sub-code corresponding to the first target data structure scheme.

4. The method according to any one of claims 1-2, characterized in that, The step of receiving the target total code and the first target scheme identifier sent by the receiving server includes: Receive the target total code, the first target scheme identifier, and the client key sent by the server; After obtaining the token, the process also includes: The token is encrypted using the client key to obtain an encrypted token; Sending the request content, the token, and the first target scheme identifier to the server includes: The request content, the encrypted token, and the first target scheme identifier are sent to the server.

5. A token generation method, characterized in that, Applied to the server side, including: According to a preset cycle, the algorithm-related schemes involved in generating tokens are adjusted; wherein, the algorithm-related schemes include encoding algorithm schemes, encryption algorithm schemes, and verification algorithm schemes; each of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme has multiple candidate schemes; In response to the achievement of a preset trigger condition, the algorithm-related schemes within the current period are acquired as the second target algorithm-related schemes, and the scheme identifiers of the second target algorithm-related schemes are acquired as the second target scheme identifiers. Each scheme identifier is used to identify an algorithm-related scheme, and the scheme identifiers include the algorithm identifiers of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme. The second target scheme identifier is used to identify the second target algorithm-related scheme, which includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. The second target scheme identifier includes the algorithm identifiers of the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme. Record the correspondence between the identifier of the second target scheme and the expiration time information of the schemes related to the second target algorithm in the correspondence table; Based on the sub-code corresponding to the second target algorithm scheme, update the total code used to generate tokens to obtain the target total code used to generate tokens in the current period. The target total code includes the sub-code corresponding to the target encoding algorithm scheme, the sub-code corresponding to the target encryption algorithm scheme, and the sub-code corresponding to the target verification algorithm scheme. The target total code and the second target scheme identifier are sent to the client so that the client can generate a token based on the second target algorithm related scheme by executing the target total code; The target total code is obtained by updating the total code used to generate the token based on the sub-codes corresponding to the target encoding algorithm scheme, the sub-codes corresponding to the target encryption algorithm scheme, and the sub-codes corresponding to the target verification algorithm scheme. The total code used to generate the token is generated based on the sub-codes corresponding to the pre-set data structure scheme and the sub-codes corresponding to each algorithm scheme in the pre-set algorithm-related scheme. The data structure scheme is used to determine the data structure of the token. The data structure scheme is adjusted according to the preset period and there are multiple candidate schemes. The data structure scheme includes: a scheme for inserting redundant data and / or a data hiding scheme.

6. The method according to claim 5, characterized in that, The adjustment of the algorithm-related schemes involved in token generation includes: Select one candidate scheme sequentially or randomly from the candidate schemes corresponding to the coding algorithm scheme as the coding algorithm scheme for the current period; Select one candidate scheme sequentially or randomly from the candidate schemes corresponding to the encryption algorithm scheme as the encryption algorithm scheme for the current period; One candidate scheme is selected sequentially or randomly from the candidate schemes corresponding to the verification algorithm scheme as the verification algorithm scheme for the current period.

7. The method according to any one of claims 5-6, characterized in that, Also includes: In response to receiving the request content, token, and first target scheme identifier sent by the client; Obtain the expiration time information corresponding to the first target scheme identifier from the correspondence table; In response to obtaining the expiration time information corresponding to the first target scheme identifier from the correspondence table, it is confirmed whether the first target algorithm-related scheme identified by the first target scheme identifier has expired based on the expiration time information corresponding to the first target scheme identifier. In response to the fact that the first target algorithm-related scheme has not expired, the token is processed based on the first target algorithm-related scheme to obtain a processing result; Based on the data structure scheme corresponding to the token, valid data is obtained from the processing result; wherein, the data structure scheme is used to determine the data structure of the token; In response to obtaining valid data from the processing result, the requested content is processed.

8. The method according to claim 7, characterized in that, The processing of the token based on the first target algorithm-related scheme includes: The token is decoded, decrypted, and verified based on the target encoding algorithm scheme, target encryption algorithm scheme, and target verification algorithm scheme in the first target algorithm related scheme, respectively.

9. The method according to claim 7, characterized in that, The data structure scheme corresponding to the token is the first target data structure scheme corresponding to the third target scheme identifier; The method further includes: In response to the achievement of the preset triggering condition, the data structure scheme in the current period is obtained as the second target data structure scheme, and the scheme identifier of the second target data structure scheme is obtained as the fourth target scheme identifier, wherein the fourth target scheme identifier is used to identify the second target data structure scheme; The step of recording the correspondence between the first target scheme identifier and the expiration time information of the second target algorithm-related schemes in the correspondence table includes: The correspondence table records the correspondence between the second target scheme identifier, the fourth target scheme identifier, and the expiration time information of the second target algorithm related scheme and the second target data structure scheme; The sub-code update for generating the token based on the relevant scheme of the second target algorithm includes: The total code for generating tokens is updated based on the sub-codes corresponding to the second target algorithm scheme and the second target data structure scheme; the total target code also includes the sub-codes corresponding to the second target data structure scheme. Sending the target total code and the second target scheme identifier to the client, so that the client can generate a token processed based on the second target algorithm related scheme by executing the target total code, includes: The target total code, the second target scheme identifier, and the fourth target scheme identifier are sent to the client so that the client can execute the target total code, generate a token with a data structure determined by the second target data structure scheme, and process it based on the second target algorithm related scheme.

10. The method according to claim 9, characterized in that, The step of responding to receiving the request content, token, and first target scheme identifier sent by the client includes: Receive the request content, token, first target scheme identifier, and third target scheme identifier sent by the client; The step of obtaining the expiration time information corresponding to the first target scheme identifier from the correspondence table includes: Obtain the expiration time information corresponding to the first target scheme identifier and the third target scheme identifier from the correspondence table; The step of responding to obtaining the expiration time information corresponding to the first target scheme identifier from the correspondence table, and confirming whether the first target algorithm-related scheme identified by the first target scheme identifier has expired based on the expiration time information corresponding to the first target scheme identifier, includes: In response to obtaining the expiration time information corresponding to the first target scheme identifier and the third target scheme identifier from the correspondence table, it is confirmed whether the first target algorithm related scheme and the first target data structure scheme have expired based on the expiration time information corresponding to the first target scheme identifier and the third target scheme identifier; The step of responding to the first target algorithm-related scheme not being expired, processing the token based on the first target algorithm-related scheme to obtain a processing result includes: Since the first target algorithm-related scheme and the first target data structure scheme have not expired, the token is processed based on the first target algorithm-related scheme to obtain the processing result.

11. The method according to claim 7, characterized in that, The step of sending the target total code and the second target scheme identifier to the client includes: The target total code, the second target scheme identifier, and the pre-acquired client key are sent to the client; wherein the client key is used by the client to encrypt the token.

12. The method according to claim 11, characterized in that, The response to receiving the request content, token, and first target scheme identifier sent by the client includes: In response to receiving the request content, the encrypted token, and the identifier of the first target scheme sent by the client; Before processing the token based on the first target algorithm-related scheme, the method further includes: The encrypted token is decrypted using the client key to obtain the token.

13. A token generation device, characterized in that, Applied to the client side, including: A receiving module is used to receive a target total code and a first target scheme identifier sent by the server. The first target scheme identifier identifies a first target algorithm-related scheme, which is an algorithm-related scheme for the current period obtained by the server adjusting the algorithm-related schemes participating in token generation according to a preset period. The algorithm-related scheme includes an encoding algorithm scheme, an encryption algorithm scheme, and a verification algorithm scheme. Each of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme has multiple candidate schemes. The first target algorithm-related scheme includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme. The target total code includes sub-codes corresponding to the target encoding algorithm scheme, the target encryption algorithm scheme, and the target verification algorithm scheme within the first target algorithm-related scheme. The generation module is used to execute the target general code and process the assignment information of the fields participating in the generation of the token according to the relevant scheme of the first target algorithm to obtain the token. The token includes data obtained by processing the assignment information of the fields participating in the generation of the token according to the relevant scheme of the first target algorithm. The first sending module is used to send the request content, the token, and the first target scheme identifier to the server. The target total code is obtained by updating the total code used to generate the token based on the sub-codes corresponding to the target encoding algorithm scheme, the sub-codes corresponding to the target encryption algorithm scheme, and the sub-codes corresponding to the target verification algorithm scheme. The total code used to generate the token is generated based on the sub-codes corresponding to the pre-set data structure scheme and the sub-codes corresponding to each algorithm scheme in the pre-set algorithm-related scheme. The data structure scheme is used to determine the data structure of the token. The data structure scheme is adjusted according to the preset period and there are multiple candidate schemes. The data structure scheme includes: a scheme for inserting redundant data and / or a data hiding scheme.

14. A token generation device, characterized in that, Applied to the server side, including: The adjustment module is used to adjust the algorithm-related schemes involved in token generation according to a preset period; wherein, the algorithm-related schemes include encoding algorithm schemes, encryption algorithm schemes, and verification algorithm schemes; each of the encoding algorithm scheme, the encryption algorithm scheme, and the verification algorithm scheme has multiple candidate schemes; The acquisition module is used to, in response to reaching a preset trigger condition, acquire algorithm-related schemes within the current period as second target algorithm-related schemes, and acquire the scheme identifier of the second target algorithm-related scheme as a second target scheme identifier; wherein, each scheme identifier is used to identify an algorithm-related scheme, and the scheme identifier includes the algorithm identifier of the encoding algorithm scheme, the algorithm identifier of the encryption algorithm scheme, and the algorithm identifier of the verification algorithm scheme; the second target scheme identifier is used to identify the second target algorithm-related scheme, which includes a target encoding algorithm scheme, a target encryption algorithm scheme, and a target verification algorithm scheme, and the second target scheme identifier includes the algorithm identifier of the target encoding algorithm scheme, the algorithm identifier of the target encryption algorithm scheme, and the algorithm identifier of the target verification algorithm scheme; The recording module is used to record the correspondence between the identifier of the second target scheme and the expiration time information of the related schemes of the second target algorithm in the correspondence table; The update module is used to update the total code for generating tokens based on the sub-codes corresponding to the second target algorithm related scheme, so as to obtain the target total code for generating tokens in the current period. The target total code includes the sub-codes corresponding to the target encoding algorithm scheme, the sub-codes corresponding to the target encryption algorithm scheme, and the sub-codes corresponding to the target verification algorithm scheme. The second sending module is used to send the target total code and the second target scheme identifier to the client, so that the client can generate a token based on the second target algorithm related scheme by executing the target total code; The target total code is obtained by updating the total code used to generate the token based on the sub-codes corresponding to the target encoding algorithm scheme, the sub-codes corresponding to the target encryption algorithm scheme, and the sub-codes corresponding to the target verification algorithm scheme. The total code used to generate the token is generated based on the sub-codes corresponding to the pre-set data structure scheme and the sub-codes corresponding to each algorithm scheme in the pre-set algorithm-related scheme. The data structure scheme is used to determine the data structure of the token. The data structure scheme is adjusted according to the preset period and there are multiple candidate schemes. The data structure scheme includes: a scheme for inserting redundant data and / or a data hiding scheme.

15. An electronic device, characterized in that, The electronic device includes: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-12.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-12.

Images