Method of identity verification and related apparatus

Abstract

Embodiments of the present application disclose an identity authentication method and related equipment, which are used for improving identity authentication efficiency. The method comprises the following steps: receiving an identity authentication token sent by a client; the identity authentication token is issued by an issuing server to the client; the identity authentication token is generated by the issuing server based on a preset key processing identity information of the client; the issuing server and the application server belong to the same mutual trust server cluster, wherein the preset keys of each server in the same mutual trust server cluster are consistent; based on the preset key, it is determined whether the verified identity information and the to-be-verified identity information included in the identity authentication token are consistent; if the to-be-verified identity information is consistent with the verified identity information, it is determined that the client passes the identity authentication, and the client is allowed to call the application server.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of cloud services, and in particular to an identity verification method and related device. BACKGROUND

[0002] In network communication, the protection of local data of a client and local data of a server is particularly important. Therefore, in today's network environment, a user needs to perform identity verification when accessing a network or logging into an application.

[0003] When a user needs to access a certain cloud service, a client sends a calling instruction and user information to a corresponding application server, and the application server sends an identity verification request including client identity information to a remote server, where the remote server stores user information of all users allowed to access the application server. The remote server determines whether there is identity information consistent with the received client identity information locally, and if so, determines that the client passes the identity verification and informs the application server to allow the client to call.

[0004] However, identity verification based on the remote server is very time-consuming due to network latency and other reasons. When the client frequently generates business demands and needs to access the application server, each access needs to initiate identity verification from the corresponding application server to the remote server, and the client is allowed to access only after the verification is passed, which consumes a lot of time and becomes a bottleneck for performance improvement of the corresponding business. SUMMARY

[0005] Embodiments of the present application provide an identity verification method and related device for improving identity verification efficiency.

[0006] A first aspect of embodiments of the present application provides an identity verification method applied to an application server, the method comprising:

[0007] receiving an identity verification token sent by a client; the identity verification token being issued by an issuing server to the client; the identity verification token being generated by the issuing server based on a preset key processing identity information of the client; the issuing server and the application server belong to the same trusted server cluster, wherein the preset keys of each server in the same trusted server cluster are consistent;

[0008] determining whether the verified identity information and the to-be-verified identity information included in the identity verification token are consistent based on the preset key;

[0009] if the to-be-verified identity information is consistent with the verified identity information, determining that the client passes the identity verification and allowing the client to call the application server.

[0010] In a specific implementation, after allowing the client to call the application server, the method further includes:

[0011] sending, in response to a service call request for other services, an authentication token of the client to other servers that deploy the other services, the other servers belonging to the same trusted server cluster as the application server;

[0012] if no check failure information sent by the other servers is received, accessing the other services deployed by the other servers.

[0013] In a specific implementation, the preset key includes a preset private key and a preset public key; and determining, based on the preset key, whether the verified identity information and the to-be-verified identity information included in the authentication token are consistent includes:

[0014] decrypting the verified identity information in the authentication token based on the preset public key to obtain corresponding decrypted identity information; the verified identity information is obtained by the issuing server based on the preset private key encrypting an identity information digest of the client; the identity information digest of the client is obtained by the issuing server based on a preset digest algorithm processing the identity information of the client;

[0015] processing the to-be-verified identity information in the authentication token based on the preset digest algorithm to obtain a to-be-verified identity information digest;

[0016] if the to-be-verified identity information digest is consistent with the decrypted identity information, determining that the to-be-verified identity information is consistent with the verified identity information.

[0017] A second aspect of the embodiments of the application provides an identity authentication method, applied to a client, and the method includes:

[0018] sending, in response to a service call instruction for target services, an authentication token to an application server that deploys the target services; the authentication token is issued by an issuing server to the client; the authentication token is generated by the issuing server based on a preset key processing identity information of the client; the issuing server and the application server belong to the same trusted server cluster, wherein the preset keys of each server in the same trusted server cluster are consistent;

[0019] if no check failure information sent by the application server is received, accessing the target services deployed by the application server.

[0020] In a specific implementation, before the sending of the authentication token to the application server that deploys the target services, the method further includes:

[0021] In response to a service call instruction for any service, a service initialization request is sent to a distribution server deploying the any service, so that the distribution server initiates identity verification for the client to a remote server;

[0022] The identity authentication token sent by the distribution server is received and saved, and any service deployed by the distribution server is accessed based on the identity authentication token; the identity authentication token is generated by the distribution server after the remote server determines that the client is authenticated.

[0023] In a specific implementation, the saving of the identity authentication token sent by the distribution server includes:

[0024] The identity authentication token is saved in a security context of the client local thread.

[0025] The third aspect of the embodiments of the present application provides an identity authentication method, applied to a distribution server, and the method includes:

[0026] In response to a service call request sent by a client, identity verification for the client is initiated to a remote server;

[0027] If the verification pass information for the client sent by the remote server is received, identity information of the client is processed based on a preset key, and an identity authentication token of the client is generated;

[0028] The identity authentication token is sent to the client, so that the client sends a service call request to an application server deploying a target service according to the identity authentication token, and the application server performs identity authentication on the client locally according to the identity authentication token, the application server and the distribution server belong to the same trusted server cluster, and the preset keys of each server in the same trusted server cluster are consistent.

[0029] In a specific implementation, the preset key includes a preset private key and a preset public key; the processing of the identity information of the client based on the preset key to generate the identity authentication token of the client includes:

[0030] The identity information of the client is processed based on a preset digest algorithm to obtain an identity information digest of the client;

[0031] The identity information digest of the client is encrypted based on a preset private key to obtain encrypted identity information;

[0032] The identity authentication token including the identity information of the client and the encrypted identity information is generated.

[0033] The fourth aspect of the embodiments of the present application provides an application server, comprising:

[0034] a receiving unit configured to receive an identity authentication token sent by a client; the identity authentication token is issued by an issuing server to the client; the identity authentication token is generated by the issuing server based on a preset key processing identity information of the client; the issuing server and the application server belong to the same trusted server cluster, wherein the preset keys of each server in the same trusted server cluster are consistent;

[0035] a determining unit configured to determine whether the verified identity information and the to-be-verified identity information included in the identity authentication token are consistent based on the preset key;

[0036] The determining unit is further configured to determine that the client passes the identity authentication if the to-be-verified identity information is consistent with the verified identity information, and allow the client to call the application server.

[0037] In a specific implementation manner, after allowing the client to call the application server, the application server further comprises a sending unit and an accessing unit.

[0038] The sending unit is configured to send the identity authentication token of the client to another server deploying another service in response to a service call request for the other service, wherein the other server and the application server belong to the same trusted server cluster.

[0039] The accessing unit is configured to access the other service deployed by the other server if no check failure information sent by the other server is received.

[0040] In a specific implementation manner, the preset key comprises a preset private key and a preset public key; the determining unit is specifically configured to decrypt the verified identity information in the identity authentication token based on the preset public key to obtain corresponding decrypted identity information; the verified identity information is obtained by the issuing server based on the preset private key encrypting an identity information digest of the client; the identity information digest of the client is obtained by the issuing server based on a preset digest algorithm processing the identity information of the client;

[0041] obtain a to-be-verified identity information digest based on the preset digest algorithm processing the to-be-verified identity information in the identity authentication token;

[0042] If the to-be-verified identity information digest is consistent with the decrypted identity information, it is determined that the to-be-verified identity information is consistent with the verified identity information.

[0043] The fifth aspect of the embodiment of the present application provides a client, comprising:

[0044] a sending unit configured to send an identity authentication token to an application server deploying a target service in response to a service calling instruction for the target service; the identity authentication token is issued by an issuing server to the client; the identity authentication token is generated by the issuing server based on preset key processing of identity information of the client; the issuing server and the application server belong to the same trusted server cluster, wherein the preset keys of each server in the same trusted server cluster are consistent;

[0045] The access unit is configured to access the target service deployed by the application server if the check failure information sent by the application server is not received.

[0046] In a specific implementation manner, before the identity authentication token is sent to the application server deploying the target service, the sending unit is further configured to send a service initialization request to an issuing server deploying any service in response to a service calling instruction for the any service, so that the issuing server initiates identity check for the client to a remote server.

[0047] The access unit is further configured to receive and save the identity authentication token sent by the issuing server, and access any service deployed by the issuing server based on the identity authentication token; the identity authentication token is generated by the issuing server after the remote server determines that the client is authenticated.

[0048] In a specific implementation manner, the access unit is specifically configured to save the identity authentication token in a security context of a local thread of the client.

[0049] The sixth aspect of the embodiment of the present application provides an issuing server, comprising:

[0050] an initiating unit configured to initiate identity check for a client to a remote server in response to a service calling request sent by the client;

[0051] a processing unit configured to generate an identity authentication token of the client based on preset key processing of identity information of the client if check pass information for the client sent by the remote server is received;

[0052] The sending unit is configured to send the identity authentication token to the client, so that the client sends a service invocation request to an application server of a service deployment target according to the identity authentication token, and so that the application server performs identity authentication on the client locally according to the identity authentication token, the application server and the issuing server belonging to the same mutually trusted server cluster, wherein preset keys of each server in the same mutually trusted server cluster are consistent.

[0053] In a specific implementation, the preset key includes a preset private key and a preset public key; and the processing unit is specifically configured to process the identity information of the client based on a preset digest algorithm to obtain an identity information digest of the client.

[0054] The identity information of the client is encrypted based on the preset private key to obtain encrypted identity information.

[0055] The identity authentication token including the identity information of the client and the encrypted identity information is generated.

[0056] The seventh aspect of the embodiments of the present application provides a computer device, which comprises:

[0057] a central processing unit, a memory, and an input and output interface;

[0058] The memory is a transitory storage memory or a persistent storage memory.

[0059] The central processing unit is configured to communicate with the memory and perform instruction operation in the memory to execute the method in the first aspect, the second aspect, or the third aspect.

[0060] The eighth aspect of the embodiments of the present application provides a computer program product containing instructions, when the computer program product is executed on a computer, so that the computer executes the method in the first aspect, the second aspect, or the third aspect.

[0061] The ninth aspect of the embodiments of the present application provides a computer storage medium, the computer storage medium storing instructions, when the instructions are executed on a computer, so that the computer executes the method in the first aspect, the second aspect, or the third aspect.

[0062] From the above technical solution can be seen, the application embodiment has the following advantages: by configuring the same preset key for each application server consistent with the user information allowed to access, a mutual trust server cluster is constituted. The client only initiates a service request to any application server (i.e. issuing server) of the mutual trust server cluster, and the issuing server sends an identity authentication token based on the preset key and the identity information of the client to the client after the identity authentication is passed. After receiving the identity authentication token sent by any application server (i.e. issuing server) of the mutual trust server cluster, the client sends a service call request to the corresponding application server, so that the application server can perform identity authentication on the client locally according to the identity authentication token and the preset key, without the help of a remote server to complete the identity authentication, which can greatly improve the identity authentication efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0063] Figure 1 A system architecture diagram of the identity authentication method disclosed by the embodiment of the application;

[0064] Figure 2 A flowchart of the identity authentication method disclosed by the embodiment of the application;

[0065] Figure 3 Another flowchart of the identity authentication method disclosed by the embodiment of the application;

[0066] Figure 4 A structure diagram of the application server disclosed by the embodiment of the application;

[0067] Figure 5 A structure diagram of the client disclosed by the embodiment of the application;

[0068] Figure 6 A structure diagram of the issuing server disclosed by the embodiment of the application;

[0069] Figure 7 A structure diagram of the computer device disclosed by the embodiment of the application. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the application.

[0071] The business logic of an EJB-carrying application often has specific requirements for the identity of the visitor (or user and / or client), and the identity of the visitor needs to be verified every time the business method of the EJB with security requirements is invoked. Currently, the identity information of the user allowed to access is saved in a remote separate LDAP server (i.e. remote server), and the remote LDAP server needs to be connected to for verification.

[0072] Because the identity verification needs to rely on the remote server every time the business method of the EJB is invoked, network latency or the processing capacity of the remote server will cause time loss and limit the performance improvement of the EJB business.

[0073] In order to solve the above problems of the prior art, the embodiments of the present application provide an identity verification method and related equipment for improving the identity verification efficiency.

[0074] In order to better illustrate the technical solutions of the embodiments of the present application, the following department technical concepts appearing later will be explained and described in advance.

[0075] EJB (Enterprise JavaBeans) technology is a server-side component architecture of Java EE (Java Platform, Enterprise Edition). The EJB technology supports the rapid and simplified development of distributed, transactional, secure and portable applications based on Java technology.

[0076] Cluster: multiple distributed computer nodes provide services as a unified whole, and this whole is called a cluster, which can provide stronger service capability than a single node.

[0077] JNDI (Java Naming and Directory Interface) is an application programming interface that provides naming and directory functions for applications written in Java programming language, and it is defined to be independent of any specific directory service implementation.

[0078] The JNDI name context, or called Context, is composed of a series of "name-object" bindings, and provides methods for finding, creating and deleting these bindings.

[0079] LDAP (Lightweight Directory Access Protocol) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over Internet protocol networks. Directory services can provide any organized collection of records, often with a hierarchical structure, such as a company's e-mail directory, user information, etc.

[0080] An application server is a kind of basic software above the operating system. It is also called a kind of middleware because it is located between the operating system and the application program of the business. It is used to provide an execution environment for the application program, and the underlying services of security, transaction, data, etc. independent of the commonality of each application, so that the developer can focus on the development of business logic.

[0081] A domain is a kind of way to manage applications and processes in the application server. Multiple domains can be established in the installation of each application server. Each domain usually corresponds to a separate process. It can be understood as an instance of the application server, which has the complete function of the application server, and some applications can be deployed on it to provide services to the outside.

[0082] Please refer to the following Figure 1The embodiment of the present application provides an identity authentication system, which comprises a client 101, an issuing server 102, a remote server 103 and an application server 104. The issuing server 102 and the application server 104 belong to the same mutual trust server cluster, that is, the preset key of the issuing server 102 is consistent with the preset key of the application server 104. Before the client 101 initiates a service call request to any application server 104 in the mutual trust server cluster for the first time, the client 101 initiates a service initialization request to the issuing server 102. After receiving the service initialization request, the issuing server 102 initiates an identity authentication request for the client 101 to the remote server 103. The remote server 103 comprises identity information of each user allowed to access the mutual trust server cluster. If the remote server 103 finds that the identity information of the client 101 is allowed to access the mutual trust server cluster, the remote server 103 sends check-through information to the issuing server 102 to inform the issuing server 102 that the client 101 is allowed to access the related service. After receiving the check-through information, the issuing server 102 processes the identity information of the client 101 based on the preset key, generates an identity authentication token, and sends the generated identity authentication token to the client 101. When the client 101 sends a service call request to any application server 104 in the mutual trust server cluster, the client 101 sends the identity authentication token obtained before to the application server 104. The application server 104 can perform identity authentication on the client 101 based on the identity authentication token. If the authentication fails, the application server 104 sends check-failure information to the client 101; if the authentication succeeds, the application server 104 allows the client 101 to access the related service.

[0083] It should be noted that the mutual trust server cluster can further comprise any other server except the issuing server 102 and the application server 104, as long as the identity information of the users allowed to access the servers in the mutual trust server cluster is consistent. In addition, in actual application, the issuing server 102 and the application server 104 can be the same or different servers in the mutual trust server cluster. The difference is that the first server in the mutual trust server cluster accessed by the client 101 can only be the issuing server 102, and any non-first server in the mutual trust server cluster accessed by the client 101 can be the application server 104. The purpose of distinguishing the issuing server 102 and the application server 104 is to better illustrate the identity authentication process of the embodiment of the present application.

[0084] The client 101 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, or the like. The server (including the issuing server 102, the remote server 103, and the application server 104) can be implemented by an independent server or a server cluster composed of multiple servers.

[0085] Based on the foregoing identity verification system, referring to Figure 2 The embodiment of the present application provides an identity verification method, which can be executed by the foregoing client 101, the issuing server 102, the remote server 103, and / or the application server 104. The method comprises the following steps:

[0086] 201. The client sends an identity verification token to an application server deploying a target service in response to a service call instruction for the target service.

[0087] When a user needs to access a target service, the user initiates a service call instruction for the target service through a client. Then, an identity verification token is sent to an application server deploying the target service. The application server can verify whether the client has the permission to access the target service based on the identity verification token. The application server deploying the target service can be any server deploying the target service.

[0088] It should be noted that the identity verification token is sent to the client by the issuing server belonging to the same mutually trusted server cluster as the application server, and is generated by the issuing server based on a preset key processing the identity information of the client (here, the identity information is the identity information verified by the remote server). The preset key of each server (including the application server and / or the issuing server) in the same mutually trusted server cluster is consistent.

[0089] It can be understood that, in actual application, the same preset key can be configured for each server in the same mutually trusted server cluster by the following methods, but is not limited to the following methods: 1) the same identity password is configured for each server in the same mutually trusted server cluster, and each server can generate the same preset key based on the same identity password; 2) the same preset key is directly configured for each server in the same mutually trusted server cluster. In addition, for method 1, after the same identity password is further configured for each server in the same mutually trusted server cluster, each server can encrypt the identity password in the local by any encryption method, and only decrypt the identity password when the preset key needs to be generated. In this way, even if two servers have the same identity password, the ciphertext obtained after encryption is completely different, and the outside world cannot determine whether the two servers belong to the same mutually trusted server cluster according to the encrypted identity password.

[0090] 202. The application server determines whether the verified identity information included in the identity verification token and the identity information to be verified are consistent based on the preset key.

[0091] Because the application server and the issuing server belong to the same trusted server cluster, the preset key in the application server is consistent with the preset key of the issuing server. Meanwhile, the identity verification token is generated by the issuing server based on the preset key to process the identity information of the client. Therefore, by processing the identity verification token based on the preset key, it can be determined whether the verified identity information included in the identity verification token and the identity information to be verified are consistent. It should be noted that the verified identity information recorded in the identity verification token is encrypted and therefore cannot be tampered with; while the identity information to be verified recorded in the identity verification token is the identity information of the client recorded in plaintext. The identity information includes but is not limited to user information (such as username and user identifier) and / or client IP, etc.

[0092] In actual application, the identity information to be verified is usually the original identity information of the client, and the verified identity information can be the original identity information of the client encrypted based on the preset key, or the digest of the identity information of the client encrypted based on the preset key. For example, if the identity information of the client is A, the identity information to be verified in the corresponding identity verification token can be A, and the verified identity information in the corresponding identity verification token can be A encrypted based on the preset key or the digest of A encrypted based on the preset key (wherein the digest of A refers to the data obtained by processing A based on a preset digest algorithm).

[0093] 203. If the identity information to be verified is consistent with the verified identity information, the application server determines that the client passes the identity verification and allows the client to call the application server.

[0094] The verified identity information obtained in step 202 is the identity information verified by the remote server, that is, the client corresponding to the verified identity information is allowed to access the target service. Therefore, if the identity information to be verified is consistent with the verified identity information, it means that the identity verification token is generated by any trusted server cluster of the application server, that is, the client holding the identity verification token in step 201 is allowed to access the application server deploying the target service and the target service deployed by the application server.

[0095] 204. If the client does not receive the check failure information sent by the application server, the target service deployed by the application server is accessed.

[0096] If the application server finds that the to-be-verified identity information is inconsistent with the already-verified identity information, the application server sends check failure information to the client to inform the client that the client cannot continue to access the target service deployed on the application server. In actual application, the client can keep accessing the target service deployed on the application server before receiving the check failure information, or the client can consider that the check is successful and continue to access the target service deployed on the application server if the client does not receive the check failure information within a certain time.

[0097] In the embodiment of the application, the same preset key is configured for each application server whose user information is consistent with the allowed access, to form a mutual trust server cluster. The client only needs to initiate a service request to any application server (i.e., an issuing server) of the mutual trust server cluster once, and the issuing server sends an identity verification token based on the preset key and the processing of the identity information of the client after the identity verification is passed. After receiving the identity verification token sent by any application server (i.e., an issuing server) of the mutual trust server cluster, the client sends a service call request to the corresponding application server, so that the application server can perform identity verification on the client locally according to the foregoing content without the help of a remote server to complete the identity verification, which can greatly improve the identity verification efficiency. That is, the servers in the same server cluster can mutually recognize the identity verification tokens issued by each other, so that the identity verification can be quickly completed locally, avoiding the calling of the authentication method of the remote server, thereby improving the performance.

[0098] In some specific implementation manners, the preset key usually includes a preset public key and a preset private key, and the foregoing step 202 can be implemented in the following manner: decrypting the already-verified identity information in the identity verification token based on the preset public key to obtain corresponding decrypted identity information; the already-verified identity information is obtained by the issuing server based on the preset private key and the identity information digest of the client; the identity information digest of the client is obtained by the issuing server based on the preset digest algorithm and the identity information of the client; the to-be-verified identity information digest is obtained by processing the to-be-verified identity information in the identity verification token based on the preset digest algorithm; and if the to-be-verified identity information digest is consistent with the decrypted identity information, it is determined that the to-be-verified identity information is consistent with the already-verified identity information.

[0099] Specifically, the identity information to be verified in the identity verification token is processed by using a preset digest algorithm to obtain a digest of the identity information to be verified. Further, the verified identity information in the identity verification token is decrypted by using a preset public key to obtain corresponding decrypted identity information. Finally, the consistency of the identity information to be verified and the verified identity information can be determined by comparing the consistency of the digest of the identity information to be verified and the decrypted identity information. In addition, if the verified identity information in the identity verification token is obtained by encrypting the identity information of the client based on a preset private key, the identity information of the client can be obtained by decrypting the verified identity information by using the preset public key, and the consistency of the identity information to be verified and the verified identity information can be determined by comparing the consistency of the identity information to be verified and the identity information of the client.

[0100] Please refer to Figure 3 On the basis of the foregoing embodiment, before the client sends a service invocation request to the application server, the client also needs to send a first service invocation request for any server in the corresponding trusted server cluster, i.e., the issuing server, to generate an identity verification token. The embodiment of the application also includes the following steps:

[0101] 301. The client sends a service initialization request to the issuing server deploying any service in response to a service invocation instruction for any service.

[0102] The identity verification token can be obtained by initiating a first service invocation request for any service in the trusted server cluster where the application server is located. Specifically, the server receiving the first service invocation request is the issuing server, and the service deployed by the issuing server is the foregoing any service. Because the server receiving the service invocation request sent by the client is uncertain, the service invocation instruction initiated by the client for any service can be initiated for any server in the trusted server cluster.

[0103] It should be noted that when the client first receives a service invocation instruction initiated by a user for any server in a certain trusted server cluster (the instruction is initiated by the user to the client), the client first sends a service initialization request to the issuing server deploying any service to verify whether the client has the permission to access the server. Only after it is determined that the client has the permission to access the any service, the client will initiate a service invocation request for the any service deployed by the sending server to access the any service.

[0104] 302. The issuing server initiates an identity check for the client to the remote server in response to the service initialization request sent by the client.

[0105] When the client sends a service initialization request to any server in the mutual trust server cluster, the local does not have an identity authentication token encrypted by any server in the mutual trust server cluster. Therefore, when the client sends the service initialization request for the first time, the issuing server needs to complete identity verification with the help of the remote server.

[0106] 303、If the client passes the identity verification, the remote server sends verification pass information to the issuing server.

[0107] If the identity information of the client is allowed to access any of the aforementioned services deployed by the issuing server, the remote server sends the verification pass information to the issuing server to inform the issuing server of the identity verification result of the client.

[0108] 304、If the issuing server receives the verification pass information sent by the remote server for the client, the issuing server processes the identity information of the client based on a preset key to generate an identity authentication token of the client.

[0109] If the issuing server receives the verification pass information sent by the remote server for the client, it means that the client passes the identity verification. Then, the issuing server can execute processing on the verified identity information of the client based on a preset key to generate an identity authentication token of the client.

[0110] In some specific implementations, this step can be implemented in the following manner: processing the identity information of the client based on a preset digest algorithm to obtain an identity information digest of the client; encrypting the identity information digest of the client based on a preset private key to obtain verified identity information; and generating an identity authentication token including the identity information of the client and the verified identity information.

[0111] Specifically, first, the identity information of the client is processed based on a preset digest algorithm to obtain a corresponding identity information digest. Then, the corresponding identity information digest is encrypted based on a preset private key and a preset encryption algorithm to obtain encrypted identity information (i.e., the verified identity information described in the aforementioned embodiments). Finally, the identity information of the client and the encrypted identity information can be combined as an identity authentication token. The encrypted identity information can be used to determine whether the issuing server and the application server belong to the same mutual trust server cluster (if they do not belong to the same mutual trust server cluster, the application server cannot decrypt the encrypted identity information using a preset public key); and the identity information of the client is the identity information to be verified described in the aforementioned embodiments. Because the identity information of the client exists in the identity authentication token in plaintext form, its content cannot be guaranteed not to be tampered with, and therefore it is referred to as identity information to be verified.

[0112] In addition, the identity authentication token can also be generated in the following manner: first, identity information of the client is encrypted based on a preset private key and a preset encryption algorithm to obtain encrypted identity information (i.e., the verified identity information described in the foregoing embodiment). That is, the identity information of the client is directly encrypted to obtain the encrypted identity information. Finally, the identity information of the client and the encrypted identity information can be combined as the identity authentication token. The embodiments of the present application do not specifically limit the generation manner of the identity authentication token.

[0113] It should be noted that, according to the generation manner of the identity authentication token, the consistency of the identity information to be verified and the verified identity information is verified in different manners.

[0114] 305. The issuing server sends the identity authentication token to the client.

[0115] 306. The client receives and saves the identity authentication token sent by the issuing server.

[0116] Specifically, the client can save the identity authentication token in any location of the client locally. In order to facilitate the calling of the identity authentication token, the identity authentication token can be saved in a security context field of a local thread. Because the security context field is saved in ThreadLocal, i.e., in the same thread, the security context field is particularly convenient to use, and does not need to be explicitly transmitted, and can be directly obtained anywhere.

[0117] In the embodiments of the present application, various implementation manners of the identity authentication token are provided, and the realizability of the scheme is improved.

[0118] On the basis of the foregoing embodiments, after the application server receives a service call request for a target service deployed by the application server, the application server can also initiate a service call request for other services deployed by other servers in the same mutual trust server cluster according to the needs of the service logic, instead of the client sending the identity authentication token of the client to the other servers to perform local identity verification.

[0119] The foregoing describes various embodiments of the identity authentication method of the present application, and the identity authentication method of the embodiments of the present application is described below in a specific scenario.

[0120] When the client sends a service initialization request, the username and password are passed to the issuing server in the env when generating the JNDI name context ctx = new InitialContext(env). After the issuing server verifies the username and password, the issuing server returns an AccessToken (that is, an identity authentication token) to the client. The client saves the identity authentication token in the local thread security context after obtaining the identity authentication token. The client can continuously call the business method by taking the EJB object within the scope of the security context. The identity information is no longer passed to the application server, but the identity authentication token is passed secretly. The application server verifies the identity authentication token locally. If the verification is passed, the application server allows the access. If the verification is failed, the application server reports the verification failure and does not allow the access.

[0121] Because the application server and the issuing server belong to the same mutual trust server cluster, and any server in the same mutual trust server cluster can recognize the identity authentication token issued by the other server. In addition to the scenario of using the EJB cluster to establish the mutual trust server cluster among the EJB cluster members, there is another scenario. For example, a web domain receives the identity information input by a user through a login page. After the identity information is verified by a specific manner, the web domain generates an identity authentication token and saves the identity authentication token in the local thread security context. At this time, if the web domain directly calls the EJB in another EJB domain, as long as the web domain and the EJB domain trust each other, the web domain can call the EJB successfully. It should be noted that the two domains (that is, the EJB domain and the web domain) have no essential difference. The EJB domain and the web domain are only called in this way because the EJB application is usually deployed in the EJB domain, and the web application is usually deployed in the web domain. In fact, the EJB and the web can be deployed in the same domain. There is no mandatory requirement to separate the deployment. The separation of the deployment is only because of the management needs, such as the clearer division of responsibilities, or the different domains can form clusters of different sizes.

[0122] Please refer to Figure 4 The embodiment of the application provides an application server, comprising:

[0123] A receiving unit 401 is configured to receive an identity authentication token sent by a client. The identity authentication token is issued by an issuing server to the client. The identity authentication token is generated by the issuing server based on pre-set keys processing identity information of the client. The issuing server and the application server belong to the same mutual trust server cluster. The pre-set keys of each server in the same mutual trust server cluster are consistent.

[0124] A determining unit 402 is configured to determine whether the verified identity information and the to-be-verified identity information included in the identity authentication token are consistent based on the pre-set keys.

[0125] The determining unit 402 is further configured to determine that the client passes the identity verification and allow the client to invoke the application server if the to-be-verified identity information is consistent with the verified identity information.

[0126] In a specific implementation, after allowing the client to invoke the application server, the application server further includes a sending unit and an accessing unit.

[0127] The sending unit is configured to send, in response to a service invocation request for other services, an identity verification token of the client to another server that deploys the other services, the other server and the application server belonging to a same trusted server cluster.

[0128] The accessing unit is configured to access the other services deployed by the other server if no verification failure information sent by the other server is received.

[0129] In a specific implementation, the preset key includes a preset private key and a preset public key; the determining unit 402 is specifically configured to decrypt the verified identity information in the identity verification token based on the preset public key to obtain corresponding decrypted identity information; the verified identity information is obtained by the issuing server based on the preset private key encrypting an identity information digest of the client; the identity information digest of the client is obtained by the issuing server based on a preset digest algorithm processing the identity information of the client.

[0130] The to-be-verified identity information in the identity verification token is processed based on a preset digest algorithm to obtain a to-be-verified identity information digest.

[0131] If the to-be-verified identity information digest is consistent with the decrypted identity information, it is determined that the to-be-verified identity information is consistent with the verified identity information.

[0132] For details, please refer to Figure 5 The application embodiment provides a client, which includes:

[0133] The sending unit 501 is configured to send, in response to a service invocation instruction for target services, an identity verification token to an application server that deploys the target services; the identity verification token is issued by an issuing server to the client; the identity verification token is generated by the issuing server based on a preset key processing the identity information of the client; the issuing server and the application server belong to a same trusted server cluster, wherein the preset keys of each server in the same trusted server cluster are consistent.

[0134] The accessing unit 502 is configured to access the target services deployed by the application server if no verification failure information sent by the application server is received.

[0135] In an implementation, before sending the identity authentication token to the application server where the target service is deployed, the sending unit 501 is further configured to, in response to a service invocation instruction for any service, send a service initialization request to the issuance server where any service is deployed, so that the issuance server initiates an identity check for the client to the remote server.

[0136] The access unit 502 is further configured to receive and save the identity authentication token sent by the issuance server, and access any service deployed by the issuance server based on the identity authentication token.

[0137] In an implementation, the access unit 502 is specifically configured to save the identity authentication token in a security context of a local thread of the client.

[0138] Please refer to Figure 6 The embodiment of the present application provides a kind of issuance server, comprising:

[0139] The initiation unit 601 is configured to initiate an identity check for the client to the remote server in response to the service invocation request sent by the client.

[0140] The processing unit 602 is configured to, if receiving the check pass information sent by the remote server for the client, process the identity information of the client based on the preset key, and generate the identity authentication token of the client.

[0141] The sending unit 603 is configured to send the identity authentication token to the client, so that the client sends the service invocation request to the application server where the target service is deployed according to the identity authentication token, and the application server performs identity authentication on the client locally according to the identity authentication token, and the application server and the issuance server belong to the same mutual trust server cluster, wherein the preset keys of each server in the same mutual trust server cluster are consistent.

[0142] In an implementation, the preset key includes a preset private key and a preset public key; the processing unit 602 is specifically configured to process the identity information of the client based on a preset digest algorithm to obtain an identity information digest of the client.

[0143] The identity information digest of the client is encrypted based on the preset private key to obtain encrypted identity information.

[0144] The identity authentication token including the identity information of the client and the encrypted identity information is generated.

[0145] Figure 7is a schematic diagram of a computer device structure provided in the embodiments of the present application. The computer device 700 can include one or more central processing units (CPU) 701 and a memory 705, and the memory 705 stores one or more application programs or data.

[0146] The memory 705 can be volatile memory or persistent memory. The programs stored in the memory 705 can include one or more modules, and each module can include a series of instruction operations in the computer device. Further, the central processing unit 701 can be configured to communicate with the memory 705 and execute the series of instruction operations in the memory 705 on the computer device 700.

[0147] The computer device 700 can further include one or more power supplies 702, one or more wired or wireless network interfaces 703, one or more input / output interfaces 704, and / or one or more operating systems, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0148] The central processing unit 701 can execute the operations of the computer device in the embodiments described above, and details are not repeated here. The computer device can be a client, an issuing server, an application server and / or a remote server. Figures 1 to 6

[0149] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which are not repeated here.

[0150] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0151] ​The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0152] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0153] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, read-only memory), a random access memory (RAM, random access memory), a magnetic disk or an optical disk, and various program code storage media.

[0154] The embodiments of the present application also provide a computer program product containing instructions, which, when the computer program product runs on a computer, causes the computer to execute the identity verification method as described above.

Claims

1. An identity verification method, characterized by, The method applied to an application server comprises: receiving an authentication token sent by a client; the authentication token is issued by an issuing server to the client; the authentication token is generated by the issuing server based on a preset key processing identity information of the client; the issuing server and the application server belong to the same trusted server cluster, wherein the preset keys of each server in the same trusted server cluster are consistent and have the permission to issue the authentication token of the other party; the issuing server is any application server in the trusted server cluster; based on the preset key, the application server locally determines whether the verified identity information and the to-be-verified identity information included in the authentication token are consistent; if the to-be-verified identity information is consistent with the verified identity information, it is determined that the client passes the authentication, and the client is allowed to call the application server.

2. The method of claim 1, wherein, After allowing the client to call the application server, the method further comprises: in response to a service call request for other services, sending the authentication token of the client to other servers deploying the other services, wherein the other servers and the application server belong to the same trusted server cluster; if no verification failure information sent by the other servers is received, the other services deployed by the other servers are accessed.

3. The method of claim 1, wherein, The preset key comprises a preset private key and a preset public key; based on the preset key, determining whether the verified identity information and the to-be-verified identity information included in the authentication token are consistent, comprises: decrypting the verified identity information in the authentication token based on the preset public key to obtain corresponding decrypted identity information; the verified identity information is obtained by the issuing server based on the preset private key encrypting an identity information digest of the client; the identity information digest of the client is obtained by the issuing server based on a preset digest algorithm processing the identity information of the client; processing the to-be-verified identity information in the authentication token based on the preset digest algorithm to obtain a to-be-verified identity information digest; if the to-be-verified identity information digest is consistent with the decrypted identity information, it is determined that the to-be-verified identity information is consistent with the verified identity information.

4. An identity verification method characterized by, The method applied to a client comprises: in response to a service call instruction for a target service, sending an authentication token to an application server deploying the target service; the authentication token is issued by an issuing server to the client; the authentication token is generated by the issuing server based on a preset key processing identity information of the client; the issuing server and the application server belong to the same trusted server cluster, wherein the preset keys of each server in the same trusted server cluster are consistent and have the permission to issue the authentication token of the other party; the issuing server is any application server in the trusted server cluster; if no verification failure information sent by the application server after local verification is received, the target service deployed by the application server is accessed.

5. The method of claim 4, wherein, Before sending the authentication token to the application server deploying the target service, the method further comprises: in response to a service invocation instruction for any service, sending a service initialization request to the issuance server deploying the any service, so that the issuance server initiates identity verification for the client to the remote server; receiving and saving the authentication token sent by the issuance server, and accessing any service deployed by the issuance server based on the authentication token; the authentication token is generated by the issuance server after the remote server determines that the client is authenticated.

6. The method of claim 5, wherein, The saving of the authentication token sent by the issuance server comprises: saving the authentication token in the security context of the client local thread.

7. An identity verification method characterized by, The method applied to the issuance server comprises: in response to a service invocation request sent by the client, initiating identity verification for the client to the remote server; if the verification pass information for the client sent by the remote server is received, processing the identity information of the client based on a preset key to generate an authentication token of the client; sending the authentication token to the client, so that the client sends a service invocation request to the application server deploying the target service according to the authentication token, and so that the application server performs identity verification on the client locally according to the authentication token, the application server and the issuance server belong to the same trusted server cluster, wherein the preset keys of each server in the same trusted server cluster are consistent and have the permission to verify the authentication token issued by the other party, and the issuance server is any application server in the trusted server cluster.

8. The method of claim 7, wherein, The preset key comprises a preset private key and a preset public key; The processing of the identity information of the client based on the preset key to generate the authentication token of the client comprises: processing the identity information of the client based on a preset digest algorithm to obtain an identity information digest of the client; encrypting the identity information digest of the client based on a preset private key to obtain encrypted identity information; generating an authentication token comprising the identity information of the client and the encrypted identity information.

9. A computer device, comprising: Comprise: central processing unit, memory and input and output interface; The memory is a volatile storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instruction operation in the memory to execute the method of any one of claims 1-3, 4-6 or 7-8.

10. A computer storage medium, characterized in that, The computer storage medium stores instructions, and the instructions make the computer execute the method of any one of claims 1-3, 4-6 or 7-8 when executed on the computer.

11. A computer program product comprising instructions which, when the computer program product is executed on a computer, cause the computer to carry out the method of any one of claims 1-3, 4-6 or 7-8.

Images