Access authentication method, device, equipment, storage medium and program product

Abstract

The present disclosure provides an access authentication method, which relates to the field of cloud computing technology and can be applied to the field of financial technology. The method comprises: in response to a connection request from a client, authenticating the identity of a client to be connected; after the identity authentication is successful, sending metadata information and an encryption key to the client to be connected; in response to an operation request from the client, performing permission verification on the operation request based on the type of the operation request, wherein the operation request includes encrypted serial number information, which is obtained by encrypting the encrypted serial number using the encryption key; and executing the operation request after the permission verification is successful. The present disclosure also provides an access authentication apparatus, device, storage medium, and program product.

Description

Technical Field

[0001] The present disclosure relates to the field of cloud technology, specifically to the field of cluster operation and maintenance technology, and more specifically to an access authentication method, apparatus, device, storage medium, and program product. Background Art

[0002] As a high-throughput distributed messaging system, Kafka has been applied in the actual business of many large companies. In related technologies, when using Kafka, you need to first construct a client object, then obtain the metadata information of the Kafka cluster, and then encapsulate the corresponding operation request according to the client type and send it to the corresponding Broker node in the metadata. Finally, the Kafka Broker node executes the corresponding operation and returns the execution result to the client.

[0003] Since the access method and operation process of the management client and the production or consumption client are consistent, when ordinary users create a management client object, they can directly perform cluster management operations, which seriously threatens production security.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0005] In view of the above problems, the present disclosure provides an access authentication method, apparatus, device, storage medium and program product for resolving security risks.

[0006] According to a first aspect of the present disclosure, there is provided an access authentication method, which is applied to a server, and the method includes:

[0007] In response to the client's connection request, authenticate the client to be connected;

[0008] After the identity verification is passed, metadata information and encryption key are sent to the client to be connected;

[0009] In response to an operation request from a client, performing permission verification on the operation request according to the type of the operation request, the operation request including encrypted serial number information, the encrypted serial number information being obtained by being encrypted according to the encryption key; and

[0010] After the permission verification is passed, the operation request is executed.

[0011] According to an embodiment of the present disclosure, authenticating the client to be connected includes:

[0012] Obtaining connection request information; and

[0013] Authentication is performed on the client to be connected according to the connection request information.

[0014] According to an embodiment of the present disclosure, the server pre-registers accessible application credential information, and the authentication of the client to be connected according to the connection request information includes:

[0015] parsing the connection request information to determine request header information, the request header information including application information; and

[0016] The client to be connected is verified according to the application information and the application credential information.

[0017] According to an embodiment of the present disclosure, the server also pre-registers a whitelist of client serial number information, and the authorization verification of the operation request according to the type of the operation request includes:

[0018] When it is determined that the type of the operation request is a management and maintenance operation, the encrypted serial number information is segmented and parsed to determine an encryption key;

[0019] parsing the encrypted serial number information according to the encryption key to determine the original serial number information; and

[0020] Permission verification is performed based on the original sequence information and the client serial number information whitelist.

[0021] According to an embodiment of the present disclosure, it further includes:

[0022] If it is determined that the permission verification fails, a response with a permission exception is returned to the client;

[0023] Record the client information and send abnormal alarm information to the preset message queue.

[0024] A second aspect of the present disclosure provides an access authentication method, applied to a client, the method comprising:

[0025] Encapsulate the client application information in the request information and send the access request to the server;

[0026] Receive metadata information and encryption keys returned by the server;

[0027] Encrypting the original serial number information of the client according to the encryption key to generate encrypted serial number information;

[0028] Generate an operation request based on the business operation type and the encrypted serial number information package; and

[0029] The operation request is sent to the server according to the metadata information.

[0030] A third aspect of the present disclosure provides an access authentication device, applied to a server, the device comprising:

[0031] An authentication module is used to authenticate the client in response to the client's connection request;

[0032] A first sending module, configured to send metadata information and an encryption key to the client to be connected after the identity authentication is passed;

[0033] an authority verification module, configured to respond to an operation request from a client and perform authority verification on the operation request according to the type of the operation request, wherein the operation request includes encrypted serial number information, and the encrypted serial number information is obtained by being encrypted according to the encryption key; and

[0034] The operation execution module is used to execute the operation request after the permission verification is passed.

[0035] According to an embodiment of the present disclosure, the identity authentication module includes: an acquisition submodule and an identity authentication submodule.

[0036] An acquisition submodule, used to obtain connection request information; and

[0037] The identity authentication submodule is used to authenticate the client to be connected according to the connection request information.

[0038] According to an embodiment of the present disclosure, the server is pre-registered with accessible application credential information, and the identity authentication submodule includes: a first determination unit and an identity authentication unit.

[0039] a first determining unit, configured to parse the connection request information to determine request header information, wherein the request header information includes application information; and

[0040] An identity authentication unit is used to authenticate the client to be connected according to the application information and the application credential information.

[0041] According to an embodiment of the present disclosure, the server also pre-registers a whitelist of client serial number information, and the authority verification module includes: a first parsing submodule, a second parsing submodule and a authority verification submodule.

[0042] A first parsing submodule is configured to, when determining that the type of the operation request is a management and maintenance operation, parse the encrypted serial number information in sections to determine an encryption key;

[0043] A second parsing submodule is configured to parse the encrypted serial number information according to the encryption key to determine the original serial number information; and

[0044] The authority verification submodule is used to perform authority verification based on the original sequence information and the client serial number information whitelist.

[0045] According to an embodiment of the present disclosure, the system further includes: a determination module and a third sending module.

[0046] A determination module, configured to return a response with a permission exception to the client if it is determined that the permission verification fails;

[0047] The third sending module is used to record the client information and send abnormal alarm information to a preset message queue.

[0048] A fourth aspect of the present disclosure provides an access authentication device, applied to a client, the device comprising:

[0049] Access request encapsulation module, used to encapsulate client application information in request information and send access request to the server;

[0050] The receiving module is used to receive metadata information and encryption keys returned by the server;

[0051] An encryption module, configured to encrypt the original serial information of the client according to the encryption key to generate encrypted serial number information;

[0052] an operation request encapsulation module, configured to encapsulate and generate an operation request according to the business operation type and the encrypted sequence number information; and

[0053] The second sending module is used to send the operation request to the server according to the metadata information.

[0054] The fifth aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned access authentication method.

[0055] A sixth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned access authentication method.

[0056] A seventh aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above-mentioned access authentication method when executed by a processor.

[0057] The access authentication method provided by the embodiments of the present disclosure authenticates the client when it requests access to a cluster, filters out unauthorized users, and improves management and control of client access. After successful authentication, metadata and encryption keys are sent to the client. Upon receiving an operation request from the client, permissions are verified based on the type of operation request. Once the permissions are verified, the operation request is executed, thereby achieving permission control for both management and ordinary clients. Compared to related technologies, the access authentication method provided by the embodiments of the present disclosure can reduce operational risks and improve production safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0059] Figure 1 The flowchart of the client access process in the related art is schematically shown;

[0060] Figure 2 Schematically illustrates an application scenario diagram of the access authentication method, apparatus, device, storage medium, and program product according to an embodiment of the present disclosure;

[0061] Figure 3 The following schematically shows a system architecture diagram of an access authentication device provided according to an embodiment of the present disclosure;

[0062] Figure 4 The following schematically shows a flow chart of an access authentication method provided according to an embodiment of the present disclosure;

[0063] Figure 5 Schematically illustrates one of the flow charts of the client identity authentication method provided according to an embodiment of the present disclosure;

[0064] Figure 6 Schematically shows a second flow chart of a client identity authentication method provided according to an embodiment of the present disclosure;

[0065] Figure 7 The following schematically shows a flow chart of a method for verifying client authority according to an embodiment of the present disclosure;

[0066] Figure 8 A flowchart of another access authentication method provided by an embodiment of the present disclosure is schematically shown;

[0067] Figure 9 The following schematically shows a structural block diagram of an access authentication device according to an embodiment of the present disclosure;

[0068] Figure 10A schematic structural diagram of another access authentication device according to an embodiment of the present disclosure is shown; and

[0069] Figure 11 A block diagram of an electronic device suitable for implementing an access authentication method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0070] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0071] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0072] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0073] When expressions such as "at least one of A, B and C, etc." are used, they should generally be interpreted in accordance with the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0074] First, the terms that appear in the embodiments of the present disclosure are explained:

[0075] Kafka: An open source stream processing platform developed by the Apache Software Foundation. It is a high-throughput distributed publish-subscribe messaging system.

[0076] Broker: A service proxy node. For Kafka, a broker can be simply considered an independent Kafka service node or server instance. One or more brokers form a Kafka cluster.

[0077] Clients: They are divided into management clients and regular clients. The management client is the AdminClient, which can create and delete message queues, modify cluster configuration or message topic configuration, and modify ACL permission configuration by calling APIs. Regular clients are further divided into producer clients (Producer) and consumer clients (Consumer). Producer clients are responsible for sending messages to message queues, while consumer clients receive messages.

[0078] AdminClientAPI: The API interface for managing the client, which can be directly called through the AdminClient object to perform operation and maintenance management operations of the Kafka cluster.

[0079] In order to better understand the technical problems of the present disclosure, Figure 1 This article introduces the client access process in related technologies. Figure 1 The flowchart of the client access process in the related art is schematically shown. Figure 1 As shown, when a client connects to the server, it first constructs a client object, then obtains the Kafka cluster's metadata. It then encapsulates the corresponding operation request based on the client type and sends it to the broker node corresponding to the metadata. Finally, the Kafka broker node executes the corresponding operation and returns the result to the client. As can be seen from the above, the management client lacks access authentication when connecting to Kafka for operations and maintenance, making it impossible to control client access. Because the access method and operation process for management clients are exactly the same as those for ordinary production and consumption clients, the broker node does not distinguish between them. Once a client object is constructed, it can access the cluster and perform operations. If ordinary users create management client objects, they can directly perform cluster management operations, posing a serious threat to production security.

[0080] In Kafka, scripts are often used to manage entities. To integrate message management functionality into application systems, the Kafka community has released the Java client version of the AdminClient API for daily Kafka cluster operations. While this approach facilitates operational management, it also carries certain security risks. These include:

[0081] 1) Insufficient authentication factors. The management client connecting to Kafka for operation and maintenance lacks access authentication methods, making it impossible to control client access.

[0082] 2) Unclear permissions. The access method and operation process for management clients and regular production / consumer clients are identical. Broker nodes do not differentiate between them. Anyone who constructs a client object can access the cluster and perform operations. Once a regular user creates a management client object, they can directly perform cluster management operations, posing a serious threat to production security.

[0083] Based on the above technical problems, an embodiment of the present disclosure provides an access authentication method, which includes: in response to a connection request from a client, authenticating the access client; after the authentication is passed, sending metadata information and an encryption key to the access client; in response to an operation request from the client, performing permission verification on the operation request according to the type of the operation request, the operation request includes encrypted serial number information, and the encrypted serial number information is obtained by encrypting according to the encryption key; and after the permission verification is passed, executing the operation request.

[0084] Figure 2 The application scenario diagram of the access authentication method, apparatus, device, storage medium and program product according to the embodiments of the present disclosure is schematically shown.

[0085] like Figure 2 As shown, the application scenario 100 according to this embodiment may include an application scenario in which a client accesses a cluster. A network 104 is used as a medium for providing a communication link between terminal devices 101, 102, 103 and a server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0086] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0087] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0088] Server 105 may be a Kafka server, which implements the access authentication method provided by the embodiments of the present disclosure and pre-registers application credentials for accessible clients and a whitelist of client permissions. Upon receiving an access request from a client, the server authenticates the client based on the request information. Upon verification, metadata information and an encryption key are returned to the client. Upon receiving the encryption key, the client encrypts its device serial number using the encryption key, encapsulates the business operation type and the encrypted information, and sends the encrypted information to the server. The server then performs permission verification based on the received encrypted information and, upon successful verification, executes the relevant business operation.

[0089] It should be noted that the access authentication method provided in the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the access authentication apparatus provided in the embodiments of the present disclosure can generally be set in the server 105. The access authentication method provided in the embodiments of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the access authentication apparatus provided in the embodiments of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0090] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0091] It should be noted that the access authentication method and device determined in the embodiments of the present disclosure can be used in the field of cloud computing technology, the field of financial technology, and any field other than the financial field. The application field of the access authentication method and device determined in the embodiments of the present disclosure is not limited.

[0092] Figure 3 The system architecture diagram of the access authentication device provided according to the embodiment of the present disclosure is schematically shown. Figure 3 As shown in the figure, it includes two major components: the server and the client. The client includes the producer client, the consumer client, and the management client. The client is used to send access requests to the client and send business operation requests based on business needs. The server is used to authenticate and verify the client's identity and permissions, and execute the client's requested operations. Specifically, the server encrypts and saves the pre-registered application credentials, and processes the credential information in the request header of the client operation request for access verification. At the same time, the server also pre-enters a whitelist of client serial numbers, allowing clients in the whitelist to perform operation and maintenance management operations.

[0093] The following will be based on Figure 2 Describe the application scenarios and Figure 3 The system architecture described by Figures 4 to 7 The access authentication method of the embodiment of the present disclosure is described in detail.

[0094] Figure 4 The following schematically shows a flow chart of an access authentication method provided according to an embodiment of the present disclosure. Figure 4 As shown, the access authentication method of this embodiment includes operations S210 to S240, which can be executed by a server or other computing device. The access authentication method provided by the embodiment of the present invention involves two major components, the client and the server. The server is first used as the execution subject for the description.

[0095] In operation S210 , in response to a connection request from the client, identity authentication is performed on the client to be connected.

[0096] In an example, in order to implement access control for clients, when a client accesses a cluster, it needs to initiate a connection request to the server and send access information. After receiving the connection request from the client, the server will authenticate the client to filter out illegal access users. The specific process of authentication can be found in Figures 5 and 6 The technical solution shown is not described in detail here. A client that has not passed the authentication cannot establish a connection with the client to send a request.

[0097] In operation S220, after the identity authentication is passed, metadata information and an encryption key are sent to the client to be connected.

[0098] In one example, after the client identity is authenticated, the server returns metadata information and encryption keys to the client, where the metadata information includes the IP address of the server to which the client actually wants to send. Since static passwords have the risk of leakage, in this embodiment, the encryption key is updated periodically, that is, the encryption key changes dynamically. The encryption key is used to encrypt the client's serial number information. In addition, the SSL protocol is used to open an encryption and decryption tunnel transmission between the client and the server to ensure confidentiality, integrity and non-repudiation during transmission.

[0099] In operation S230 , in response to the operation request from the client, permission verification is performed on the operation request according to the type of the operation request.

[0100] In operation S240 , after the authority verification is passed, the operation request is executed.

[0101] According to an embodiment of the present disclosure, the operation request includes encrypted serial number information, and the encrypted serial number information is obtained by being encrypted according to the encryption key.

[0102] According to an embodiment of the present disclosure, if it is determined that the permission verification fails, a response with a permission exception is returned to the client; the client information is recorded and an exception alarm message is sent to a preset message queue.

[0103] In one example, the client encrypts its serial number according to the received encryption key. The client's operation request includes multiple types of requests, such as ordinary client requests and operation and maintenance client requests. Ordinary client requests can be, for example, business operations such as obtaining metadata information, producing messages, consuming messages, and submitting consumption displacements. Operation and maintenance client requests can be, for example, management and operation operations such as obtaining cluster information, adding and deleting message queues, modifying cluster configurations, and modifying message queue configurations. Different operations correspond to different identifiers. The client can determine the specific operation type based on the received operation request, and perform permission verification on the operation request based on the operation type. By performing management authentication on the client, security risks caused by malicious operations are avoided. The specific process of permission verification can be found in Figure 7 Operation S211 and operation S212 are shown.

[0104] After the permission verification is passed, the operation request initiated by the client is executed and the client's execution operation record is saved; if the client passes the identity authentication but fails the permission verification request, a response message indicating that the client has insufficient permissions will be returned, the client information will be recorded, and the client information will be sent to the message queue used to record abnormal client information.

[0105] The access method provided by the embodiments of the present disclosure performs authentication on the client when it requests access to the cluster, filtering out unauthorized users and improving management and control of client access. After successful authentication, metadata and encryption keys are sent to the client. Upon receiving an operation request from the client, permissions are verified based on the type of operation request. Once the permissions are verified, the operation request is executed, thereby achieving permission control for both management and ordinary clients. Compared to related technologies, the access authentication method provided by the embodiments of the present disclosure can reduce operational risks and improve production safety.

[0106] The following will be combined Figures 5-7 This section describes the process of verifying requests initiated by clients. Figure 5 Schematically illustrates one of the flow charts of the client identity authentication method provided according to an embodiment of the present disclosure; Figure 6 The second flowchart of the client identity authentication method provided according to an embodiment of the present disclosure is schematically shown.

[0107] like Figure 5 As shown, operation S210 includes operation S211 and operation S212.

[0108] In operation S211, connection request information is obtained. In operation S212, identity authentication is performed on the client to be connected according to the connection request information.

[0109] like Figure 6 The illustrated operation S212 includes operations S2121 and S2122.

[0110] According to an embodiment of the present disclosure, the server is pre-registered with accessible application credential information.

[0111] In operation S2121, the connection request information is parsed to determine request header information.

[0112] According to an embodiment of the present disclosure, the request header information includes application information.

[0113] In operation S2122, the client to be connected is verified according to the application information and the application credential information.

[0114] In one example, in response to a connection request from a client, connection request information of the client to be connected is obtained, the connection request information is parsed to obtain request header information, and application information of the client to be connected is determined based on the request header information. The application information includes an application name and application credentials. The application credentials can be a string of characters. The server has pre-registered accessible application credential information, for example, an application credential list. The parsed application credential is compared with the application credential information in the application credential list. If they match, it indicates that the client to be connected is a legitimate user and a connection can be established. If they do not match, it indicates that the client to be connected is an illegal user, the current connection request is rejected, and an exception message is returned to the client.

[0115] Figure 7 The flowchart of the client authority verification method provided in accordance with the embodiment of the present disclosure is schematically shown. Figure 7 As shown, operation S230 includes operations S231 to S233.

[0116] In operation S231 , when it is determined that the type of the operation request is a management and maintenance operation, the encrypted serial number information is segmented and parsed to determine an encryption key.

[0117] In operation S232, the encrypted serial number information is parsed according to the encryption key to determine original serial number information.

[0118] In operation S233, permission verification is performed based on the original sequence information and the client serial number information whitelist.

[0119] According to an embodiment of the present disclosure, the server also pre-registers a whitelist of client serial number information.

[0120] In one example, a client can determine the specific operation type based on a received operation request. If the current operation request type is a business operation issued by a standard client, such as producing or consuming a message, the server directly executes the corresponding operation without authorization verification. If the current operation request type is a management and maintenance operation, authorization verification is required for the requesting client before execution. Specifically, the encrypted serial number information in the request header is obtained, segmented and parsed to determine the encryption key. The encrypted serial number information is then parsed again using the encryption key to complete the decryption process. The encrypted serial number information is obtained by encrypting the client's own serial number using the encryption key sent by the server. Each server device serial number is unique. A whitelist of client serial numbers is pre-registered on the server. The whitelist information is encrypted using the DES3 encryption algorithm and recorded in a server-side file. The decrypted serial number is then matched with the serial number in the whitelist. If a match is found, the client is a management client with management and maintenance permissions. If a match is found, the client does not have management and maintenance permissions.

[0121] Scalability: In order to achieve more refined management of client management and operation permissions, the permission operation information corresponding to different client serial numbers can be saved in the pre-registered whitelist. For example, management client A has the permission to obtain cluster information and modify cluster configuration, and management client B has the permission to obtain cluster information, add and delete message queues, and modify cluster configuration. This information and client serial number are recorded in the whitelist. When management client A initiates the management and operation operation of adding and deleting message queues, even if management client A is in the whitelist, management client A still does not have the permission to add or delete message queues.

[0122] Figure 8 The flowchart of another access authentication method provided by the embodiment of the present disclosure is schematically shown. Figure 8 As shown, it includes operations S310 to S350.

[0123] In operation S310, the client application information is encapsulated in the request information and an access request is sent to the server.

[0124] In one example, operations S310 to S350 are all performed by the client. When the client accesses the server and initiates a connection request / access request to the server, the client application information is encapsulated in the request header of the request information.

[0125] In operation S320 , metadata information and encryption key returned by the server are received.

[0126] In operation S330, the client original sequence information is encrypted according to the encryption key to generate encrypted sequence number information.

[0127] In one example, after the server completes authentication, a connection is established and the server returns metadata and an encryption key. The metadata includes information about the specific server node the client is requesting, such as the server's IP address. The encryption key is used to manage the client's serial number encryption. The serial number is encrypted using the encryption key to generate the encrypted serial number.

[0128] In operation S340, an operation request is generated according to the service operation type and the encrypted serial number information package.

[0129] In operation S350, the operation request is sent to the server according to the metadata information.

[0130] In one example, the client encapsulates different operation requests based on different types and business operations. For example, the business operations corresponding to the producer client include producing messages and obtaining metadata information, while the business operations corresponding to the consumer client include submitting consumption displacements and consuming messages. Operations corresponding to the operation and maintenance client include obtaining cluster information, adding and deleting message queues, modifying cluster configuration, and modifying message queue configuration. The client encapsulates the encrypted sequence number information in the operation request and sends the operation request to the corresponding server according to the address in the metadata information.

[0131] Based on the above access authentication method, the present disclosure also provides an access authentication device. Figure 9 The device is described in detail.

[0132] Figure 9 The following schematically shows a structural block diagram of an access authentication device according to an embodiment of the present disclosure.

[0133] like Figure 9 As shown, the access authentication device 700 of this embodiment includes an identity authentication module 710 , a first sending module 720 , an authority verification module 730 and an operation execution module 740 .

[0134] The identity authentication module 710 is used to authenticate the client to be connected in response to the client's connection request. In one embodiment, the identity authentication module 710 can be used to perform the operation S210 described above, which will not be repeated here.

[0135] The first sending module 720 is used to send metadata information and encryption key to the client to be connected after the identity authentication is passed. In one embodiment, the first sending module 720 can be used to perform the operation S220 described above, which will not be repeated here.

[0136] The permission verification module 730 is configured to respond to an operation request from the client and perform permission verification on the operation request based on the type of the operation request. The operation request includes encrypted serial number information, which is obtained by encrypting the serial number information using the encryption key. In one embodiment, the permission verification module 730 can be configured to perform operation S230 described above, which will not be further described here.

[0137] The operation execution module 740 is used to execute the operation request after the permission verification is passed. In one embodiment, the operation execution module 740 can be used to execute the operation S240 described above, which will not be repeated here.

[0138] According to an embodiment of the present disclosure, the identity authentication module 710 includes: an acquisition submodule and an identity authentication submodule.

[0139] The acquisition submodule is used to acquire the connection request information. In one embodiment, the acquisition submodule can be used to perform the operation S221 described above, which will not be described in detail here.

[0140] The identity authentication submodule is configured to authenticate the client to be connected according to the connection request information. In one embodiment, the identity authentication submodule may be configured to execute the operation S222 described above, which will not be described in detail here.

[0141] According to an embodiment of the present disclosure, the identity authentication submodule includes: a first determination unit and an identity authentication unit.

[0142] The first determining unit is configured to parse the connection request information to determine request header information, wherein the request header information includes application information. In one embodiment, the first determining unit may be configured to perform the operation S2221 described above, which will not be described in detail herein.

[0143] The identity authentication unit is configured to authenticate the client to be connected according to the application information and the application credential information. In one embodiment, the identity authentication unit may be configured to perform the operation S2222 described above, which will not be described in detail herein.

[0144] According to an embodiment of the present disclosure, the authority verification module 730 includes: a first parsing submodule, a second parsing submodule, and a authority verification submodule.

[0145] The first parsing submodule is configured to, when determining that the type of the operation request is a management and maintenance operation, parse the encrypted serial number information segment by segment to determine the encryption key. In one embodiment, the first parsing submodule may be configured to perform the operation S231 described above, which will not be described in detail here.

[0146] The second parsing submodule is configured to parse the encrypted serial number information according to the encryption key to determine the original serial number information. In one embodiment, the second parsing submodule may be configured to perform the operation S232 described above, which will not be described in detail here.

[0147] The permission verification submodule is used to perform permission verification based on the original sequence information and the client serial number information whitelist. In one embodiment, the permission verification submodule can be used to perform the operation S233 described above, which will not be repeated here.

[0148] According to an embodiment of the present disclosure, the system further includes: a determination module and a third sending module.

[0149] A determination module, configured to return a response with a permission exception to the client if it is determined that the permission verification fails;

[0150] The third sending module is used to record the client information and send abnormal alarm information to a preset message queue.

[0151] According to an embodiment of the present disclosure, any multiple modules among the identity authentication module 710, the first sending module 720, the permission verification module 730 and the operation execution module 740 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the identity authentication module 710, the first sending module 720, the permission verification module 730 and the operation execution module 740 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the identity authentication module 710 , the first sending module 720 , the authority verification module 730 and the operation execution module 740 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0152] Figure 10 Schematically shows a structural block diagram of another access authentication device according to an embodiment of the present disclosure. Figure 10 As shown, the access authentication device 800 of this embodiment includes an access request encapsulation module 810 , a receiving module 820 , an encryption module 830 , an operation request encapsulation module 840 and a second sending module 850 .

[0153] The access request encapsulation module 810 is used to encapsulate the client application information in the request information and send the access request to the server. In one embodiment, the access request encapsulation module 810 can be used to perform the operation S310 described above, which will not be repeated here.

[0154] The receiving module 820 is used to receive the metadata information and encryption key returned by the server. In one embodiment, the receiving module 820 can be used to perform the operation S320 described above, which will not be repeated here.

[0155] The encryption module 830 is used to encrypt the original serial information of the client according to the encryption key to generate encrypted serial number information. In one embodiment, the encryption module 830 can be used to perform the operation S330 described above, which will not be repeated here.

[0156] The operation request encapsulation module 840 is used to encapsulate and generate an operation request according to the business operation type and the encrypted sequence number information. In one embodiment, the operation request encapsulation module 840 can be used to perform the operation S340 described above, which will not be repeated here.

[0157] The second sending module 850 is used to send the operation request to the server according to the metadata information. In one embodiment, the second sending module 850 can be used to perform the operation S350 described above, which will not be repeated here.

[0158] According to an embodiment of the present disclosure, any multiple modules among the access request encapsulation module 810, the receiving module 820, the encryption module 830, the operation request encapsulation module 840, and the second sending module 850 can be combined into a single module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module. According to an embodiment of the present disclosure, at least one of the access request encapsulation module 810, the receiving module 820, the encryption module 830, the operation request encapsulation module 840, and the second sending module 850 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented in hardware or firmware by any other reasonable means of integrating or packaging circuits, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of these. Alternatively, at least one of the access request encapsulation module 810, the receiving module 820, the encryption module 830, the operation request encapsulation module 840 and the second sending module 850 can be at least partially implemented as a computer program module, which can perform corresponding functions when executed.

[0159] Figure 11 A block diagram of an electronic device suitable for implementing an access authentication method according to an embodiment of the present disclosure is schematically shown.

[0160] like Figure 11 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may, for example, include a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0161] Various programs and data required for the operation of the electronic device 900 are stored in the RAM 903. The processor 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. The processor 901 executes the various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs may also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 may also execute the various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0162] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card or a modem. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in the drive 910 as needed, so that a computer program read therefrom can be installed into the storage portion 908 as needed.

[0163] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the access authentication method according to the embodiments of the present disclosure.

[0164] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0165] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the access authentication method provided by the embodiments of the present disclosure.

[0166] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the processor 901 executes the computer program. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0167] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0168] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from a removable medium 911. When the computer program is executed by the processor 901, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0169] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0170] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0171] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0172] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An access authentication method, applied to a server, characterized in that: The method comprises: In response to the client's connection request, authenticate the client to be connected; After the identity verification is passed, metadata information and encryption key are sent to the client to be connected; In response to an operation request from a client, performing permission verification on the operation request according to the type of the operation request, the operation request including encrypted serial number information, the encrypted serial number information being obtained by being encrypted according to the encryption key; and After the permission verification is passed, the operation request is executed. The server also pre-registers a client serial number information whitelist, which stores permission operation information corresponding to different client serial numbers. The permission verification of the operation request according to the type of the operation request includes: When it is determined that the type of the operation request is a management and maintenance operation, the encrypted serial number information is segmented and parsed to determine an encryption key; parsing the encrypted serial number information according to the encryption key to determine the original serial number information; Permission verification is performed based on the original sequence information and the client serial number information whitelist.

2. The method according to claim 1, characterized in that The authentication of the client to be connected includes: Obtaining connection request information; and Authentication is performed on the client to be connected according to the connection request information.

3. The method according to claim 2, characterized in that The server pre-registers accessible application credential information, and the authentication of the client to be connected according to the connection request information includes: parsing the connection request information to determine request header information, the request header information including application information; and The client to be connected is verified according to the application information and the application credential information.

4. The method according to any one of claims 1 to 3, characterized in that Also includes: If it is determined that the permission verification fails, a response with a permission exception is returned to the client; Record the client information and send abnormal alarm information to the preset message queue.

5. An access authentication method, applied to a client communicating with a server according to any one of claims 1 to 4, characterized in that: The method comprises: Encapsulate the client application information in the request information and send the access request to the server; Receive metadata information and encryption keys returned by the server; Encrypting the original serial number information of the client according to the encryption key to generate encrypted serial number information; Generate an operation request based on the business operation type and the encrypted serial number information package; and The operation request is sent to the server according to the metadata information.

6. An access authentication device, applied to a server, characterized in that: The device comprises: An authentication module is used to authenticate the client in response to the client's connection request; A first sending module, configured to send metadata information and an encryption key to the client to be connected after the identity authentication is passed; an authority verification module, configured to respond to an operation request from a client and perform authority verification on the operation request according to the type of the operation request, wherein the operation request includes encrypted serial number information, and the encrypted serial number information is obtained by being encrypted according to the encryption key; and The operation execution module is used to execute the operation request after the permission verification is passed. The server also pre-registers a client serial number information whitelist, and the client serial number information whitelist stores the permission operation information corresponding to different client serial numbers. The permission verification module is also used to, when it is determined that the type of the operation request is a management and maintenance operation, segmentally parse the encrypted serial number information to determine the encryption key; parse the encrypted serial number information according to the encryption key to determine the original sequence information; and perform permission verification based on the original sequence information and the client serial number information whitelist.

7. An access authentication device, applied to a client communicating with a server according to any one of claims 1 to 4, characterized in that: The device comprises: Access request encapsulation module, used to encapsulate client application information in request information and send access request to the server; The receiving module is used to receive metadata information and encryption keys returned by the server; An encryption module, configured to encrypt the original serial information of the client according to the encryption key to generate encrypted serial number information; an operation request encapsulation module, configured to encapsulate and generate an operation request according to the business operation type and the encrypted sequence number information; and The second sending module is used to send the operation request to the server according to the metadata information.

8. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the access authentication method according to any one of claims 1 to 5.

9. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the access authentication method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the access authentication method according to any one of claims 1 to 5 is implemented.

Images