An authentication method and related apparatus

Abstract

This invention provides an authentication method and related apparatus to improve the reliability of authentication. The method includes: receiving an access request from a target user for a resource with access permissions, wherein the access request carries a target user identifier; invoking an authentication process in an authentication module based on the target user identifier, wherein the authentication process includes: generating a target user key based on the target user identifier; decrypting encrypted permission data of the target user based on the target user key and a decryption algorithm to obtain permission data and a permission list; determining the target user's access permissions to the permission data based on the target user identifier, permission data, and permission list, and decrypting encrypted token data of the target user based on the target user key to obtain an access token for the target user; and sending the access token to the target user, enabling the target user to access the resource with access permissions on the resource server using the access token.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a method for generating authentication and related apparatus. Background Technology

[0002] When a user requests restricted resources, such as images, music, videos, or live streams, the server hosting the resource needs to determine whether the user has permission to access it. Common methods for this determination are as follows:

[0003] like Figure 1 As shown: The resource server provides an authentication server. When the resource server receives a client's request to access a authorized resource, it checks with the authentication server to see if the user has permission. If the user has permission, the resource server returns the requested data to the client; otherwise, it returns a specific error message to the client.

[0004] However, the above authentication methods will have the following problems:

[0005] 1. Reliability issues: If the authentication server itself malfunctions, such as due to network failure, physical machine failure, virtual machine failure, or storage failure, the reliability of the authentication service will be affected, resulting in authentication failure and the user being unable to access the requested resources.

[0006] 2. Request pressure issue: For certain popular resources, if a large number of users access them at the same time, the authentication server will be under sudden pressure, which may cause the authentication service to become unavailable in severe cases. Summary of the Invention

[0007] This invention provides an authentication method and related apparatus to improve the reliability of authentication.

[0008] The first aspect of this application provides an authentication method, including:

[0009] Receive a target user's access request for authorized resources, wherein the access request carries the target user's identifier;

[0010] Based on the target user identifier, the authentication process in the authentication module is invoked. The authentication module stores a decryption algorithm, encrypted permission data for each authorized user, and encrypted token data for each authorized user. Each encrypted permission data and encrypted token data carries a corresponding user identifier. The authentication process includes:

[0011] Generate a target user key based on the target user identifier;

[0012] Based on the target user key and decryption algorithm, the encrypted permission data of the target user is decrypted to obtain the permission data and permission list;

[0013] Based on the target user identifier, the permission data, and the permission list, the target user's access permission to the permission data is determined, and the target user's token data ciphertext is decrypted based on the target user key to obtain the target user's access token;

[0014] The access token is sent to the target user, enabling the target user to use the access token to access authorized resources on the resource server.

[0015] Preferably, before receiving the target user's access request for the authorized resources, the method further includes:

[0016] The initialization operation is completed, which includes: sending an authentication module acquisition request to the resource server or CDN server; receiving the authentication module sent by the resource server or CDN server; and loading the authentication module locally.

[0017] Preferably, the client has a root key pre-stored;

[0018] The step of generating a target user key based on the target user identifier includes:

[0019] The target user key is generated based on the target user identifier and the root key.

[0020] Preferably, the authentication module also stores a random value corresponding to each authorized user;

[0021] The step of generating the target user key based on the target user identifier and the root key includes:

[0022] The target user key is generated based on the target user identifier, the root key, and the random value corresponding to the target user.

[0023] Preferably, the authentication module also stores the encrypted permission key of each authorized user, wherein the encrypted permission key of each authorized user carries a corresponding user identifier;

[0024] Based on the target user key and the decryption algorithm, the encrypted permission data of the target user is decrypted to obtain permission data and a permission list, including:

[0025] Based on the target user key and the decryption algorithm, the encrypted data of the target user's permission key is decrypted to obtain the target user's permission key;

[0026] Based on the target user's permission key and the decryption algorithm, the encrypted permission data of the target user is decrypted to obtain permission data and a permission list.

[0027] Preferably, the target user's token data ciphertext is decrypted based on the target user's key to obtain the target user's access token, including:

[0028] Based on the target user's permission key and the decryption algorithm, the target user's token data ciphertext is decrypted to obtain the target user's access token.

[0029] Preferably, the authentication module further stores the encrypted token key for each authorized user, wherein the encrypted token key carries the corresponding user identifier, and the method further includes:

[0030] Based on the target user's permission key and the decryption algorithm, the target user's token key ciphertext is decrypted to obtain the target user's token key.

[0031] Preferably, the step of decrypting the target user's token data ciphertext according to the target user's permission key and the decryption algorithm to obtain the target user's access token includes:

[0032] Based on the target user's token key and the decryption algorithm, the target user's token data ciphertext is decrypted to obtain the target user's access token.

[0033] A second aspect of this application provides an authentication device, including:

[0034] A receiving unit is used to receive an access request from a target user for a resource with access permissions, wherein the access request carries a target user identifier.

[0035] The invocation unit is used to invoke the authentication process in the authentication module based on the target user identifier. The authentication module stores a decryption algorithm, encrypted permission data for each authorized user, and encrypted token data for each authorized user. Each encrypted permission data and encrypted token data carries a corresponding user identifier. The authentication process includes:

[0036] Generate a target user key based on the target user identifier;

[0037] Based on the target user key and decryption algorithm, the encrypted permission data of the target user is decrypted to obtain the permission data and permission list;

[0038] Based on the target user identifier, the permission data, and the permission list, the target user's access permission to the permission data is determined, and the target user's token data ciphertext is decrypted based on the target user key to obtain the target user's access token;

[0039] The sending unit is used to send the access token to the target user, so that the target user can use the target user's access token to access the authorized resources in the resource server.

[0040] Specifically, the client also includes:

[0041] An initialization unit is configured to complete an initialization operation before receiving an access request from a target user for authorized resources. The initialization operation includes: sending an authentication module acquisition request to a resource server or CDN server; receiving the authentication module sent by the resource server or CDN server; and loading the authentication module locally.

[0042] Specifically, the client pre-stores the root key, and the authentication process includes:

[0043] The target user key is generated based on the target user identifier and the root key;

[0044] Based on the target user key and decryption algorithm, the encrypted permission data of the target user is decrypted to obtain the permission data and permission list;

[0045] Based on the target user identifier, the permission data, and the permission list, the target user's access permissions to the permission data are determined, and the target user's token data ciphertext is decrypted based on the target user key to obtain the target user's access token.

[0046] Specifically, the client also stores a random value for each authorized user, and the authentication process includes:

[0047] The target user key is generated based on the target user identifier, the root key, and the random value corresponding to the target user;

[0048] Based on the target user key and decryption algorithm, the encrypted permission data of the target user is decrypted to obtain the permission data and permission list;

[0049] Based on the target user identifier, the permission data, and the permission list, the target user's access permissions to the permission data are determined, and the target user's token data ciphertext is decrypted based on the target user key to obtain the target user's access token.

[0050] Specifically, the authentication module also stores the encrypted permission key for each authorized user, wherein each authorized user's encrypted permission key carries a corresponding user identifier, and the authentication process includes:

[0051] The target user key is generated based on the target user identifier, the root key, and the random value corresponding to the target user;

[0052] Based on the target user key and the decryption algorithm, the encrypted data of the target user's permission key is decrypted to obtain the target user's permission key;

[0053] Based on the target user's permission key and the decryption algorithm, the encrypted permission data of the target user is decrypted to obtain permission data and permission list;

[0054] Based on the target user identifier, the permission data, and the permission list, the target user's access permissions to the permission data are determined, and the target user's token data ciphertext is decrypted based on the target user's permission key to obtain the target user's access token.

[0055] Specifically, the authentication module also stores the encrypted token key for each authorized user. Each authorized user's encrypted key carries a corresponding user identifier. The authentication process includes:

[0056] The target user key is generated based on the target user identifier, the root key, and the random value corresponding to the target user;

[0057] Based on the target user key and the decryption algorithm, the encrypted data of the target user's permission key is decrypted to obtain the target user's permission key;

[0058] Based on the target user's permission key and the decryption algorithm, the encrypted permission data of the target user is decrypted to obtain permission data and permission list;

[0059] Based on the target user identifier, the permission data, and the permission list, determine the target user's access permissions to the permission data;

[0060] Based on the target user's permission key and the decryption algorithm, the target user's token key ciphertext is decrypted to obtain the target user's token key. Then, based on the target user's token key, the target user's token data ciphertext is decrypted to obtain the target user's access token.

[0061] A third aspect of this application provides a computer device including a processor, which, when executing a computer program stored in a memory, implements the authentication method provided in the first aspect of this application.

[0062] A fourth aspect of this application provides a computer storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is used to implement the authentication method provided in the first aspect of this application.

[0063] As can be seen from the above technical solutions, the embodiments of the present invention have the following advantages:

[0064] In this embodiment, a client receives an access request from a target user for a resource with access permissions. The access request carries a target user identifier. Based on the target user identifier, an authentication process is invoked in the authentication module. This authentication module stores a decryption algorithm, encrypted permission data for each user, and encrypted token data for each user. Each encrypted permission data and each encrypted token data carries a corresponding user identifier. The authentication process includes: generating a target user key based on the target user identifier; decrypting the encrypted permission data of the target user using the target user key and the decryption algorithm to obtain permission data and a permission list; determining the target user's access permissions to the permission data based on the target user identifier, the permission data, and the permission list; decrypting the encrypted token data of the target user using the target user key to obtain the target user's access token; and sending the access token to the target user, enabling the target user to access the resource with access permissions on the resource server.

[0065] Compared with the prior art, the embodiments of this application do not require setting up an authentication server on the resource server side, thereby saving the cost of the authentication server. On the other hand, the embodiments of this application set the authentication process on the client side, so that each client only authenticates the access requests of the target users associated with it (such as bound to it), thereby greatly alleviating the authentication pressure and improving the efficiency and reliability of authentication. Attached Figure Description

[0066] Figure 1 This is a schematic diagram of the authentication process in existing technology;

[0067] Figure 2 This is a schematic diagram of one embodiment of the authentication method in this application;

[0068] Figure 3 This is a schematic diagram of another embodiment of the authentication method in this application;

[0069] Figure 4 This is a schematic diagram of one embodiment of the authentication generation module in this application;

[0070] Figure 5 This is a schematic diagram of another embodiment of the authentication generation module in this application;

[0071] Figure 6 This is a schematic diagram of one embodiment of the authentication device in this application. Detailed Implementation

[0072] This invention provides an authentication method and related apparatus to improve the reliability of authentication.

[0073] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0074] The terms "first," "second," "third," "fourth," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0075] For ease of understanding, the implementation scenarios of the embodiments of this application are described below:

[0076] Unlike existing technologies, which require an authentication server on the resource server side to authenticate the client's access permissions, resulting in high pressure on the authentication server side and poor authentication reliability, this application provides an authentication method applied to the client side. That is, the authentication method in this application embodiment is executed by the client, so that the user can complete the authentication process on their local client. Compared with the existing technology, this reduces the service pressure on the authentication side and improves the reliability of the authentication process.

[0077] The authentication method in the embodiments of this application is described below. This authentication method is applied to the client side. Please refer to [link / reference needed]. Figure 2 One embodiment of the authentication method in this application includes:

[0078] 201. Receive an access request from a target user for a resource with access permissions, wherein the access request carries a target user identifier;

[0079] It's easy to understand that resource servers typically store various resources, such as QQ Music, QQ Games, and resource documents. In order to enable authorized users to access authorized resources, authorized users are generally required to authenticate their own permissions before accessing the resources, and only after the authentication is successful will they be allowed to access the corresponding authorized resources.

[0080] Specifically, in this embodiment, the client authenticates the target user's access permissions. The client receives the target user's access request for the authorized resources, and the access request carries the target user's identifier. The target user identifier can be the target user's ID card, phone number, or email address, or it can be a string generated after special processing (such as hash operation) of the target user's ID card, phone number, or email address. There are no specific restrictions on the target user identifier here. The client can be a mobile phone, computer, tablet, or wearable device, etc. There are no specific restrictions on the form of the client here.

[0081] The following uses a mobile phone as the client to illustrate this application scenario: If user A clicks to play song A on their mobile phone, the request to play song A can be regarded as an access request for song A. When generating user A's access request for song A, the access request can carry user A's identifier, such as user A's phone number.

[0082] 202. Based on the target user identifier, invoke the authentication process in the authentication module. The authentication module stores a decryption algorithm, encrypted permission data for each authorized user, and encrypted token data for each authorized user. Each encrypted permission data and each encrypted token data carries a corresponding user identifier. The authentication process includes: generating a target user key based on the target user identifier; decrypting the encrypted permission data of the target user based on the target user key and the decryption algorithm to obtain permission data and a permission list; determining the target user's access permissions to the permission data based on the target user identifier, the permission data, and the permission list; and decrypting the encrypted token data of the target user based on the target user key to obtain the target user's access token.

[0083] After receiving the access request from the target user, the client invokes the authentication process in the authentication module based on the target user's identifier. This authentication module stores the decryption algorithm, the encrypted permission data of each authorized user, and the encrypted token data of each authorized user. Each encrypted permission data and each encrypted token data of each authorized user carries the corresponding user identifier.

[0084] If the client receives a request from user A to access song A, it will invoke the authentication process in the authentication module based on the target user identifier, such as user A's phone number. It is easy to understand that the authentication module itself is used to execute the authentication process, so the authentication process (i.e., authentication method, authentication instruction) in the authentication module is pre-stored.

[0085] The authentication process in the authentication module is described below:

[0086] Generate a target user key based on the target user identifier. Specifically, this process can involve generating a target user key using any encryption algorithm based on the user identifier. This encryption algorithm can be a hash algorithm, bcrypt algorithm, etc., and there are no specific restrictions on the type of encryption algorithm.

[0087] After obtaining the user's key, the encrypted permission data of the target user is decrypted according to the target user's key and decryption algorithm to obtain permission data and a permission list. The permission list records which users have access to the requested resources, while the permission data records which resources each user has access to. Specifically, in this embodiment, the permission data and permission list can also be combined into a permission file, as long as it can be determined whether the target user has access to the requested data.

[0088] After obtaining the permission data and permission list, the target user's access permissions to the permission data are determined based on the user identifier, permission data, and permission list. The result of this determination process may be that the target user does not have access permissions to the permission resource, in which case authentication fails; or the target user has access permissions to the permission resource, in which case this embodiment further decrypts the target user's token data ciphertext based on the target user's key to obtain the target user's access token.

[0089] Specifically, an access token is a credential used to access protected resources. An access token represents an authorization string issued to a client, which is opaque to the client. The token represents a specific scope and duration of access, authorized by the resource owner and enforced by the resource server.

[0090] For ease of understanding, Table 1 provides a description of the access token format:

[0091] Table 1

[0092]

[0093] 203. Send the access token to the target user, so that the target user can use the target user's access token to access the authorized resources in the resource server.

[0094] After obtaining the access token of the target user (i.e., the client corresponding to the target user), the access token is sent to the target user, enabling the target user to use the access token to access the authorized resources of the resource server.

[0095] Compared with the prior art, the embodiments of this application do not require setting up an authentication server on the resource server side, thereby saving the cost of the authentication server. On the other hand, the embodiments of this application set the authentication process on the client side, so that each client only authenticates the access requests of the target users associated with it (such as bound to it), thereby greatly alleviating the authentication pressure and improving the efficiency and reliability of authentication.

[0096] The following describes the client's initialization operations before receiving access requests from target users. It should be noted that each client's initialization operation only needs to be performed once before receiving access requests from target users for authorized resources, rather than being performed every time.

[0097] The initialization process includes: the client sending an authentication request module acquisition request to the resource server or CDN server, receiving the authentication module sent by the resource server or CDN server, and loading the authentication module locally.

[0098] Specifically, this application scenario could be that during the registration process on the resource server side, an authorized user (i.e., the authorized user's client) needs to send a request to the resource server to obtain the authentication module. Then, the resource server sends the authentication module to the client, and the client completes the installation of the authentication module locally (i.e., the loading process of the authentication module).

[0099] Furthermore, to avoid the problem that each authorized user (i.e., the authorized user's client) needs to send an authentication module retrieval request to the resource server during the registration process on the resource server side, thus causing a large load on the authentication module, this embodiment of the application can also store the authentication module on the CDN server. This allows each target user's client to send an authentication module retrieval request to the CDN server, then receive the authentication module sent by the CDN server, and complete the installation of the authentication module locally (i.e., the loading process of the authentication module).

[0100] Because a CDN, as a content delivery network, allows each authorized user's client to obtain network resources from the nearest edge server, thereby improving the convenience of obtaining network resources. Therefore, the authentication module in this embodiment can be stored on the resource server side or in the CDN, but it is preferred to store the authentication module in the CDN.

[0101] To further enhance the security of the target user key, embodiments of this application may also generate the target user key in the following manner:

[0102] exist Figure 2 In the described embodiment, the target user key is generated based on the target user identifier and the encryption algorithm. To further enhance the security of the target user key, this embodiment may also pre-store a root key in the authentication module, and then generate the target user key based on the root key, the target user identifier, and the encryption algorithm. Furthermore, the authentication module may pre-store a root key and a random value corresponding to each authorized user, wherein the random value may be generated using the rand, srand, and time functions, and then generate the target user key based on the root key, the target user identifier, the random value corresponding to the target user, and the encryption algorithm. Here, no specific limitation is made on the algorithm for generating the random value.

[0103] To further enhance the security of permission data and permission lists, this application embodiment may also pre-store the ciphertext of the permission key for each permission user in the authentication module, and the ciphertext of the permission key for each permission user carries the corresponding user identifier.

[0104] The authentication process is optimized as follows: A target user key is generated based on the root key, the target user identifier, a random value corresponding to the target user, and an encryption algorithm; the target user's permission key ciphertext is decrypted using the target user key and a decryption algorithm to obtain the target user's permission key; the target user's permission data ciphertext is decrypted using the target user's permission key and a decryption algorithm to obtain the target user's permission data and permission list; the target user's access permissions to the permission data are determined based on the target user identifier, the permission data, and the permission list; and the target user's token data ciphertext is decrypted using the target user's permission key and a decryption algorithm to obtain the target user's access token.

[0105] Different from Figure 2 In the authentication process described in this embodiment, the root key, target user identifier, random value corresponding to the target user, and encryption algorithm are used to generate the target user key, which improves the security of the target user key. At the same time, the target user key and decryption algorithm are used to first obtain the permission key, and then the permission key and decryption algorithm are used to decrypt the permission data ciphertext and token data ciphertext, thereby further improving the security of the permission data ciphertext and token data ciphertext, that is, further improving the security of the authentication process.

[0106] To further enhance the security of access tokens, this application embodiment can further optimize the authentication process based on the above embodiments. In this application embodiment, the authentication module also stores the encrypted token data of each authorized user.

[0107] The authentication process is optimized as follows: A target user key is generated based on the root key, target user identifier, a random value corresponding to the target user, and an encryption algorithm; the target user's permission key ciphertext is decrypted using the target user key and decryption algorithm to obtain the target user's permission key; the target user's permission data ciphertext is decrypted using the target user's permission key and decryption algorithm to obtain the target user's permission data and permission list; the target user's access permissions to the permission data are determined based on the target user identifier, the permission data, and the permission list, and the target user's token key ciphertext is decrypted using the target user's permission key and decryption algorithm to obtain the target user's token key; the target user's token data ciphertext is decrypted using the target user's token key and decryption algorithm to obtain the target user's access token.

[0108] Unlike the above embodiments, this application embodiment uses the target user's permission key and decryption algorithm to decrypt the target user's token key ciphertext to obtain the target user's token key. Furthermore, based on the token key and decryption algorithm, the target user's token data ciphertext is decrypted to obtain the target user's access token, thereby further improving the security of the token data ciphertext, which in turn further enhances the security of the authentication process.

[0109] For ease of understanding, another embodiment of the authentication method in this application is described below. Please refer to [link to relevant documentation]. Figure 3 :

[0110] 301. Receive an access request from a target user for a resource with access permissions, wherein the access request carries a target user identifier;

[0111] 302. Based on the target user identifier, invoke the authentication process in the authentication module, wherein the authentication module stores a decryption algorithm, a root key, a random value corresponding to each authorized user, encrypted authorization data and encrypted authorization key for each authorized user, encrypted token data and encrypted token key for each authorized user, each authorized user's encrypted authorization data and encrypted token key carrying a user identifier, and each authorized user's encrypted token data and encrypted token key carrying a corresponding user identifier; the authentication process includes: generating a target user key based on the root key, target user identifier, random value corresponding to the target user, and encryption algorithm; and... The decryption algorithm decrypts the target user's ciphertext permission key to obtain the target user's permission key; based on the target user's permission key and the decryption algorithm, it decrypts the target user's ciphertext permission data to obtain the target user's permission data and permission list; based on the target user identifier, the permission data, and the permission list, it determines the target user's access permissions to the permission data; based on the target user's permission key and the decryption algorithm, it decrypts the target user's ciphertext token key to obtain the target user's token key; based on the target user's token key and the decryption algorithm, it decrypts the target user's ciphertext token data to obtain the target user's access token.

[0112] 303. Send the access token to the target user, so that the target user can use the target user's access token to access the authorized resources in the resource server.

[0113] It should be noted that the descriptions of steps 301 and 303 in the embodiments of this application are consistent with... Figure 2 The descriptions of steps 201 and 203 are similar, and the description of step 302 is similar to the description of the optimized authentication process in the above embodiments, so it will not be repeated here.

[0114] In this embodiment, a root key, a target user identifier, a random value corresponding to the target user, and an encryption algorithm are used to generate a target user key, thereby improving the security of the target user key. The target user key and a decryption algorithm are used to first obtain an access key, and then the access key and decryption algorithm are used to decrypt the access data ciphertext to obtain the access data and access list, further improving the security of the access data and access list. Finally, the access key and decryption algorithm are used to decrypt the token key ciphertext to obtain the token key, and the token key is used to decrypt the token data ciphertext to obtain the target user's access token, thereby further improving the security of the token data ciphertext, and thus further improving the security of the entire authentication process.

[0115] For ease of understanding, the process of generating the authentication module is further described below. Please refer to [link / reference]. Figure 4The authentication module in this application embodiment is generated by the resource server. One embodiment of generating the authentication module in this application embodiment includes:

[0116] 401. Obtain the user ID of the authorized user;

[0117] Specifically, the resource server in this application may obtain the user identifier of the authorized user during the authorized user registration process. The user identifier may be the user's ID card, phone number, email address, or a unique string generated based on the user's ID card, phone number, or email address. There are no restrictions on the specific form of the user identifier.

[0118] 402. Generate the corresponding user key for each authorized user based on the user identifier of each authorized user;

[0119] After the resource server obtains the user identifier of each authorized user, it generates a user key for each authorized user based on the user identifier and the encryption algorithm.

[0120] Specifically, the encryption algorithm here can be a hash algorithm or a bcrypt algorithm, etc., and there is no restriction on the specific form of the encryption algorithm.

[0121] 403. Based on the user key and encryption algorithm of each authorized user, encrypt the permission list and permission data of each authorized user to obtain the ciphertext of the permission data of each authorized user, wherein the ciphertext of the permission data of each authorized user carries the corresponding user identifier;

[0122] After obtaining the user key of the authorized user, this embodiment of the application uses the user key and encryption algorithm to encrypt the permission category and permission data of each authorized user to obtain the ciphertext of the permission data of each authorized user, wherein the ciphertext of the permission data of each authorized user carries the corresponding user identifier.

[0123] The encryption algorithm here can also be a hash algorithm or a bcrypt algorithm, and there are no restrictions on the specific form of the encryption algorithm.

[0124] 404. Based on the user key and encryption algorithm of each authorized user, decrypt the access token of each authorized user to obtain the token data ciphertext of each authorized user, wherein the token data ciphertext of each authorized user carries the corresponding user identifier;

[0125] Furthermore, when authorized users access resource servers, they generally access authorized resources through access tokens. Therefore, in this embodiment of the application, each authorized user's user key and encryption algorithm are used to encrypt each authorized user's access token to obtain the token data ciphertext of each authorized user. The token data ciphertext of each authorized user also carries the corresponding user identifier.

[0126] The description of the access token is as follows: Figure 2 The embodiments are consistent with those described, and will not be repeated here.

[0127] 405. Generate an authentication module based on the encrypted permission data of each authorized user and the encrypted token data of each authorized user among multiple authorized users, wherein the authentication module includes a decryption algorithm, the encrypted permission data of each authorized user, and the encrypted token data of each authorized user;

[0128] After obtaining the encrypted permission data and token data of each authorized user, this embodiment of the application generates an authentication module based on the encrypted permission data and token data of each authorized user among multiple authorized users. The authentication module includes a decryption algorithm, the encrypted permission data of each authorized user, and the encrypted token data of each authorized user.

[0129] 406. Send the authentication module to the client or CDN server.

[0130] After generating the authentication module, the resource server sends the authentication module to the client or CDN server.

[0131] Specifically, the resource server can send the authentication module to the client during the registration process of an authorized user through the client. Alternatively, the resource server can send the authentication module to the CDN server after the authorized user completes the registration process through the client. This allows the client to obtain the authentication module from the CDN server, thereby reducing the pressure on the resource server and improving the ease with which the client can obtain the authentication module.

[0132] This application embodiment describes in detail the process of the resource server generating the authentication module. In this application embodiment, the resource server sends the generated authentication module to the client or CDN server, so that the access request of the target user can be authenticated through the authentication module in the client or the client obtains the authentication module from the CDN server, thereby reducing the pressure on the resource server and improving the reliability and convenience of the authentication process.

[0133] based on Figure 4In order to improve the security of the authentication process in the authentication module, the embodiments of this application may also use the following methods to generate the authentication module. Please refer to [link to relevant documentation]. Figure 5 Another embodiment of the authentication module generation in this application includes:

[0134] 501. Obtain the user identifier of the authorized user;

[0135] Specifically, the resource server in this application may obtain the user identifier of the authorized user during the authorized user registration process. The user identifier may be the user's ID card, phone number, email address, or a unique string generated based on the user's ID card, phone number, or email address. There are no restrictions on the specific form of the user identifier.

[0136] 502. Generate a corresponding random value for the user identifier of each authorized user;

[0137] Specifically, the random value here can be generated using any of the rand, srand, or time functions, and there are no specific restrictions on the algorithm used to generate the random value.

[0138] 503. Generate a user key for each authorized user based on the root key, each user identifier, and the random value of the corresponding user identifier;

[0139] Here, the root key is pre-built into the resource server. After obtaining the user identifier and random value of each authorized user, the user key of each authorized user is further generated based on the root key, each user identifier and the corresponding random value of the user identifier.

[0140] Different from Figure 4 In the described embodiment, a root key, each user identifier, and a random value of the corresponding user identifier are used to generate a user key for each authorized user, thereby improving the security of the user key.

[0141] 504. Based on the user key and encryption algorithm of each authorized user, encrypt the authorization key of each authorized user to obtain the authorization key ciphertext of each authorized user, wherein the authorization key ciphertext of each authorized user carries the corresponding user identifier;

[0142] To ensure the security of user access keys, this application embodiment uses a user key and an encryption algorithm to encrypt the access keys of authorized users, thereby obtaining the ciphertext of the access keys for each authorized user, thus improving the security of user access keys.

[0143] Specifically, the permission key for each authorized user is the permission key generated during the registration process with the resource server. Therefore, the resource server can obtain the permission key for each authorized user.

[0144] 505. Based on the permission key and encryption algorithm of each authorized user, encrypt the permission list and permission data of each authorized user to obtain the ciphertext of the permission data of each authorized user, wherein the ciphertext of the permission data of each authorized user carries the corresponding user identifier;

[0145] To enhance the security of each user's permission list and permission data, this application embodiment uses each user's permission key and encryption algorithm to encrypt each user's permission list and permission data, thereby obtaining ciphertext of each user's permission data, wherein each user's ciphertext of permission data carries a corresponding user identifier.

[0146] 506. Based on the permission key and encryption algorithm of each authorized user, encrypt the token key of each authorized user to obtain the token key ciphertext of each authorized user, wherein the token key ciphertext of each authorized user carries the corresponding user identifier;

[0147] To further enhance the security of the token key, this application embodiment can also use the permission key and encryption algorithm of each authorized user to encrypt the token key of each authorized user to obtain the token key ciphertext of each authorized user, wherein the token key ciphertext of each authorized user carries the corresponding user identifier.

[0148] 507. Based on the token key and encryption algorithm of each authorized user, encrypt the access token of each authorized user to obtain the ciphertext of the token data of each authorized user;

[0149] Furthermore, in order to enhance the security of each authorized user's access token, this application embodiment also utilizes each authorized user's token key and encryption algorithm to encrypt each authorized user's access token, thereby obtaining the token data ciphertext for each authorized user.

[0150] In the authentication module of this application embodiment, personalized permission key ciphertext, permission data ciphertext, token key ciphertext, and token data ciphertext can be generated for each authorized user, thereby achieving personalized key settings for each authorized user while ensuring the security of the authentication process.

[0151] 508. Generate an authentication module based on the ciphertext of the permission key and the ciphertext of the permission data, the ciphertext of the token key and the ciphertext of the token data for each of the multiple authorized users, and the random value corresponding to each authorized user. The authentication module stores the random value, decryption algorithm, ciphertext of the permission key and the ciphertext of the permission data for each authorized user, and ciphertext of the token key and the ciphertext of the token data for each authorized user.

[0152] After the resource server obtains the encrypted permission key, encrypted permission data, encrypted token key, and encrypted token data for each authorized user, it further generates an authentication module based on the encrypted permission key, encrypted permission data, encrypted token key, encrypted token data, and the random value corresponding to each authorized user.

[0153] 509. Send the authentication module to the client or CDN server.

[0154] After the resource server generates the authentication module, it will send the authentication module to the client or CDN server.

[0155] In this embodiment, a root key, a target user identifier, a random value corresponding to the target user, and an encryption algorithm are used to generate a target user key, which improves the security of the target user key in the authentication module. The target user key and the encryption algorithm are used to encrypt the permission key to obtain the permission key ciphertext. The permission key and the encryption algorithm are then used to encrypt the permission data to obtain the permission data ciphertext, which also improves the security of the permission data and permission list. Finally, the permission key and the encryption algorithm are used to encrypt the token key to obtain the token key ciphertext. The token key and the encryption algorithm are then used to encrypt the access token to obtain the token data ciphertext, thereby further improving the security of the permission data ciphertext and the token data ciphertext, which in turn further improves the security of the entire authentication process.

[0156] To facilitate understanding, the application scenarios in the embodiments of this application are described below: Taking any authorized user as an example, suppose the authorized user is user W. User W enjoys authorized resources on the resource server. It is easy to understand that when user W enjoys authorized services on the resource server, registration is generally required on the resource server. During this registration process, the user usually carries a user identifier. The resource server generates a random value for user W using the rand function. Then, the resource server generates a user key for user W based on user W's user identifier, root key (pre-stored in the resource server), and the corresponding random value for user W. The resource server further uses user W's user key... The system encrypts user W's permission key (set during registration) to obtain the ciphertext of user W's permission key. Then, based on the permission key and an encryption algorithm (such as bcrypt), it encrypts user W's permission list (which records which users have permissions to resources on the resource server) and permission data (permission data for each user) to obtain the ciphertext of user W's permission data. Furthermore, the resource server uses user W's permission key to encrypt user W's token key (also generated during registration) to obtain the ciphertext of user W's token key. Finally, it uses the token key to encrypt the access token, thus obtaining the ciphertext of the token data.

[0157] At this point, the resource server has generated encrypted permission key, encrypted permission data, encrypted token key, and encrypted token data for user W. Then, based on the random value, encrypted permission key, encrypted permission data, encrypted token key, and encrypted token data for each user among all authorized users, the resource server generates an authentication module. This authentication module stores the decryption algorithm, the random value for each authorized user, and the encrypted permission key, encrypted permission data, encrypted token key, and encrypted token data for each user. Furthermore, each user's encrypted permission key, encrypted permission data, encrypted token key, and encrypted token data carries a user identifier.

[0158] The resource server can generate the authentication module and then send it to the client or the CDN server during the registration process of the W user through the client.

[0159] During the user registration process, the client can complete the client initialization operation, which includes obtaining the authentication module (which can be done by the client requesting the authentication module from the resource server or from the CDN server) and loading the authentication module locally.

[0160] When the client receives an access request from user W for a resource with access permissions (e.g., user W clicks a play command on a QQ Music song on the client), the client invokes the authentication process in the authentication module based on user W's user identifier. The authentication process in the authentication module is used to authenticate user W's access permissions to the QQ Music song. If authentication is successful, an access token is sent to the client, allowing the client to access the QQ Music song using the access token. If authentication fails, a message indicating that playback is not possible is displayed.

[0161] Because the embodiments of this application can distribute authentication permissions to the client, the client can authenticate the access permissions of each authorized user, thereby alleviating the access pressure on the resource server and improving the convenience and reliability of authenticating each authorized user compared to the prior art.

[0162] The authentication method in the embodiments of this application has been described above. The client in the embodiments of this application will be described below. Please refer to [link / reference]. Figure 6 One embodiment of the client in this application includes:

[0163] The receiving unit 601 is used to receive an access request from a target user for a permissioned resource, wherein the access request carries a target user identifier.

[0164] Calling unit 602 is used to invoke the authentication process in the authentication module according to the target user identifier. The authentication module stores a decryption algorithm, encrypted permission data for each authorized user, and encrypted token data for each authorized user. Each encrypted permission data and encrypted token data carries a corresponding user identifier. The authentication process includes:

[0165] Generate a target user key based on the target user identifier;

[0166] Based on the target user key and decryption algorithm, the encrypted permission data of the target user is decrypted to obtain the permission data and permission list;

[0167] Based on the target user identifier, the permission data, and the permission list, the target user's access permission to the permission data is determined, and the target user's token data ciphertext is decrypted based on the target user key to obtain the target user's access token;

[0168] The sending unit 603 is used to send the access token to the target user, so that the target user can use the target user's access token to access the authorized resources in the resource server.

[0169] Specifically, the client also includes:

[0170] The initialization unit 604 is used to complete an initialization operation before receiving the target user's access request for the authorized resources. The initialization operation includes: sending an authentication module acquisition request to the resource server or CDN server; receiving the authentication module sent by the resource server or the CDN server; and loading the authentication module locally.

[0171] Specifically, the client pre-stores the root key, and the authentication process includes:

[0172] The target user key is generated based on the target user identifier and the root key;

[0173] Based on the target user key and decryption algorithm, the encrypted permission data of the target user is decrypted to obtain the permission data and permission list;

[0174] Based on the target user identifier, the permission data, and the permission list, the target user's access permissions to the permission data are determined, and the target user's token data ciphertext is decrypted based on the target user key to obtain the target user's access token.

[0175] Specifically, the client also stores a random value for each authorized user, and the authentication process includes:

[0176] The target user key is generated based on the target user identifier, the root key, and the random value corresponding to the target user;

[0177] Based on the target user key and decryption algorithm, the encrypted permission data of the target user is decrypted to obtain the permission data and permission list;

[0178] Based on the target user identifier, the permission data, and the permission list, the target user's access permissions to the permission data are determined, and the target user's token data ciphertext is decrypted based on the target user key to obtain the target user's access token.

[0179] Specifically, the authentication module also stores the encrypted permission key for each authorized user, wherein each authorized user's encrypted permission key carries a corresponding user identifier, and the authentication process includes:

[0180] The target user key is generated based on the target user identifier, the root key, and the random value corresponding to the target user;

[0181] Based on the target user key and the decryption algorithm, the encrypted data of the target user's permission key is decrypted to obtain the target user's permission key;

[0182] Based on the target user's permission key and the decryption algorithm, the encrypted permission data of the target user is decrypted to obtain permission data and permission list;

[0183] Based on the target user identifier, the permission data, and the permission list, the target user's access permissions to the permission data are determined, and the target user's token data ciphertext is decrypted based on the target user's permission key to obtain the target user's access token.

[0184] Specifically, the authentication module also stores the encrypted token key for each authorized user. Each authorized user's encrypted key carries a corresponding user identifier. The authentication process includes:

[0185] The target user key is generated based on the target user identifier, the root key, and the random value corresponding to the target user;

[0186] Based on the target user key and the decryption algorithm, the encrypted data of the target user's permission key is decrypted to obtain the target user's permission key;

[0187] Based on the target user's permission key and the decryption algorithm, the encrypted permission data of the target user is decrypted to obtain permission data and permission list;

[0188] Based on the target user identifier, the permission data, and the permission list, determine the target user's access permissions to the permission data;

[0189] Based on the target user's permission key and the decryption algorithm, the target user's token key ciphertext is decrypted to obtain the target user's token key. Then, based on the target user's token key, the target user's token data ciphertext is decrypted to obtain the target user's access token.

[0190] Specifically, the functions of each unit in the embodiments of this application are as follows: Figures 2 to 3 The examples described are similar and will not be repeated here.

[0191] In this embodiment, compared with the prior art, there is no need to set up an authentication server on the resource server side, thereby saving the cost of the authentication server. On the other hand, this embodiment calls the authentication process in the authentication module through the calling unit 602. The authentication process is set on the client side, so that each client only authenticates the access requests of the target user associated with itself (such as the bound user), thereby greatly alleviating the authentication pressure and improving the efficiency and reliability of authentication.

[0192] The client in this embodiment of the invention has been described above from the perspective of modular functional entities. The computer device in this embodiment of the invention will now be described from the perspective of hardware processing.

[0193] This computer device is used to implement client functions. One embodiment of the computer device in this invention includes:

[0194] Processor and memory;

[0195] When a memory is used to store computer programs, and a processor executes the computer programs stored in the memory, the following steps can be achieved:

[0196] Receive a target user's access request for authorized resources, wherein the access request carries the target user's identifier;

[0197] Based on the target user identifier, the authentication process in the authentication module is invoked. The authentication module stores a decryption algorithm, encrypted permission data for each authorized user, and encrypted token data for each authorized user. Each encrypted permission data and encrypted token data carries a corresponding user identifier. The authentication process includes:

[0198] Generate a target user key based on the target user identifier;

[0199] Based on the target user key and decryption algorithm, the encrypted permission data of the target user is decrypted to obtain the permission data and permission list;

[0200] Based on the target user identifier, the permission data, and the permission list, the target user's access permission to the permission data is determined, and the target user's token data ciphertext is decrypted based on the target user key to obtain the target user's access token;

[0201] The access token is sent to the target user, enabling the target user to use the access token to access authorized resources on the resource server.

[0202] In some embodiments of the present invention, before receiving the target user's access request for the authorized resources, the processor may further perform the following steps:

[0203] The initialization operation is completed, which includes: sending an authentication module acquisition request to the resource server or CDN server; receiving the authentication module sent by the resource server or CDN server; and loading the authentication module locally.

[0204] In some embodiments of the present invention, the client pre-stores a root key, and the processor can also be used to implement the following steps:

[0205] The target user key is generated based on the target user identifier and the root key.

[0206] In some embodiments of the present invention, the authentication module further stores a random value corresponding to each authorized user, and the processor can also be used to implement the following steps:

[0207] The target user key is generated based on the target user identifier, the root key, and the random value corresponding to the target user.

[0208] In some embodiments of the present invention, the authentication module further stores the encrypted permission key of each authorized user, wherein the encrypted permission key of each authorized user carries a corresponding user identifier; the processor can also be used to implement the following steps:

[0209] Based on the target user key and the decryption algorithm, the encrypted data of the target user's permission key is decrypted to obtain the target user's permission key;

[0210] Based on the target user's permission key and the decryption algorithm, the encrypted permission data of the target user is decrypted to obtain permission data and a permission list.

[0211] In some embodiments of the present invention, the processor may also be used to implement the following steps:

[0212] Based on the target user's permission key and the decryption algorithm, the target user's token data ciphertext is decrypted to obtain the target user's access token.

[0213] In some embodiments of the present invention, the processor may also be used to implement the following steps:

[0214] Based on the target user's permission key and the decryption algorithm, the target user's token key ciphertext is decrypted to obtain the target user's token key.

[0215] In some embodiments of the present invention, the processor may also be used to implement the following steps:

[0216] Based on the target user's token key and the decryption algorithm, the target user's token data ciphertext is decrypted to obtain the target user's access token.

[0217] It is understood that when the processor in the computer device described above executes the computer program, it can also implement the functions of each unit in the corresponding device embodiments described above, which will not be repeated here. For example, the computer program can be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the client. For example, the computer program can be divided into units in the client described above, and each unit can implement the specific functions described in the corresponding client above.

[0218] The computer device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the processor and memory are merely examples of a computer device and do not constitute a limitation on the computer device. It may include more or fewer components, or a combination of certain components, or different components. For example, the computer device may also include input / output devices, network access devices, buses, etc.

[0219] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the computer device, connecting various parts of the computer device via various interfaces and lines.

[0220] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function, etc.; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0221] The present invention also provides a computer-readable storage medium for implementing client functionality, wherein a computer program is stored thereon, and when the computer program is executed by a processor, the processor can perform the following steps:

[0222] Receive a target user's access request for authorized resources, wherein the access request carries the target user's identifier;

[0223] Based on the target user identifier, the authentication process in the authentication module is invoked. The authentication module stores a decryption algorithm, encrypted permission data for each authorized user, and encrypted token data for each authorized user. Each encrypted permission data and encrypted token data carries a corresponding user identifier. The authentication process includes:

[0224] Generate a target user key based on the target user identifier;

[0225] Based on the target user key and decryption algorithm, the encrypted permission data of the target user is decrypted to obtain the permission data and permission list;

[0226] Based on the target user identifier, the permission data, and the permission list, the target user's access permission to the permission data is determined, and the target user's token data ciphertext is decrypted based on the target user key to obtain the target user's access token;

[0227] The access token is sent to the target user, enabling the target user to use the access token to access authorized resources on the resource server.

[0228] In some embodiments of the present invention, before receiving the target user's access request for the authorized resources, the processor may further perform the following steps:

[0229] The initialization operation is completed, which includes: sending an authentication module acquisition request to the resource server or CDN server; receiving the authentication module sent by the resource server or CDN server; and loading the authentication module locally.

[0230] In some embodiments of the present invention, the client has a root key pre-stored in it. When the computer program stored in the computer-readable storage medium is executed by the processor, the processor can also be used to implement the following steps:

[0231] The target user key is generated based on the target user identifier and the root key.

[0232] In some embodiments of the present invention, the authentication module further stores a random value corresponding to each authorized user. When the computer program stored in the computer-readable storage medium is executed by the processor, the processor can also be used to implement the following steps:

[0233] The target user key is generated based on the target user identifier, the root key, and the random value corresponding to the target user.

[0234] In some embodiments of the present invention, the authentication module further stores the encrypted permission key of each authorized user, wherein the encrypted permission key of each authorized user carries a corresponding user identifier; when the computer program stored on the computer-readable storage medium is executed by the processor, the processor can also be used to implement the following steps:

[0235] Based on the target user key and the decryption algorithm, the encrypted data of the target user's permission key is decrypted to obtain the target user's permission key;

[0236] Based on the target user's permission key and the decryption algorithm, the encrypted permission data of the target user is decrypted to obtain permission data and a permission list.

[0237] In some embodiments of the present invention, when a computer program stored on a computer-readable storage medium is executed by a processor, the processor may also be used to perform the following steps:

[0238] Based on the target user's permission key and the decryption algorithm, the target user's token data ciphertext is decrypted to obtain the target user's access token.

[0239] In some embodiments of the present invention, when a computer program stored on a computer-readable storage medium is executed by a processor, the processor may also be used to perform the following steps:

[0240] Based on the target user's permission key and the decryption algorithm, the target user's token key ciphertext is decrypted to obtain the target user's token key.

[0241] In some embodiments of the present invention, when a computer program stored on a computer-readable storage medium is executed by a processor, the processor may also be used to perform the following steps:

[0242] Based on the target user's token key and the decryption algorithm, the target user's token data ciphertext is decrypted to obtain the target user's access token.

[0243] It is understood that if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a corresponding computer-readable storage medium. Based on this understanding, all or part of the processes in the above-described embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the above-described method embodiments. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0244] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0245] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0246] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0247] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0248] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An authentication method characterized by, Applied to a client, the method comprises: receiving an access request of a target user to a permission resource, wherein the access request carries a target user identifier; calling an authentication process in an authentication module according to the target user identifier, wherein the authentication module stores a decryption algorithm, permission data ciphertext of each permission user, and token data ciphertext of each permission user, the permission data ciphertext of each permission user and the token data ciphertext of each permission user both carry a corresponding user identifier, and the authentication process comprises: generating a target user key by using any encryption algorithm according to the target user identifier; decrypting the permission data ciphertext of the target user according to the target user key and the decryption algorithm to obtain permission data and a permission list; determining the access permission of the target user to the permission data according to the target user identifier, the permission data, and the permission list, and decrypting the token data ciphertext of the target user based on the target user key to obtain an access token of the target user; sending the access token to the target user, so that the target user accesses the permission resource in a resource server by using the access token of the target user.

2. The authentication method of claim 1, wherein, Before the receiving of the access request of the target user to the permission resource, the method further comprises: completing an initialization operation, wherein the initialization operation comprises: sending an authentication module acquisition request to a resource server or a CDN server; receiving the authentication module sent by the resource server or the CDN server; and locally loading the authentication module.

3. The method of claim 1, wherein, The client pre-stores a root key; The generating of the target user key by using any encryption algorithm according to the target user identifier comprises: generating the target user key by using any encryption algorithm according to the target user identifier and the root key.

4. The method of claim 3, wherein, The authentication module further stores a random value corresponding to each permission user; The generating of the target user key by using any encryption algorithm according to the target user identifier and the root key comprises: generating the target user key by using any encryption algorithm according to the target user identifier, the root key, and the random value corresponding to the target user.

5. The method of claim 1, wherein, The authentication module further stores permission key ciphertext of each permission user, wherein the permission key ciphertext of each permission user carries a corresponding user identifier; The decrypting of the permission data ciphertext of the target user according to the target user key and the decryption algorithm to obtain the permission data and the permission list comprises: decrypting the permission key ciphertext of the target user according to the target user key and the decryption algorithm to obtain the permission key of the target user; decrypting the permission data ciphertext of the target user according to the permission key of the target user and the decryption algorithm to obtain the permission data and the permission list.

6. The method of claim 5, wherein, The decrypting of the token data ciphertext of the target user according to the target user key to obtain the access token of the target user comprises: decrypting the token data ciphertext of the target user according to the permission key of the target user and the decryption algorithm to obtain the access token of the target user.

7. The method of claim 6, wherein, The authentication module also stores a token key cryptogram of each authorized user, wherein the token key cryptogram carries a corresponding user identifier, and the method further comprises: decrypting the token key cryptogram of the target user according to the authorization key of the target user and the decryption algorithm to obtain a token key of the target user.

8. The method of claim 7, wherein, The decryption of the token data cryptogram of the target user according to the authorization key of the target user and the decryption algorithm to obtain an access token of the target user comprises: decrypting the token data cryptogram of the target user according to the token key of the target user and the decryption algorithm to obtain an access token of the target user.

9. A computer apparatus comprising a processor, characterised in that, The processor, when executing a computer program stored on the memory, is configured to implement the authentication method according to any one of claims 1 to 8.

10. A computer storage medium having stored thereon a computer program, characterized in that The computer program, when executed by the processor, is configured to implement the authentication method according to any one of claims 1 to 8.

Images