Identity authority verification method, device, server, storage medium and product

Abstract

The present application provides an identity authority verification method, device, server, storage medium and product, which belongs to the field of information processing technology. The method includes: receiving a permission verification request from a terminal, the permission verification request carries a first hash value obtained based on a second hash value of the identity information to be verified and a third hash value of the permission information to be verified, the identity information to be verified and the permission information to be verified are partial identity information and partial permission information respectively; obtaining a hash value tree of a generated account, the third node in the hash value tree is the parent node of the first node and the second node, and the first node and the second node respectively store a fourth hash value corresponding to the baseline identity information and a fifth hash value corresponding to the baseline permission information, and the third node stores a sixth hash value obtained based on the fourth hash value and the fifth hash value; based on the first hash value and the sixth hash value, verifying the identity authority of the terminal. This method effectively improves the security of identity authority verification.

Description

Technical Field

[0001] The present application relates to the field of information processing technology, and in particular to an identity authority verification method, device, server, storage medium and product. Background Art

[0002] In some competition scenarios, it's common to establish information communication channels such as chat rooms or groups to facilitate communication between participants. When notifying members of event information such as the time and location of the match, group announcements are often used. However, only management personnel such as referees and team captains have the authority to post announcements. Therefore, before a group announcement is published, the user's permissions must be verified. Only if the verification confirms that the user has permission to post announcements can the announcement be published.

[0003] In related technologies, when verifying whether a user has the authority to post announcements, it is generally necessary to obtain the user's complete identity information and obtain complete permission information based on the complete identity information. The complete permission information includes all permission information such as the user's chat permission and announcement posting permission; then, based on the complete permission information, it is verified whether the user has the authority to post announcements.

[0004] In related technologies, since the authority to publish announcements is only a partial authority of the user, when verifying this partial authority, it is necessary to obtain the user's complete identity information and complete authority information for verification, which makes the user's privacy exposed to a large extent and results in a low level of privacy protection for the user. Summary of the Invention

[0005] The embodiments of the present application provide an identity and authority verification method, device, server, storage medium, and product, which can effectively improve the security of identity and authority verification. The technical solution is as follows:

[0006] In one aspect, a method for verifying identity and authority is provided, the method comprising:

[0007] Receiving a permission verification request from a terminal, the permission verification request carrying a first hash value, where the first hash value is obtained based on a second hash value of identity information to be verified and a third hash value of permission information to be verified, where the identity information to be verified is part of the identity information of the currently logged-in account, and the permission information to be verified is part of the permission information of the account;

[0008] Obtaining a generated hash value tree for the account, the hash value tree including a first node, a second node, and a third node, the third node being a parent node of the first node and the second node, the first node storing a fourth hash value corresponding to baseline identity information, the second node storing a fifth hash value corresponding to baseline authority information, and the third node storing a sixth hash value, the sixth hash value being obtained based on the fourth hash value and the fifth hash value;

[0009] Based on the first hash value and the sixth hash value, identity authority of the terminal is verified.

[0010] Optionally, the verifying the identity authority of the terminal based on the first hash value and the sixth hash value includes:

[0011] If the first hash value and the sixth hash value are the same, it means that the second hash value and the fourth hash value are the same and the third hash value and the fifth hash value are the same, and the permission verification result is determined to be verification passed;

[0012] If the first Hash value and the sixth Hash value are different, it means that the second Hash value and the fourth Hash value are different or the third Hash value and the fifth Hash value are different, and the permission verification result is determined to be verification failure.

[0013] Optionally, the hash value tree further includes a fourth node and a fifth node, the fifth node being a parent node of the third node and the fourth node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on the hash value of the identity information, and the fifth node storing an eighth hash value, the eighth hash value being obtained based on the sixth hash value and the seventh hash value;

[0014] The verifying the identity authority of the terminal based on the first hash value and the sixth hash value includes:

[0015] If the first hash value is the same as the sixth hash value, and the ninth hash value is the same as the eighth hash value, it is determined that the permission check result is verification passed, and the ninth hash value is obtained based on the first hash value and the seventh hash value;

[0016] If the first hash value is different from the sixth hash value, or the ninth hash value is different from the eighth hash value, it is determined that the permission verification result is verification failure.

[0017] Optionally, the permission verification request carries a hash value obtained by encrypting the first hash value based on a public key;

[0018] Before verifying the identity authority of the terminal based on the first hash value and the sixth hash value, the method further includes:

[0019] The encrypted hash value is decrypted based on the private key corresponding to the public key to obtain the first hash value.

[0020] Optionally, the method further includes:

[0021] Signing the sixth hash value based on the private key;

[0022] Sending a signature verification request to the terminal, the signature verification request carrying the public key, the sixth hash value, and the signed sixth hash value, the signature verification request being used to instruct the terminal to decrypt the signed sixth hash value based on the public key, and if the hash value obtained after decryption is the same as the sixth hash value, storing the public key.

[0023] Optionally, the process of generating the hash value tree includes:

[0024] receiving an authorization request from the terminal, the authorization request carrying the baseline identity information and the baseline authority information;

[0025] Determine the hash value of the reference identity information and the hash value of the reference authority information respectively to obtain the fourth hash value and the fifth hash value;

[0026] Determining the sixth hash value based on the fourth hash value and the fifth hash value;

[0027] The hash value tree is generated based on the fourth hash value, the fifth hash value, and the sixth hash value.

[0028] Optionally, the hash value tree further includes a fourth node and a fifth node, the fifth node being a parent node of the fourth node and the third node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on the hash value of the identity information, the fifth node storing an eighth hash value, the eighth hash value being obtained based on the seventh hash value and the sixth hash value; the authorization request also carries the identity information;

[0029] Generating the hash value tree based on the fourth hash value, the fifth hash value, and the sixth hash value includes:

[0030] Determining the seventh hash value based on the hash value of the identity information;

[0031] determining the eighth hash value based on the sixth hash value and the seventh hash value;

[0032] The hash value tree is generated based on the fourth hash value, the fifth hash value, the sixth hash value, the seventh hash value, and the eighth hash value.

[0033] Optionally, determining the seventh Hash value based on the Hash value of the identity information includes:

[0034] Obtaining a hash value of the identity information and a hash value of the current timestamp, and determining the seventh hash value based on the hash value of the identity information and the hash value of the current timestamp; or,

[0035] Obtain a hash value of the identity information, and determine the hash value of the identity information as the seventh hash value.

[0036] Optionally, the authorization request carries the baseline identity information and the baseline authority information encrypted using a symmetric key;

[0037] Before respectively determining the hash value of the reference identity information and the hash value of the reference authority information to obtain the fourth hash value and the fifth hash value, the method further includes:

[0038] The encrypted reference identity information and reference authority information are decrypted based on the symmetric key to obtain the reference identity information and the reference authority information.

[0039] Optionally, the receiving terminal's permission verification request includes:

[0040] Receive a permission verification request forwarded by an application server, where the permission verification request is sent by the terminal to the application server.

[0041] Optionally, the method further includes:

[0042] receiving an announcement publishing request from the terminal, wherein the announcement publishing request carries announcement information of the currently logged-in account;

[0043] If the result of the permission verification is passed, the announcement information is sent to the target group, and the target group is the group where the current login account belongs.

[0044] In another aspect, an identity authority verification device is provided, the device comprising:

[0045] a first receiving module, configured to receive a permission verification request from a terminal, the permission verification request carrying a first hash value, the first hash value being obtained based on a second hash value of identity information to be verified and a third hash value of permission information to be verified, the identity information to be verified being part of the identity information of a currently logged-in account, and the permission information to be verified being part of the permission information of the account;

[0046] an acquisition module, configured to acquire a generated hash value tree for the account, the hash value tree including a first node, a second node, and a third node, the third node being a parent node of the first node and the second node, the first node storing a fourth hash value corresponding to baseline identity information, the second node storing a fifth hash value corresponding to baseline authority information, and the third node storing a sixth hash value, the sixth hash value being obtained based on the fourth and fifth hash values;

[0047] A verification module is used to verify the identity authority of the terminal based on the first hash value and the sixth hash value.

[0048] Optionally, the verification module is used to:

[0049] If the first hash value and the sixth hash value are the same, it means that the second hash value and the fourth hash value are the same and the third hash value and the fifth hash value are the same, and the permission verification result is determined to be verification passed;

[0050] If the first Hash value and the sixth Hash value are different, it means that the second Hash value and the fourth Hash value are different or the third Hash value and the fifth Hash value are different, and the permission verification result is determined to be verification failure.

[0051] Optionally, the hash value tree further includes a fourth node and a fifth node, the fifth node being a parent node of the third node and the fourth node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on the hash value of the identity information, and the fifth node storing an eighth hash value, the eighth hash value being obtained based on the sixth hash value and the seventh hash value;

[0052] The verification module is used to:

[0053] If the first hash value is the same as the sixth hash value, and the ninth hash value is the same as the eighth hash value, it is determined that the permission check result is verification passed, and the ninth hash value is obtained based on the first hash value and the seventh hash value;

[0054] If the first hash value is different from the sixth hash value, or the ninth hash value is different from the eighth hash value, it is determined that the permission verification result is verification failure.

[0055] Optionally, the permission verification request carries a hash value obtained by encrypting the first hash value based on a public key; and the apparatus further includes:

[0056] The first decryption module is configured to decrypt the encrypted hash value based on a private key corresponding to the public key to obtain the first hash value.

[0057] Optionally, the device further comprises:

[0058] a signing module, configured to sign the sixth Hash value based on the private key;

[0059] A first sending module is configured to send a signature verification request to the terminal, where the signature verification request carries the public key, the sixth hash value, and the signed sixth hash value. The signature verification request is configured to instruct the terminal to decrypt the signed sixth hash value based on the public key, and if the hash value obtained after decryption is the same as the sixth hash value, store the public key.

[0060] Optionally, the device further includes:

[0061] A second receiving module is configured to receive an authorization request from the terminal, where the authorization request carries the baseline identity information and the baseline authority information;

[0062] a first determining module, configured to respectively determine a hash value of the reference identity information and a hash value of the reference authority information to obtain the fourth hash value and the fifth hash value;

[0063] a second determining module, configured to determine the sixth Hash value based on the fourth Hash value and the fifth Hash value;

[0064] A generating module is configured to generate the hash value tree based on the fourth hash value, the fifth hash value, and the sixth hash value.

[0065] Optionally, the hash value tree further includes a fourth node and a fifth node, the fifth node being a parent node of the fourth node and the third node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on the hash value of the identity information, the fifth node storing an eighth hash value, the eighth hash value being obtained based on the seventh hash value and the sixth hash value; the authorization request also carries the identity information;

[0066] The generation module includes:

[0067] a first determining unit, configured to determine the seventh Hash value based on the Hash value of the identity information;

[0068] a second determining unit, configured to determine the eighth Hash value based on the sixth Hash value and the seventh Hash value;

[0069] A generating unit is configured to generate the hash value tree based on the fourth hash value, the fifth hash value, the sixth hash value, the seventh hash value, and the eighth hash value.

[0070] Optionally, the first determining unit is configured to:

[0071] Obtaining a hash value of the identity information and a hash value of the current timestamp, and determining the seventh hash value based on the hash value of the identity information and the hash value of the current timestamp; or,

[0072] Obtain a hash value of the identity information, and determine the hash value of the identity information as the seventh hash value.

[0073] Optionally, the authorization request carries the baseline identity information and the baseline authority information encrypted using a symmetric key; the apparatus further includes:

[0074] The second decryption module is configured to decrypt the encrypted reference identity information and reference authority information based on the symmetric key to obtain the reference identity information and the reference authority information.

[0075] Optionally, the first receiving module is configured to:

[0076] Receive a permission verification request forwarded by an application server, where the permission verification request is sent by the terminal to the application server.

[0077] Optionally, the device further comprises:

[0078] A third receiving module is configured to receive an announcement publishing request from the terminal, wherein the announcement publishing request carries the announcement information of the currently logged-in account;

[0079] The second sending module is configured to send the announcement information to a target group if the result of the permission verification is passed, where the target group is the group where the currently logged-in account belongs.

[0080] On the other hand, a server is provided, comprising one or more processors and one or more memories, wherein at least one program code is stored in the one or more memories, and the at least one program code is loaded and executed by the one or more processors to implement the identity authority verification method described in any of the above implementation methods.

[0081] On the other hand, a computer-readable storage medium is provided, in which at least one program code is stored. The at least one program code is loaded and executed by a processor to implement the identity authority verification method described in any of the above implementations.

[0082] On the other hand, a computer program product is provided, which includes at least one program code, and the at least one program code is loaded and executed by a processor to implement the identity authority verification method described in any of the above implementations.

[0083] The beneficial effects of the technical solutions provided by the embodiments of the present application include at least:

[0084] An embodiment of the present application provides an identity and authority verification method. Since the sixth hash value of the parent node of the hash value tree in this method is generated based on the baseline identity information and baseline authority information of the account, and the baseline identity information and baseline authority information are respectively partial identity information and partial authority information of the account corresponding to the identity information to be verified and the authority information to be verified; in this way, when verifying the identity information to be verified and the authority information to be verified, it is only necessary to verify whether the first hash value is the same as the sixth hash value to confirm whether the identity information to be verified and the authority information to be verified are respectively the same as the baseline identity information and the baseline authority information, thereby avoiding the process of identity and authority verification based on the complete identity information and complete authority information of the account, and verifying the identity and authority based on the first hash value and the sixth hash value, thereby avoiding the exposure of the baseline identity information and the baseline authority information, realizing effective protection of the identity information and authority information of the account, and effectively improving the security of identity and authority verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0086] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0087] Figure 2 This is a flowchart of an identity authority verification method provided by an embodiment of the present application;

[0088] Figure 3 This is a flowchart of a hash value tree generation process provided by an embodiment of the present application;

[0089] Figure 4This is a schematic diagram of a hash value tree provided in an embodiment of the present application;

[0090] Figure 5 This is a flowchart of an identity authority verification method provided by an embodiment of the present application;

[0091] Figure 6 This is a flowchart of a hash value tree generation process provided by an embodiment of the present application;

[0092] Figure 7 This is a schematic diagram of a hash value tree provided in an embodiment of the present application;

[0093] Figure 8 This is a flowchart of an identity authority verification method provided by an embodiment of the present application;

[0094] Figure 9 This is a flowchart of an identity authority verification method provided by an embodiment of the present application;

[0095] Figure 10 This is a schematic diagram of an inter-device interaction process provided by an embodiment of the present application;

[0096] Figure 11 This is a schematic diagram of an interface of an application provided in an embodiment of the present application;

[0097] Figure 12 This is a schematic diagram of an interface of an application provided in an embodiment of the present application;

[0098] Figure 13 This is a schematic diagram of an interface of an application provided in an embodiment of the present application;

[0099] Figure 14 is a schematic diagram of a dialog box interface provided in an embodiment of the present application;

[0100] Figure 15 is a schematic diagram of a dialog box interface provided in an embodiment of the present application;

[0101] Figure 16 This is a schematic diagram of a chat information interface provided by an embodiment of the present application;

[0102] Figure 17 This is a schematic diagram of a chat information interface provided by an embodiment of the present application;

[0103] Figure 18 This is a block diagram of an identity authority verification device provided in an embodiment of the present application;

[0104] Figure 19 This is a block diagram of a terminal provided in an embodiment of the present application;

[0105] Figure 20This is a block diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0106] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0107] The terms "first," "second," "third," and "fourth," etc. in the specification and claims of this application and the accompanying drawings are used to distinguish different objects, not to describe a specific order. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements, but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or apparatus.

[0108] It should be noted that the user information involved in this application (including but not limited to user device information, user personal information, user identity information, user authority information, etc.) is information authorized by the user or fully authorized by all parties.

[0109] Blockchain is a new application model for computer technologies, including distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a series of data blocks linked using cryptographic methods. Each block contains information about a batch of online transactions, used to verify the validity of this information (to prevent counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product and service layer, and the application service layer.

[0110] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operation monitoring. Among them, the user management module is responsible for the identity information management of all blockchain participants, including maintaining public and private key generation (account management), key management, and maintaining the corresponding relationship between the user's real identity and the blockchain address (authority management), etc., and under authorization, it supervises and audits the transactions of certain real identities and provides risk control rule configuration (risk control audit); the basic service module is deployed on all blockchain node devices to verify the validity of business requests, and records the valid requests to the storage after consensus is reached. For a new business request, the basic service first adapts the interface to parse and authenticate the request (interface adaptation), and then encrypts the business information through the consensus algorithm (consensus management). The smart contract module is responsible for the registration, issuance, triggering and execution of contracts. Developers can define the contract logic in a programming language and publish it to the blockchain (contract registration). According to the logic of the contract terms, the contract logic is triggered by calling keys or other events to trigger execution. The contract logic is completed, and the contract upgrade and cancellation functions are also provided. The operation monitoring module is mainly responsible for the deployment, configuration modification, contract setting, cloud adaptation and real-time status visualization output of the product during the product release process, such as alarms, network status monitoring, and node equipment health status monitoring.

[0111] The platform's product service layer provides the basic capabilities and implementation framework for typical applications. Developers can build on these basic capabilities, overlay business features, and complete the blockchain implementation of business logic. The application service layer provides application services based on blockchain solutions for business participants to use.

[0112] Figure 1 This is a schematic diagram of an implementation environment provided by the embodiment of the present application, see Figure 1, the implementation environment includes: a terminal 10 and a server 20. The terminal 10 and the server 20 are connected via a wired or wireless network. Among them, the server 20 is a server, or a server cluster composed of several servers, such as a cloud server, a cloud computing platform and a virtualization center; optionally, the server 20 is a server of a trusted CA (Certification Authority) or a server that provides trusted third-party services. The terminal 10 can be at least one of a smart phone, a tablet computer, a car terminal, a laptop computer or a desktop computer. The terminal 10 is installed with a target application, and the terminal 10 can implement functions such as data transmission and information interaction through the target application. The target application is an application in the operating system of the terminal 10, or an application provided by a third party. For example, the target application is a chat application, and the terminal 10 can send a permission verification request to the server 20 through the target application; the server 20 is used to verify the identity authority of the terminal 10 using the method provided in this application.

[0113] In another implementation, the implementation environment includes a terminal 10, a server 20, and an application server. The application server is connected to the terminal 10 and the server 20 via a wired or wireless network. Optionally, the application server is the background server of the terminal 10, and the target application installed on the terminal 10 is served by the application server. After the terminal 10 sends a permission verification request to the application server through the target application, the application server forwards the permission verification request to the server 20, and the server 20 is used to verify the identity and permissions of the terminal 10 using the method provided in this application.

[0114] Figure 2 This is a flow chart of an identity authority verification method provided by an embodiment of the present application. The execution subject of the embodiment of the present application is a server, see Figure 2 , methods include:

[0115] 201. Receive a permission verification request from a terminal, where the permission verification request carries a first hash value, where the first hash value is obtained based on a second hash value of identity information to be verified and a third hash value of permission information to be verified, where the identity information to be verified is part of the identity information of the currently logged-in account, and the permission information to be verified is part of the permission information of the account.

[0116] 202. Obtain a hash value tree for the generated account, where the hash value tree includes a first node, a second node, and a third node, where the third node is a parent node of the first and second nodes, and the first node stores a fourth hash value corresponding to the baseline identity information, the second node stores a fifth hash value corresponding to the baseline authority information, and the third node stores a sixth hash value, where the sixth hash value is obtained based on the fourth and fifth hash values.

[0117] 203. Verify the identity authority of the terminal based on the first hash value and the sixth hash value.

[0118] Optionally, verifying the identity authority of the terminal based on the first hash value and the sixth hash value includes:

[0119] If the first hash value and the sixth hash value are the same, it means that the second hash value and the fourth hash value are the same and the third hash value and the fifth hash value are the same, and the permission verification result is determined to be verification passed;

[0120] If the first hash value and the sixth hash value are different, it means that the second hash value and the fourth hash value are different or the third hash value and the fifth hash value are different, and the permission verification result is determined to be verification failure.

[0121] Optionally, the hash value tree further includes a fourth node and a fifth node, the fifth node being a parent node of the third node and the fourth node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on the hash value of the identity information, and the fifth node storing an eighth hash value, the eighth hash value being obtained based on the sixth hash value and the seventh hash value;

[0122] Verifying the identity authority of the terminal based on the first hash value and the sixth hash value, including:

[0123] If the first hash value is the same as the sixth hash value, and the ninth hash value is the same as the eighth hash value, it is determined that the permission check result is verified to be passed, and the ninth hash value is obtained based on the first hash value and the seventh hash value;

[0124] If the first hash value is different from the sixth hash value, or the ninth hash value is different from the eighth hash value, it is determined that the permission verification result is verification failure.

[0125] Optionally, the permission verification request carries a hash value obtained by encrypting the first hash value based on the public key;

[0126] Before verifying the identity authority of the terminal based on the first hash value and the sixth hash value, the method further includes:

[0127] The encrypted hash value is decrypted based on the private key corresponding to the public key to obtain a first hash value.

[0128] Optionally, the method further comprises:

[0129] Signing the sixth hash value based on the private key;

[0130] A signature verification request is sent to the terminal, where the signature verification request carries the public key, the sixth hash value, and the signed sixth hash value. The signature verification request is used to instruct the terminal to decrypt the signed sixth hash value based on the public key, and if the hash value obtained after decryption is the same as the sixth hash value, the public key is stored.

[0131] Optionally, the process of generating the hash value tree includes:

[0132] Receive an authorization request from a terminal, the authorization request carrying baseline identity information and baseline authority information;

[0133] Determine the hash value of the baseline identity information and the hash value of the baseline authority information respectively to obtain a fourth hash value and a fifth hash value;

[0134] determining a sixth hash value based on the fourth hash value and the fifth hash value;

[0135] A hash value tree is generated based on the fourth hash value, the fifth hash value, and the sixth hash value.

[0136] Optionally, the hash value tree further includes a fourth node and a fifth node, the fifth node being a parent node of the fourth node and the third node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on a hash value of the identity information, the fifth node storing an eighth hash value, the eighth hash value being obtained based on the seventh hash value and the sixth hash value; the authorization request further carries identity information;

[0137] Generating a hash value tree based on the fourth hash value, the fifth hash value, and the sixth hash value includes:

[0138] determining a seventh hash value based on the hash value of the identity information;

[0139] determining an eighth hash value based on the sixth hash value and the seventh hash value;

[0140] A hash value tree is generated based on the fourth hash value, the fifth hash value, the sixth hash value, the seventh hash value, and the eighth hash value.

[0141] Optionally, determining the seventh hash value based on the hash value of the identity information includes:

[0142] Obtaining a hash value of the identity information and a hash value of the current timestamp, and determining a seventh hash value based on the hash value of the identity information and the hash value of the current timestamp; or,

[0143] A hash value of the identity information is obtained, and the hash value of the identity information is determined as a seventh hash value.

[0144] Optionally, the authorization request carries the baseline identity information and the baseline authority information encrypted using a symmetric key;

[0145] Before respectively determining the hash value of the baseline identity information and the hash value of the baseline authority information to obtain the fourth hash value and the fifth hash value, the method further includes:

[0146] The encrypted baseline identity information and baseline authority information are decrypted based on the symmetric key to obtain the baseline identity information and baseline authority information.

[0147] Optionally, receiving a permission verification request from a terminal includes:

[0148] Receive the permission verification request forwarded by the application server, where the permission verification request is sent by the terminal to the application server.

[0149] Optionally, the method further comprises:

[0150] Receive the announcement publishing request from the terminal, which carries the announcement information of the currently logged-in account;

[0151] If the permission verification result is passed, an announcement message will be sent to the target group, which is the group where the current login account belongs.

[0152] An embodiment of the present application provides an identity and authority verification method. Since the sixth hash value of the parent node of the hash value tree in this method is generated based on the baseline identity information and baseline authority information of the account, and the baseline identity information and baseline authority information are respectively partial identity information and partial authority information of the account corresponding to the identity information to be verified and the authority information to be verified; in this way, when verifying the identity information to be verified and the authority information to be verified, it is only necessary to verify whether the first hash value is the same as the sixth hash value to confirm whether the identity information to be verified and the authority information to be verified are respectively the same as the baseline identity information and the baseline authority information, thereby avoiding the process of identity and authority verification based on the complete identity information and complete authority information of the account, and verifying the identity and authority based on the first hash value and the sixth hash value, thereby avoiding the exposure of the baseline identity information and the baseline authority information, realizing effective protection of the identity information and authority information of the account, and effectively improving the security of identity and authority verification.

[0153] Figure 3 This is a flow chart of a hash value tree generation process provided by an embodiment of the present application. The execution subject of the embodiment of the present application is a server, see Figure 3 , methods include:

[0154] 301. The terminal sends an authorization request to the server.

[0155] The authorization request carries the base identity information and base permission information. The base identity information is part of the identity information of the current login account of the terminal, and the base permission information is part of the permission information of the account corresponding to the part of the identity information.

[0156] In some embodiments, the authorization request is triggered by a terminal based on a target control on a target application installed on the terminal, and the terminal is a terminal used by the user. In some embodiments, after the target application is first launched, the target application displays an information input interface. After the user enters their identity information, the user's account obtains multiple permissions of the target application, each of which is a partial permission of the account. Each permission corresponds to a partial identity information of the account. Each partial permission information and its corresponding partial identity information serve as the baseline identity information and baseline permission information of the permission, respectively.

[0157] In one implementation, the terminal sequentially sends each piece of permission information and the corresponding partial identity information to the server, thereby facilitating the server to subsequently generate a hash value tree directly based on the partial permission information and partial identity information. In another implementation, the terminal simultaneously sends multiple pieces of permission information and their corresponding partial identity information to the server, and the server determines each piece of permission information and its corresponding partial identity information, thereby reducing the number of transmissions and improving transmission efficiency. Optionally, the server determines the corresponding partial identity information based on the identifier of the partial identity information carried in the permission information.

[0158] 302. The server receives the authorization request sent by the terminal.

[0159] In one implementation, the authorization request carries the baseline identity information and baseline permission information encrypted using a symmetric key. Upon receiving the authorization request, the server decrypts the encrypted baseline identity information and baseline permission information using the symmetric key to obtain the baseline identity information and baseline permission information.

[0160] The symmetric key is a key agreed upon in advance between the terminal and the server. The symmetric key uses the same password for encryption and decryption. Optionally, the terminal generates the symmetric key and sends it to the server via a trusted channel, or the server generates the symmetric key and sends it to the terminal via a trusted channel.

[0161] Optionally, the server is a server of a trusted CA or a server providing trusted third-party services. In this way, when identity and authority verification is subsequently performed through the server, the security of identity and authority verification can be improved, and the accuracy and credibility of the authority verification results can be improved.

[0162] 303. The server determines the hash value of the reference identity information and the hash value of the reference authority information respectively to obtain a fourth hash value and a fifth hash value.

[0163] Among them, the hash algorithm used by the server to determine the hash value can be set and changed as needed, and is not specifically limited in the embodiments of the present application.

[0164] 304. The server determines a sixth Hash value based on the fourth Hash value and the fifth Hash value.

[0165] Optionally, the server concatenates the fourth hash value and the fifth hash value, and then performs a hash operation on the concatenated hash value again to obtain a sixth hash value.

[0166] 305. The server generates a hash value tree based on the fourth hash value, the fifth hash value, and the sixth hash value.

[0167] See also Figure 4 , Figure 4 This is a schematic diagram of a hash tree generated based on a fourth hash value, a fifth hash value, and a sixth hash value. The hash tree includes a first node, a second node, and a third node. The third node is the parent node of the first and second nodes. The first node stores the fourth hash value corresponding to the baseline identity information, the second node stores the fifth hash value corresponding to the baseline permission information, and the third node stores the sixth hash value, which is derived based on the fourth and fifth hash values. The first and second nodes are leaf nodes of the hash tree, storing the fourth and fifth hash values ​​of the baseline identity information and baseline permission information, respectively. The third node is a root node, storing the root hash value of the hash tree, i.e., the sixth hash value.

[0168] In an embodiment of the present application, the server obtains a sixth hash value based on the hash value of the baseline identity information and the hash value of the baseline permission information, and then generates a hash value tree based on the hash value of the baseline identity information, the hash value of the baseline permission information and the sixth hash value. In this way, when the server subsequently receives a permission verification request, it can directly verify the first hash value obtained based on the hash value of the sixth hash value in the hash value tree and the hash value of the identity information to be verified and the hash value of the permission information to be verified, thereby avoiding the process of verification based on the complete identity information and complete permission information of the account, and avoiding the exposure of the baseline identity information and baseline permission information, thereby achieving effective protection of the identity information and permission information of the account, and effectively improving the security of identity and permission verification.

[0169] 306. The server generates a public key and a private key corresponding to the hash value tree.

[0170] It's important to note that the private key is stored on the server, and the public key is stored on the terminal. The public key is used to encrypt the information contained in subsequent permission verification requests sent by the terminal to the server, while the private key is used to decrypt the information contained in the permission verification requests, thus ensuring the security of information transmitted between the terminal and the server.

[0171] 307. The server signs the sixth hash value based on the private key.

[0172] It should be noted that in the embodiment of the present application, the sixth hash value is signed by the private key, and then the public key of the terminal is verified based on the signed sixth hash value in the subsequent process, which can ensure the matching between the public key and the private key, thereby ensuring the effectiveness of subsequent encryption or decryption based on the public key and private key.

[0173] 308. The server sends a signature verification request to the terminal.

[0174] The signature verification request carries the public key, the sixth hash value, and the signed sixth hash value. The signature verification request is used to instruct the terminal to decrypt the signed sixth hash value based on the public key, and if the hash value obtained after decryption is the same as the sixth hash value, the public key is stored.

[0175] 309. The terminal receives the signature verification request and decrypts the signed sixth hash value based on the public key. If the hash value obtained after decryption is the same as the sixth hash value, the public key is stored.

[0176] In some embodiments, if the hash value obtained after decryption is the same as the sixth hash value, the terminal also stores the sixth hash value; in this way, when the terminal subsequently sends a permission verification request to the server, the sixth hash value is directly used as the first hash value, so that the permission verification request carries the sixth hash value and is sent to the server, thereby improving the efficiency of obtaining the first hash value, thereby improving the efficiency of sending the permission verification request.

[0177] In an embodiment of the present application, signature verification is achieved by decrypting the signed sixth hash value based on the public key, thereby verifying the sixth hash value sent by the server and the identity of the server sending the sixth hash value. This verifies the pairing of the public key and the private key, thereby ensuring that in the subsequent process, after the server receives the message encrypted based on the public key sent by the terminal, it can be accurately and smoothly decrypted based on the private key, thereby ensuring the validity of the decryption.

[0178] Figure 5 This is a flow chart of an identity authority verification method provided by an embodiment of the present application. The execution subject of the embodiment of the present application is a server, see Figure 5 , methods include:

[0179] 501. The terminal sends a permission verification request to the server.

[0180] Among them, the permission verification request carries a first hash value, which is obtained based on the second hash value of the identity information to be verified and the third hash value of the permission information to be verified. The identity information to be verified is part of the identity information of the current login account, and the permission information to be verified is part of the permission information in the permission information of the account.

[0181] In one implementation, the first hash value is obtained based on a sixth hash value pre-stored by the terminal; if the sixth hash value has not been tampered with, the first hash value is the stored sixth hash value; if the sixth hash value has been tampered with, the first hash value is the tampered sixth hash value. In another implementation, the identity information to be verified and the permission information to be verified are new identity information and new permission information, and the first hash value is obtained based on the new identity information and the new permission information. The first hash value is not obtained based on the pre-stored sixth hash value, and the server does not generate a hash value tree corresponding to the new identity information and the new permission information, and the corresponding subsequent permission verification result is failure.

[0182] In some embodiments, the permission verification request is triggered by a terminal based on a target control installed on a target application, where the terminal is a terminal used by a user. In some embodiments, the target application is a chat application, the account's permission information to be verified is permission information for posting announcements in a target group, and the account's identity information to be verified is the identity information of an administrator of the target group. In response to the triggering of the control for posting an announcement, the terminal sends a permission verification request to the server. Optionally, the terminal sends the permission verification request via a trusted channel.

[0183] In an embodiment of the present application, identity information to be verified and permission information to be verified are verified by first hash values ​​of partial identity information and partial permission information, thereby avoiding exposure of redundant information, and realizing verification of both identity information and permission information through one verification, thereby improving reliability and efficiency of verification.

[0184] 502. The server receives the permission verification request from the terminal.

[0185] In one implementation, the permission verification request carries a hash value obtained by encrypting the first hash value based on the public key. After receiving the permission verification request, the server decrypts the encrypted hash value based on the private key corresponding to the public key to obtain the first hash value.

[0186] In the embodiment of the present application, by encrypting the first hash value based on the public key, the first hash value is prevented from being tampered with during the process of being sent to the server, thereby ensuring the security of transmitting the first hash value.

[0187] 503. The server obtains the hash value tree of the generated account.

[0188] The generation process of the hash value tree is implemented through the above steps 301-305, which will not be repeated here.

[0189] It should be noted that each account can correspond to multiple different hash value trees, each hash value tree corresponds to a different part of the permissions of the account, and each hash value tree is associated not only with its corresponding account, but also with its corresponding part of the permissions.

[0190] In one implementation, multiple hash value trees for each account are stored in a set that carries the account ID of the account; each hash value tree in the set carries the permission ID of the portion of permission information corresponding to the hash value tree. The first hash value carries the account ID and the permission ID. The server then determines a target set that matches the account ID from the multiple sets of multiple accounts, and then determines a hash value tree that matches the permission ID from the target set.

[0191] In another implementation, the shared permissions for multiple accounts are stored in a set that carries a permission identifier. Each hash tree in the set carries the account identifier of the account corresponding to the hash tree. A first hash value carries both the account identifier and the permission identifier. The server then determines a target set from the multiple permission sets that matches the permission identifier, and then determines a hash tree from the target set that matches the account identifier.

[0192] 504. The server verifies the identity authority of the terminal based on the first hash value and the sixth hash value.

[0193] In one implementation, if the first hash value and the sixth hash value are the same, it means that the second hash value and the fourth hash value are the same and the third hash value and the fifth hash value are the same, and the permission verification result is determined to be verification passed. In another implementation, if the first hash value and the sixth hash value are different, it means that the second hash value and the fourth hash value are different or the third hash value and the fifth hash value are different, and the permission verification result is determined to be verification failed. Optionally, the second hash value and the fourth hash value are different or the third hash value and the fifth hash value are different include the second hash value and the fourth hash value are different, or the third hash value and the fifth hash value are different, or the second hash value and the fourth hash value are different and the third hash value and the fifth hash value are different.

[0194] Optionally, after the server determines the permission verification result, it sends the permission verification result to the terminal, and the terminal is used to proceed to the next step of the process based on the permission verification result; wherein, the permission verification result is returned by a trusted channel of a trusted CA or a trusted third-party service, thereby improving the credibility of the permission verification result.

[0195] In another implementation, after the server determines the result of the permission verification, it directly instructs the terminal to proceed to the next step of the process corresponding to the permission verification result. In some embodiments, the server receives an announcement publishing request from the terminal, and the announcement publishing request carries the announcement information of the current login account. If the permission verification result is passed, the server sends the announcement information to the target group, and the target group is the group where the current login account is located. In this embodiment, by carrying the announcement information in the announcement publishing request, the announcement information can be directly published to the target group after the verification is passed, thereby improving the efficiency of publishing the announcement information.

[0196] An embodiment of the present application provides an identity and authority verification method. Since the sixth hash value of the parent node of the hash value tree in this method is generated based on the baseline identity information and baseline authority information of the account, and the baseline identity information and baseline authority information are respectively partial identity information and partial authority information of the account corresponding to the identity information to be verified and the authority information to be verified; in this way, when verifying the identity information to be verified and the authority information to be verified, it is only necessary to verify whether the first hash value is the same as the sixth hash value to confirm whether the identity information to be verified and the authority information to be verified are respectively the same as the baseline identity information and the baseline authority information, thereby avoiding the process of identity and authority verification based on the complete identity information and complete authority information of the account, and verifying the identity and authority based on the first hash value and the sixth hash value, thereby avoiding the exposure of the baseline identity information and the baseline authority information, realizing effective protection of the identity information and authority information of the account, and effectively improving the security of identity and authority verification.

[0197] Figure 6 This is a flow chart of a hash value tree generation process provided by an embodiment of the present application. The execution subject of the embodiment of the present application is a server, see Figure 6 , methods include:

[0198] 601. The terminal sends an authorization request to the server.

[0199] The authorization request carries baseline identity information, baseline authority information, and identity information. The baseline identity information is part of the identity information of the terminal's current login account, the baseline authority information is part of the authority information of the account corresponding to the partial identity information, and the identity information is the complete identity information of the account.

[0200] In some embodiments, the authorization request is triggered by a terminal based on a target control on a target application installed on the terminal, and the terminal is a terminal used by the user. In some embodiments, after the target application is first launched, the target application displays an information input interface, and after the user enters their identity information, the user's account obtains multiple permissions of the target application, wherein the multiple permissions are respectively partial permissions of the account, each permission corresponds to partial identity information of the account, and each permission information and its corresponding partial identity information serve as the baseline identity information and baseline permission information of the permission, respectively.

[0201] In one implementation, the terminal sequentially sends each permission information, the partial identity information corresponding to each permission information, and the identity information to the server, thereby facilitating the subsequent server to directly generate a hash value tree based on the permission information, partial identity information, and identity information. In another implementation, the terminal simultaneously sends the identity information, multiple permission information, and the corresponding partial identity information to the server, and the server determines each permission information and its corresponding partial identity information, thereby reducing the number of transmissions and improving transmission efficiency. Optionally, the server determines the corresponding partial identity information based on the identifier of the partial identity information carried in the permission information.

[0202] 602. The server receives the authorization request sent by the terminal.

[0203] In one implementation, the authorization request carries the baseline identity information, baseline permission information, and identity information encrypted using a symmetric key. Upon receiving the authorization request, the server decrypts the encrypted baseline identity information, baseline permission information, and identity information using the symmetric key to obtain the baseline identity information, baseline permission information, and identity information.

[0204] Optionally, the terminal encrypts the baseline identity information, baseline authority information and identity information respectively based on a symmetric key; or, the terminal packages the baseline identity information, baseline authority information and identity information and encrypts them once based on a symmetric key.

[0205] 603. The server determines the hash value of the reference identity information and the hash value of the reference authority information respectively to obtain a fourth hash value and a fifth hash value, and determines a seventh hash value based on the hash value of the identity information.

[0206] In one implementation, the server obtains a hash value of the identity information and determines the hash value of the identity information as the seventh hash value. In another implementation, the server obtains the hash value of the identity information and the hash value of the current timestamp, and determines the seventh hash value based on the hash value of the identity information and the hash value of the current timestamp. Optionally, the server concatenates the hash value of the identity information and the hash value of the current timestamp, and then performs a hash operation on the concatenated hash value again to obtain the seventh hash value. This ensures that when identity and permission verification is subsequently performed, the identity information to be verified and the permission information to be verified are within the validity period calculated from the current timestamp, thereby ensuring the timeliness of identity and permission verification.

[0207] 604. The server determines a sixth Hash value based on the fourth Hash value and the fifth Hash value.

[0208] Optionally, the server concatenates the fourth hash value and the fifth hash value, and then performs a hash operation on the concatenated hash value again to obtain a sixth hash value.

[0209] 605. The server determines an eighth Hash value based on the sixth Hash value and the seventh Hash value.

[0210] Optionally, the server concatenates the sixth hash value and the seventh hash value, and then performs a hash operation on the concatenated hash value again to obtain an eighth hash value.

[0211] 606. The server generates a hash value tree based on the fourth hash value, the fifth hash value, the sixth hash value, the seventh hash value, and the eighth hash value.

[0212] Among them, the hash value tree includes a first node, a second node, a third node, a fourth node and a fifth node, the third node is the parent node of the first node and the second node, the fifth node is the parent node of the third node and the fourth node, and the first node stores the fourth hash value corresponding to the baseline identity information, the second node stores the fifth hash value corresponding to the baseline authority information, the third node stores the sixth hash value, and the sixth hash value is obtained based on the fourth hash value and the fifth hash value; the fourth node stores the seventh hash value, and the seventh hash value is obtained based on the hash value of the identity information; the fifth node stores the eighth hash value, and the eighth hash value is obtained based on the seventh hash value and the sixth hash value.

[0213] In an embodiment of the present application, the server generates a hash value tree based on the baseline identity information, the baseline authority information and the identity information. Since the identity information is the complete identity information of the account, the hash value of the identity information is used as a node of the hash value tree, which can ensure the stability and accuracy of the hash value tree. When subsequent verification is performed based on the hash value tree, double verification can be performed based on the sixth hash value and the eighth hash value in the hash value tree, thereby ensuring the accuracy of the verification.

[0214] In another implementation, the hash value tree further includes a sixth node and a seventh node; the sixth node stores the hash value of the identity information, the seventh node stores the hash value of the current timestamp, the fourth node is the parent node of the sixth and seventh nodes, and the fourth node stores a seventh hash value obtained based on the hash value of the identity information, the hash value, and the current timestamp. Figure 7 , Figure 7 Schematic diagram of the hash value tree. The first, second, sixth, and seventh nodes are leaf nodes of the hash value tree, respectively storing the fourth hash value of the baseline identity information, the fifth hash value of the baseline permission information, the hash value of the identity information, and the hash value of the current timestamp. The third and fourth nodes are intermediate nodes, and the fifth node is the root node, which stores the root hash value of the hash value tree, i.e., the eighth hash value. Optionally, the hash value tree is a Merkle tree.

[0215] In an embodiment of the present application, the server generates a Merkle tree based on the baseline identity information, baseline authority information, identity information and the current timestamp. In this way, the hash value of the current timestamp is used as the node of the hash value tree, which can ensure that the identity information to be verified and the authority information to be verified are within the validity period calculated from the current timestamp when the identity authority is subsequently verified, thereby ensuring the time limit of the identity authority verification.

[0216] 607. The server generates a public key and a private key corresponding to the hash value tree.

[0217] 608. The server signs the sixth hash value based on the private key.

[0218] 609. The server sends a signature verification request to the terminal.

[0219] 610. The terminal receives the signature verification request and decrypts the signed sixth hash value based on the public key. If the hash value obtained after decryption is the same as the sixth hash value, the public key is stored.

[0220] Steps 607-610 are the same as steps 306-309 and will not be repeated here.

[0221] Figure 8 This is a flow chart of an identity authority verification method provided by an embodiment of the present application. The execution subject of the embodiment of the present application is a server, see Figure 8 , methods include:

[0222] 801. The terminal sends a permission verification request to the server.

[0223] This step is the same as step 501 and will not be repeated here.

[0224] 802. The server receives a permission verification request sent by the terminal.

[0225] This step is the same as step 502 and will not be repeated here.

[0226] 803. The server obtains the hash value tree of the generated account.

[0227] The generation process of the hash value tree is implemented through the above steps 601-605. The process of the server obtaining the hash value tree is the same as step 503 and will not be repeated here.

[0228] 804. The server verifies the identity authority of the terminal based on the first hash value, the sixth hash value, the seventh hash value, and the eighth hash value.

[0229] In an embodiment of the present application, if the first hash value is the same as the sixth hash value, and the ninth hash value is the same as the eighth hash value, the server determines that the permission verification result is verification passed; wherein the ninth hash value is obtained based on the first hash value and the seventh hash value; if the first hash value is different from the sixth hash value, or the ninth hash value is different from the eighth hash value, the server determines that the permission verification result is verification failed.

[0230] In one implementation, after the server obtains the ninth hash value based on the first hash value and the seventh hash value, the server simultaneously verifies the first hash value and the sixth hash value, as well as the ninth hash value and the eighth hash value; if the first hash value is the same as the sixth hash value, and the ninth hash value is the same as the eighth hash value, the server determines that the permission verification result is passed. If the first hash value is different from the sixth hash value, or the ninth hash value is different from the eighth hash value, or the first hash value is different from the sixth hash value, and the ninth hash value is different from the eighth hash value, the server determines that the permission verification result is failed. By verifying the first hash value and the ninth hash value at the same time, the time wasted by verifying the first hash value and the ninth hash value separately is avoided, the verification time is reduced, and the verification efficiency is improved.

[0231] In another implementation, after the server obtains the ninth hash value based on the first and seventh hash values, it first verifies the first and sixth hash values. If the first and sixth hash values ​​are different, there is no need to verify the ninth and eighth hash values, and the server directly determines that the permission verification result is unsuccessful. If the first and sixth hash values ​​are the same, the server verifies the ninth and eighth hash values. If the ninth and eighth hash values ​​are the same, the server determines that the permission verification result is successful. This implementation avoids the waste of resources and time caused by verifying the ninth and eighth hash values ​​when the first and sixth hash values ​​are different.

[0232] In an embodiment of the present application, the first hash value is verified based on the sixth hash value and the eighth hash value respectively. In this way, through double verification, when any one of the first hash value and the sixth hash value and the ninth hash value and the eighth hash value is different, the authority verification result is determined to be verification failure, thereby ensuring the accuracy of identity authority verification.

[0233] Figure 9 This is a flow chart of an identity authority verification method provided by an embodiment of the present application. The execution subject of the embodiment of the present application is a server, see Figure 9 , methods include:

[0234] 901. The terminal sends a permission verification request to the application server.

[0235] The permission verification request carries the identity information to be verified and the permission information to be verified.

[0236] This step is the same as the process of the terminal sending the permission verification request to the server in step 501, and will not be repeated here.

[0237] 902. The application server receives a permission verification request sent by the terminal.

[0238] The application server is a backend server of the target application installed on the terminal. After receiving the permission verification request sent by the terminal, the server sends the permission verification request to the server.

[0239] 903. The application server sends a permission verification request to the server.

[0240] In some embodiments, the permission verification request carries the identity information to be verified and the permission information to be verified that are encrypted based on the public key. In one implementation, the terminal encrypts the identity information to be verified and the permission information to be verified based on the public key, and sends the permission verification request carrying the encrypted identity information to be verified and the permission information to be verified to the application server, and the application server forwards the permission verification request to the server. In another implementation, after receiving the permission verification request, the application server encrypts the identity information to be verified and the permission information to be verified based on the public key, and sends the permission verification request carrying the encrypted identity information to be verified and the permission information to be verified to the server.

[0241] 904. The server receives the permission verification request from the application server.

[0242] In one implementation, the permission verification request carries the identity information to be verified and the permission information to be verified, encrypted using a public key. Upon receiving the permission verification request, the server decrypts the encrypted identity information to be verified and the permission information to be verified using the private key corresponding to the public key to obtain the identity information to be verified and the permission information to be verified.

[0243] In an embodiment of the present application, by encrypting the identity information to be verified and the permission information to be verified based on the public key, the identity information to be verified and the permission information to be verified are prevented from being tampered with during the process of being sent to the server, thereby ensuring the security of transmitting the identity information to be verified and the permission information to be verified.

[0244] 905. The server generates a first hash value based on the identity information to be verified and the permission information to be verified.

[0245] In which, the server respectively determines the second hash value of the identity information to be verified and the third hash value of the permission information to be verified, and generates a first hash value based on the second hash value and the third hash value; optionally, the server splices the second hash value and the third hash value, and then performs a hash operation on the spliced ​​hash value again to obtain the first hash value.

[0246] 906. The server obtains the generated hash value tree of the account.

[0247] The generation process of the hash value tree is implemented through the above steps 601-605. The process of the server obtaining the hash value tree is the same as step 503 and will not be repeated here.

[0248] 907. The server verifies the identity authority of the terminal based on the first hash value, the sixth hash value, the seventh hash value, and the eighth hash value.

[0249] This step is the same as step 904 and will not be repeated here.

[0250] In an embodiment of the present application, the permission verification request of the terminal is forwarded by the application server. Since the application server has higher requirements than the terminal in terms of stability, security, performance, etc., forwarding the permission verification request of the terminal by the application server can improve the stability and security of information transmission.

[0251] Figure 10 This is a schematic diagram of an inter-device interaction process provided by an embodiment of the present application. Figure 10This interaction process includes an authorization phase and a verification phase, and the hash value tree is a Merkle tree. Steps 1001-1005 represent the authorization phase, while steps 1006-1009 represent the verification phase. In step 1001, the terminal sends partial identity information, partial permission information, and complete identity information to the server. In step 1002, the server receives the partial identity information, partial permission information, and complete identity information and generates a Merkle tree based on the partial identity information, partial permission information, and complete identity information. In step 1003, the server generates a public-private key pair corresponding to the Merkle tree. In step 1004, the server uses the private key to concatenate the hash value of the partial identity information and the hash value of the partial permission information corresponding to the partial identity information, and then re-hashes the resulting hash value to sign the resulting hash value. In step 1005, the server sends the public key, the re-hashed hash value, and the signed hash value to the terminal. In step 1006, the terminal verifies the signature of the public key based on the re-hashed hash value and the signed hash value. In step 1007, the terminal sends the encrypted hash value of the hash value after the public key is hashed again to the server. In step 1008, the server verifies the identity and permissions of the terminal based on the Merkle tree. In step 1009, the server sends the permission verification result to the terminal.

[0252] In some embodiments, the method provided by the embodiments of the present application is applied in an e-sports scenario, and an e-sports application is provided on the terminal. The application is a one-stop e-sports competition platform application that provides functions such as organizing competitions, participating in competitions, and watching competitions. In this application, it is necessary to establish an information communication channel to help the team members who have successfully registered for the competition to communicate with each other. The team members need to communicate the game time and event information. The team captain or the referee needs to inform everyone of the key information of the game; therefore, the information communication channel is generally a chat room-style group. Participate Figure 11 , enter the chat room by triggering the "Enter Team Chat Room" control on the "My Registered Events" interface of the application; or participate Figure 12 , enter the chat room by triggering the "Enter Battle Chat Room" control on the "My Registered Events" interface of the application; or refer to Figure 13 , on your personal homepage, enter the chat room by triggering the "My Chat" control. Figure 14 This is a diagram of the dialog interface of a team's chat room, including avatar, nickname, role, chat content, sending time, and distinguishing the conversation style between oneself and others; the roles include captain, teammates, me, and referee. When I am the "captain" or "referee", the title of "captain" or "referee" will be displayed, otherwise the title of "me" will be displayed. Figure 15This is a diagram of the dialog box interface of the chat room of two competing teams, including avatar, nickname, role, chat content, sending time, etc., and distinguishing the conversation style between oneself and others; the roles include captain, teammate, me, referee, and opponent. When I am the "captain" or "referee", the title of "captain" or "referee" will be displayed, otherwise the title of "me" will be displayed. Figure 16 This is a diagram of the "Chat Information" interface, which includes settings for chat room member roles, group chat name, and chat announcements. Figure 17 This is a diagram of the "Chat Information" interface after a chat room announcement is posted. This interface includes the chat room member roles, the group chat name, and the chat announcement content. Only referees can edit and post announcements. If there are no referees in the group, each team captain can edit and post announcements. That means if there are multiple teams, captains of multiple teams can edit and post announcements.

[0253] The embodiment of the present application can verify the chat identity authority in the chat room of the application, as well as the authority to publish announcements. When verifying the chat identity authority through the embodiment of the present application, the terminal sends a chat request to the server, which carries a first hash value obtained based on the hash value of the identity information of the current login account in the target group and the hash value of the authority information for publishing the session. The server obtains the hash value tree of the current login account, which is a hash value tree corresponding to the identity information in the target group and the authority information for publishing the session. If the first hash value is the same as the sixth hash value in the hash value tree, the terminal determines that the authority verification result is verified, and the server sends the authority verification result to the terminal. The terminal publishes the session information of the current login account in the target group based on the authority verification result. In another implementation method, the chat request carries the session information of the current login account. After the server determines that the authority verification result is verified, the session information is published to the target group, and the authority verification result is sent to the terminal. The authority verification result is used to instruct the terminal to display the session information on the dialogue interface.

[0254] When the authority to publish announcements is verified by the method provided in the embodiment of the present application, the terminal sends an announcement publishing request to the server, and the announcement publishing request carries a first hash value obtained based on the hash value of the identity information of the current login account in the target group and the hash value of the authority information for publishing announcements. The server obtains the hash value tree of the current login account, and the hash value tree is a hash value tree corresponding to the identity information in the target group and the authority information for publishing announcements. If the first hash value is the same as the sixth hash value in the hash value tree, the terminal determines that the authority verification result is verified to be passed, and the server sends the authority verification result to the terminal, and the terminal publishes the announcement information of the current login account in the target group based on the authority verification result. In another implementation method, the chat request carries the announcement information of the current login account. After the server determines that the authority verification result is verified to be passed, the announcement information is published in the target group, and the authority verification result is sent to the terminal. The authority verification result is used to instruct the terminal to display the announcement information on the chat information interface.

[0255] An embodiment of the present application provides an identity and authority verification method. Since the sixth hash value of the parent node of the hash value tree in this method is generated based on the baseline identity information and baseline authority information of the account, and the baseline identity information and baseline authority information are respectively partial identity information and partial authority information of the account corresponding to the identity information to be verified and the authority information to be verified; in this way, when verifying the identity information to be verified and the authority information to be verified, it is only necessary to verify whether the first hash value is the same as the sixth hash value to confirm whether the identity information to be verified and the authority information to be verified are respectively the same as the baseline identity information and the baseline authority information, thereby avoiding the process of identity and authority verification based on the complete identity information and complete authority information of the account, and verifying the identity and authority based on the first hash value and the sixth hash value, thereby avoiding the exposure of the baseline identity information and the baseline authority information, realizing effective protection of the identity information and authority information of the account, and effectively improving the security of identity and authority verification.

[0256] It should be noted that the method provided in the embodiment of the present application is not only applicable to the verification of identity authority for chatting in a chat room and the verification of identity authority when publishing announcements, but can also be applied to any identity authority verification scenario.

[0257] The present application also provides an identity authority verification device, see Figure 18 , the device comprises:

[0258] A first receiving module 1801 is configured to receive a permission verification request from a terminal, the permission verification request carrying a first hash value, the first hash value being obtained based on a second hash value of the identity information to be verified and a third hash value of the permission information to be verified, the identity information to be verified being part of the identity information of the currently logged-in account, and the permission information to be verified being part of the permission information of the account;

[0259] An acquisition module 1802 is configured to acquire a hash value tree for a generated account, wherein the hash value tree includes a first node, a second node, and a third node, wherein the third node is a parent node of the first and second nodes, and wherein the first node stores a fourth hash value corresponding to the baseline identity information, the second node stores a fifth hash value corresponding to the baseline authority information, and the third node stores a sixth hash value, wherein the sixth hash value is obtained based on the fourth and fifth hash values.

[0260] The verification module 1803 is configured to verify the identity authority of the terminal based on the first hash value and the sixth hash value.

[0261] Optionally, the verification module 1803 is configured to:

[0262] If the first hash value and the sixth hash value are the same, it means that the second hash value and the fourth hash value are the same and the third hash value and the fifth hash value are the same, and the permission verification result is determined to be verification passed;

[0263] If the first hash value and the sixth hash value are different, it means that the second hash value and the fourth hash value are different or the third hash value and the fifth hash value are different, and the permission verification result is determined to be verification failure.

[0264] Optionally, the hash value tree further includes a fourth node and a fifth node, the fifth node being a parent node of the third node and the fourth node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on the hash value of the identity information, and the fifth node storing an eighth hash value, the eighth hash value being obtained based on the sixth hash value and the seventh hash value;

[0265] Verification module 1803 is used to:

[0266] If the first hash value is the same as the sixth hash value, and the ninth hash value is the same as the eighth hash value, it is determined that the permission check result is verified to be passed, and the ninth hash value is obtained based on the first hash value and the seventh hash value;

[0267] If the first hash value is different from the sixth hash value, or the ninth hash value is different from the eighth hash value, it is determined that the permission verification result is verification failure.

[0268] Optionally, the permission verification request carries a hash value obtained by encrypting the first hash value based on the public key; and the apparatus further includes:

[0269] The first decryption module is used to decrypt the encrypted hash value based on the private key corresponding to the public key to obtain a first hash value.

[0270] Optionally, the device further comprises:

[0271] A signing module, configured to sign the sixth hash value based on a private key;

[0272] The first sending module is used to send a signature verification request to the terminal, where the signature verification request carries the public key, the sixth hash value, and the signed sixth hash value. The signature verification request is used to instruct the terminal to decrypt the signed sixth hash value based on the public key, and if the hash value obtained after decryption is the same as the sixth hash value, store the public key.

[0273] Optionally, the device further comprises:

[0274] A second receiving module is configured to receive an authorization request from a terminal, the authorization request carrying the baseline identity information and the baseline authority information;

[0275] a first determining module, configured to respectively determine a hash value of the reference identity information and a hash value of the reference authority information to obtain a fourth hash value and a fifth hash value;

[0276] a second determining module, configured to determine a sixth Hash value based on the fourth Hash value and the fifth Hash value;

[0277] The generating module is configured to generate a hash value tree based on the fourth hash value, the fifth hash value, and the sixth hash value.

[0278] Optionally, the hash value tree further includes a fourth node and a fifth node, the fifth node being a parent node of the fourth node and the third node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on a hash value of the identity information, the fifth node storing an eighth hash value, the eighth hash value being obtained based on the seventh hash value and the sixth hash value; the authorization request further carries identity information;

[0279] Generate modules, including:

[0280] a first determining unit, configured to determine a seventh Hash value based on the Hash value of the identity information;

[0281] a second determining unit, configured to determine an eighth Hash value based on the sixth Hash value and the seventh Hash value;

[0282] The generating unit is configured to generate a hash value tree based on the fourth hash value, the fifth hash value, the sixth hash value, the seventh hash value, and the eighth hash value.

[0283] Optionally, the first determining unit is configured to:

[0284] Obtaining a hash value of the identity information and a hash value of the current timestamp, and determining a seventh hash value based on the hash value of the identity information and the hash value of the current timestamp; or,

[0285] A hash value of the identity information is obtained, and the hash value of the identity information is determined as a seventh hash value.

[0286] Optionally, the authorization request carries the baseline identity information and the baseline authority information encrypted using a symmetric key; the apparatus further includes:

[0287] The second decryption module is used to decrypt the encrypted baseline identity information and baseline authority information based on the symmetric key to obtain the baseline identity information and baseline authority information.

[0288] Optionally, the first receiving module 1801 is configured to:

[0289] Receive the permission verification request forwarded by the application server, where the permission verification request is sent by the terminal to the application server.

[0290] Optionally, the device further comprises:

[0291] The third receiving module is used to receive an announcement publishing request from a terminal, where the announcement publishing request carries the announcement information of the current login account;

[0292] The second sending module is used to send the announcement information to the target group if the result of the permission verification is passed. The target group is the group where the current login account belongs.

[0293] Figure 19 The following is a block diagram of a terminal 1900 according to an exemplary embodiment of the present application. Terminal 1900 may be a portable mobile terminal, such as a smartphone, tablet computer, MP3 player (Moving Picture Experts Group Audio Layer III), MP4 player (Moving Picture Experts Group Audio Layer IV), laptop computer, or desktop computer. Terminal 1900 may also be referred to as user equipment, portable terminal, laptop terminal, desktop terminal, or other similar names.

[0294] Typically, the terminal 1900 includes a processor 1901 and a memory 1902 .

[0295] The processor 1901 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. The processor 1901 may be implemented in at least one hardware form of a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), or a PLA (Programmable Logic Array). The processor 1901 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1901 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1901 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0296] Memory 1902 may include one or more computer-readable storage media, which may be non-transitory. Memory 1902 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices and flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in memory 1902 is used to store at least one program code, which is executed by processor 1901 to implement the identity authority verification method provided in the method embodiment of the present application.

[0297] In some embodiments, terminal 1900 may optionally include a peripheral device interface 1903 and at least one peripheral device. The processor 1901, memory 1902, and peripheral device interface 1903 may be connected via a bus or signal lines. Each peripheral device may be connected to peripheral device interface 1903 via a bus, signal lines, or circuit boards. Specifically, the peripheral device may include at least one of a radio frequency circuit 1904, a display screen 1905, a camera assembly 1906, an audio circuit 1907, a positioning assembly 1908, and a power supply 1909.

[0298] The peripheral device interface 1903 can be used to connect at least one I / O (Input / Output)-related peripheral device to the processor 1901 and the memory 1902. In some embodiments, the processor 1901, the memory 1902, and the peripheral device interface 1903 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1901, the memory 1902, and the peripheral device interface 1903 can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0299] RF circuit 1904 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. RF circuit 1904 communicates with communication networks and other communication devices via electromagnetic signals. RF circuit 1904 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals into electrical signals. RF circuit 1904 may optionally include an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, and the like. RF circuit 1904 may communicate with other terminals via at least one wireless communication protocol. Such wireless communication protocols include, but are not limited to, the World Wide Web, metropolitan area networks, intranets, various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks, and / or WiFi (Wireless Fidelity) networks. In some embodiments, RF circuit 1904 may also include circuitry related to Near Field Communication (NFC), although this application does not limit this.

[0300] The display screen 1905 is used to display a UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 1905 is a touch screen display, the display screen 1905 also has the ability to collect touch signals on the surface or above the surface of the display screen 1905. The touch signal can be input as a control signal to the processor 1901 for processing. In this case, the display screen 1905 can also be used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, there can be one display screen 1905, which is set on the front panel of the terminal 1900; in other embodiments, there can be at least two display screens 1905, which are respectively set on different surfaces of the terminal 1900 or in a folding design; in other embodiments, the display screen 1905 can be a flexible display screen, which is set on the curved surface or folding surface of the terminal 1900. Even more, the display screen 1905 can be set to a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 1905 can be made of materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).

[0301] The camera assembly 1906 is used to capture images or videos. Optionally, the camera assembly 1906 includes a front camera and a rear camera. Typically, the front camera is set on the front panel of the terminal, and the rear camera is set on the back of the terminal. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth of field camera, a wide-angle camera, and a telephoto camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, the fusion of the main camera and the wide-angle camera to realize panoramic shooting and VR (Virtual Reality) shooting function or other fusion shooting functions. In some embodiments, the camera assembly 1906 may also include a flash. The flash can be a single-color temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.

[0302] The audio circuit 1907 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals that are input into the processor 1901 for processing, or input into the radio frequency circuit 1904 to achieve voice communication. For the purpose of stereo sound collection or noise reduction, there may be multiple microphones, each located in different parts of the terminal 1900. The microphone may also be an array microphone or an omnidirectional collection microphone. The speaker is used to convert electrical signals from the processor 1901 or the radio frequency circuit 1904 into sound waves. The speaker may be a traditional thin film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert electrical signals into sound waves audible to humans, but also convert electrical signals into sound waves inaudible to humans for purposes such as distance measurement. In some embodiments, the audio circuit 1907 may also include a headphone jack.

[0303] Positioning component 1908 is used to locate the current geographic location of terminal 1900 to implement navigation or LBS (Location Based Service). Positioning component 1908 can be a positioning component based on the US GPS (Global Positioning System), China's Beidou system, or Russia's Galileo system.

[0304] Power supply 1909 is used to power various components in terminal 1900. Power supply 1909 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery. When power supply 1909 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is charged via a wired line, while a wireless rechargeable battery is charged via a wireless coil. The rechargeable battery can also support fast charging technology.

[0305] In some embodiments, the terminal 1900 further includes one or more sensors 1910 , including but not limited to: an acceleration sensor 1911 , a gyroscope sensor 1912 , a pressure sensor 1913 , a fingerprint sensor 1914 , an optical sensor 1915 , and a proximity sensor 1916 .

[0306] The accelerometer 1911 can detect the magnitude of acceleration along the three coordinate axes of the coordinate system established by the terminal 1900. For example, the accelerometer 1911 can be used to detect the components of gravity acceleration along the three coordinate axes. The processor 1901 can control the display screen 1905 to display the user interface in a landscape or portrait view based on the gravity acceleration signal collected by the accelerometer 1911. The accelerometer 1911 can also be used to collect game or user motion data.

[0307] The gyroscope sensor 1912 can detect the orientation and rotation angle of the terminal 1900. It can work in conjunction with the accelerometer 1911 to collect the user's 3D movements on the terminal 1900. Based on the data collected by the gyroscope sensor 1912, the processor 1901 can implement the following functions: motion sensing (for example, changing the UI based on the user's tilt operation), image stabilization during shooting, game control, and inertial navigation.

[0308] The pressure sensor 1913 can be set on the side frame of the terminal 1900 and / or the lower layer of the display screen 1905. When the pressure sensor 1913 is set on the side frame of the terminal 1900, it can detect the user's grip signal of the terminal 1900, and the processor 1901 performs left and right hand recognition or shortcut operations based on the grip signal collected by the pressure sensor 1913. When the pressure sensor 1913 is set on the lower layer of the display screen 1905, the processor 1901 controls the operable controls on the UI interface based on the user's pressure operation on the display screen 1905. The operable controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.

[0309] The fingerprint sensor 1914 is used to collect the user's fingerprint. The processor 1901 identifies the user's identity based on the fingerprint collected by the fingerprint sensor 1914, or the fingerprint sensor 1914 identifies the user's identity based on the collected fingerprint. When the user's identity is recognized as a trusted identity, the processor 1901 authorizes the user to perform relevant sensitive operations, such as unlocking the screen, viewing encrypted information, downloading software, making payments, and changing settings. The fingerprint sensor 1914 can be set on the front, back, or side of the terminal 1900. When a physical button or manufacturer logo is provided on the terminal 1900, the fingerprint sensor 1914 can be integrated with the physical button or manufacturer logo.

[0310] Optical sensor 1915 is used to detect ambient light intensity. In one embodiment, processor 1901 can control the display brightness of display screen 1905 based on the ambient light intensity detected by optical sensor 1915. Specifically, when the ambient light intensity is high, the display brightness of display screen 1905 is increased; when the ambient light intensity is low, the display brightness of display screen 1905 is decreased. In another embodiment, processor 1901 can also dynamically adjust the shooting parameters of camera assembly 1906 based on the ambient light intensity detected by optical sensor 1915.

[0311] Proximity sensor 1916, also known as a distance sensor, is typically located on the front panel of terminal 1900. Proximity sensor 1916 is used to detect the distance between the user and the front of terminal 1900. In one embodiment, when proximity sensor 1916 detects that the distance between the user and the front of terminal 1900 is gradually decreasing, processor 1901 controls display screen 1905 to switch from the screen-on state to the screen-off state. When proximity sensor 1916 detects that the distance between the user and the front of terminal 1900 is gradually increasing, processor 1901 controls display screen 1905 to switch from the screen-off state to the screen-on state.

[0312] Those skilled in the art will understand that Figure 19 The structure shown in the figure does not constitute a limitation on the terminal 1900, and the terminal 1900 may include more or fewer components than shown in the figure, or combine certain components, or adopt a different component arrangement.

[0313] Figure 20 This is a block diagram of a server provided in an embodiment of the present application. The server 2000 may have relatively large differences due to different configurations or performances, and may include one or more processors (Central Processing Units, CPU) 2001 and one or more memories 2002, wherein the memories 2002 are used to store executable program codes, and the processors 2001 are configured to execute the above executable program codes to implement the identity authority verification methods provided in the above-mentioned various method embodiments. Of course, the server may also have components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output. The server may also include other components for implementing device functions, which will not be described in detail here.

[0314] In an exemplary embodiment, a storage medium including a program code is further provided, such as a memory 2002 including the program code. The program code can be executed by the processor 2001 of the server 2000 to complete the above-mentioned identity authority verification method. Optionally, the storage medium can be a non-transitory computer-readable storage medium, for example, a non-transitory computer-readable storage medium can be a ROM (Read-Only Memory), a RAM (Random Access Memory), a CD-ROM (Compact Disc Read-Only Memory), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0315] An embodiment of the present application also provides a computer-readable storage medium, in which at least one program code is stored. The at least one program code is loaded and executed by a processor to implement the identity authority verification method of any of the above implementation methods.

[0316] An embodiment of the present application also provides a computer program product, which includes at least one program code, and the at least one program code is loaded and executed by a processor to implement the identity authority verification method described in any of the above implementation methods.

[0317] In some embodiments, the computer program product involved in the embodiments of the present application can be deployed and executed on one server, or on multiple servers located in one location, or on multiple servers distributed in multiple locations and interconnected through a communication network. Multiple servers distributed in multiple locations and interconnected through a communication network can constitute a blockchain system.

[0318] An embodiment of the present application provides an identity and authority verification method. Since the sixth hash value of the parent node of the hash value tree in this method is generated based on the baseline identity information and baseline authority information of the account, and the baseline identity information and baseline authority information are respectively partial identity information and partial authority information of the account corresponding to the identity information to be verified and the authority information to be verified; in this way, when verifying the identity information to be verified and the authority information to be verified, it is only necessary to verify whether the first hash value is the same as the sixth hash value to confirm whether the identity information to be verified and the authority information to be verified are respectively the same as the baseline identity information and the baseline authority information, thereby avoiding the process of identity and authority verification based on the complete identity information and complete authority information of the account, and verifying the identity and authority based on the first hash value and the sixth hash value, thereby avoiding the exposure of the baseline identity information and the baseline authority information, realizing effective protection of the identity information and authority information of the account, and effectively improving the security of identity and authority verification.

[0319] The above are only optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for verifying identity and authority, characterized in that: The method comprises: Receiving a permission verification request from a terminal, the permission verification request carrying a first hash value, where the first hash value is obtained based on a second hash value of identity information to be verified and a third hash value of permission information to be verified, where the identity information to be verified is part of the identity information of the currently logged-in account, and the permission information to be verified is part of the permission information of the account; Obtaining a generated hash value tree for the account, the hash value tree including a first node, a second node, and a third node, the third node being a parent node of the first node and the second node, the first node storing a fourth hash value corresponding to baseline identity information, the second node storing a fifth hash value corresponding to baseline authority information, and the third node storing a sixth hash value, the sixth hash value being obtained based on the fourth hash value and the fifth hash value; Based on the first hash value and the sixth hash value, identity authority of the terminal is verified.

2. The method according to claim 1, characterized in that The verifying the identity authority of the terminal based on the first hash value and the sixth hash value includes: If the first hash value and the sixth hash value are the same, it means that the second hash value and the fourth hash value are the same and the third hash value and the fifth hash value are the same, and the permission verification result is determined to be verification passed; If the first Hash value and the sixth Hash value are different, it means that the second Hash value and the fourth Hash value are different or the third Hash value and the fifth Hash value are different, and the permission verification result is determined to be verification failure.

3. The method according to claim 1 or 2, characterized in that The hash value tree further includes a fourth node and a fifth node, the fifth node being a parent node of the third node and the fourth node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on the hash value of the identity information, and the fifth node storing an eighth hash value, the eighth hash value being obtained based on the sixth hash value and the seventh hash value; The verifying the identity authority of the terminal based on the first hash value and the sixth hash value includes: If the first hash value is the same as the sixth hash value, and the ninth hash value is the same as the eighth hash value, it is determined that the permission check result is verification passed, and the ninth hash value is obtained based on the first hash value and the seventh hash value; If the first hash value is different from the sixth hash value, or the ninth hash value is different from the eighth hash value, it is determined that the permission verification result is verification failure.

4. The method according to claim 1, wherein The permission verification request carries a hash value obtained by encrypting the first hash value based on the public key; Before verifying the identity authority of the terminal based on the first hash value and the sixth hash value, the method further includes: The encrypted hash value is decrypted based on the private key corresponding to the public key to obtain the first hash value.

5. The method according to claim 4, characterized in that The method further comprises: Signing the sixth hash value based on the private key; Sending a signature verification request to the terminal, the signature verification request carrying the public key, the sixth hash value, and the signed sixth hash value, the signature verification request being used to instruct the terminal to decrypt the signed sixth hash value based on the public key, and if the hash value obtained after decryption is the same as the sixth hash value, storing the public key.

6. The method according to claim 1, characterized in that The generation process of the hash value tree includes: receiving an authorization request from the terminal, the authorization request carrying the baseline identity information and the baseline authority information; Determine the hash value of the reference identity information and the hash value of the reference authority information respectively to obtain the fourth hash value and the fifth hash value; Determining the sixth hash value based on the fourth hash value and the fifth hash value; The hash value tree is generated based on the fourth hash value, the fifth hash value, and the sixth hash value.

7. The method according to claim 6, characterized in that The hash value tree also includes a fourth node and a fifth node, the fifth node being a parent node of the fourth node and the third node, the fourth node storing a seventh hash value, the seventh hash value being obtained based on the hash value of the identity information, and the fifth node storing an eighth hash value, the eighth hash value being obtained based on the seventh hash value and the sixth hash value; The authorization request also carries the identity information; Generating the hash value tree based on the fourth hash value, the fifth hash value, and the sixth hash value includes: Determining the seventh hash value based on the hash value of the identity information; determining the eighth hash value based on the sixth hash value and the seventh hash value; The hash value tree is generated based on the fourth hash value, the fifth hash value, the sixth hash value, the seventh hash value, and the eighth hash value.

8. The method according to claim 7, characterized in that The determining the seventh Hash value based on the Hash value of the identity information includes: Obtaining a hash value of the identity information and a hash value of the current timestamp, and determining the seventh hash value based on the hash value of the identity information and the hash value of the current timestamp; or, Obtain a hash value of the identity information, and determine the hash value of the identity information as the seventh hash value.

9. The method according to claim 6, characterized in that The authorization request carries the baseline identity information and the baseline authority information encrypted using a symmetric key; Before respectively determining the hash value of the reference identity information and the hash value of the reference authority information to obtain the fourth hash value and the fifth hash value, the method further includes: The encrypted reference identity information and reference authority information are decrypted based on the symmetric key to obtain the reference identity information and the reference authority information.

10. The method according to claim 1, characterized in that The receiving terminal's permission verification request includes: Receive a permission verification request forwarded by an application server, where the permission verification request is sent by the terminal to the application server.

11. The method according to claim 1, wherein The method further comprises: receiving an announcement publishing request from the terminal, wherein the announcement publishing request carries announcement information of the currently logged-in account; If the result of the permission verification is passed, the announcement information is sent to the target group, and the target group is the group where the current login account belongs.

12. An identity authority verification device, characterized in that: The device comprises: a first receiving module, configured to receive a permission verification request from a terminal, the permission verification request carrying a first hash value, the first hash value being obtained based on a second hash value of identity information to be verified and a third hash value of permission information to be verified, the identity information to be verified being part of the identity information of a currently logged-in account, and the permission information to be verified being part of the permission information of the account; an acquisition module, configured to acquire a generated hash value tree for the account, the hash value tree including a first node, a second node, and a third node, the third node being a parent node of the first node and the second node, the first node storing a fourth hash value corresponding to baseline identity information, the second node storing a fifth hash value corresponding to baseline authority information, and the third node storing a sixth hash value, the sixth hash value being obtained based on the fourth and fifth hash values; A verification module is used to verify the identity authority of the terminal based on the first hash value and the sixth hash value.

13. A server, characterized in that: The server includes one or more processors and one or more memories, and at least one program code is stored in the one or more memories. The at least one program code is loaded and executed by the one or more processors to implement the identity authority verification method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that The storage medium stores at least one program code, and the at least one program code is loaded and executed by the processor to implement the identity authority verification method according to any one of claims 1 to 11.

15. A computer program product, characterized in that The computer program product includes at least one program code, and the at least one program code is loaded and executed by a processor to implement the identity authority verification method according to any one of claims 1 to 11.

Images