A server access method, apparatus, system, and storage medium

Abstract

This invention discloses a server access method, apparatus, system, and storage medium, relating to the field of network security technology. The method is applied to an authentication server and includes: determining a first private identifier corresponding to a transmission identifier sent by a user terminal; determining first signature information based on the first private identifier, authentication time, and terminal identifier information sent by the user terminal; determining the user terminal's address information if the first signature information matches second signature information sent by the user terminal, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information; and configuring the user terminal's address information on a target server to enable the user terminal to access the target server. This technical solution ensures that only user terminals configured on the target server are allowed to access the target server, thereby improving the security of the target server.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a server access method, apparatus, system and storage medium. Background Technology

[0002] User terminals equipped with business applications can access business servers based on business requests. Business servers are generally deployed on the public internet. The normal operation of business servers requires ensuring that they are protected from attacks by illegal requests.

[0003] In existing technologies, security protection for business servers is achieved through protection systems such as WAF. Specifically, pre-defined security protection rules can be used to identify business requests and allow only business requests that conform to the security protection rules to access the business server.

[0004] In the process of realizing this invention, the inventors discovered at least the following technical problems in the prior art:

[0005] Identifying application requests based on security rules is inefficient and has a high error rate, making business servers vulnerable to attacks from unauthorized requests. Summary of the Invention

[0006] This invention provides a server access method, apparatus, system, and storage medium that allows only trusted business requests to access the target server, thereby improving the security of the target server.

[0007] In a first aspect, embodiments of the present invention provide a server access method applied to an authentication server, the method comprising:

[0008] Determine the first private identifier corresponding to the transmission identifier sent by the user terminal, and determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal;

[0009] If it is determined that the first signature information is consistent with the second signature information sent by the user terminal, the address information of the user terminal is determined, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information;

[0010] Configure the address information of the user terminal on the target server so that the user terminal has the ability to access the target server.

[0011] Secondly, embodiments of the present invention also provide a server access method, applied to a target server, the method comprising:

[0012] Receive the address information of the user terminal sent by the authentication server, and configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server;

[0013] The address information of the user terminal is broadcast to other servers in the server cluster to which the target server belongs, and the address information of the user terminal is configured on each of the other servers so that the user terminal has the ability to access each of the other servers.

[0014] Thirdly, embodiments of the present invention also provide a server access device configured on an authentication server, the device comprising:

[0015] The signature determination module is used to determine the first private identifier corresponding to the transmission identifier sent by the user terminal, and to determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal.

[0016] The address determination module is used to determine the address information of the user terminal when it is determined that the first signature information is consistent with the second signature information sent by the user terminal, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information;

[0017] The configuration module is used to configure the address information of the user terminal to the target server, so that the user terminal has the ability to access the target server.

[0018] Fourthly, embodiments of the present invention also provide a server access device configured on a target server, the device comprising:

[0019] The receiving module is used to receive the address information of the user terminal sent by the authentication server, and configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server.

[0020] The broadcast module is used to broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs, and to configure the address information of the user terminal on each of the other servers, so that the user terminal has the ability to access each of the other servers.

[0021] Fifthly, embodiments of the present invention also provide a server access system, including:

[0022] An authentication server is configured to determine a first private identifier corresponding to a transmission identifier sent by a user terminal, and to determine first signature information based on the first private identifier, authentication time, and terminal identifier information sent by the user terminal. If the first signature information matches the second signature information sent by the user terminal, the server determines the address information of the user terminal, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information. The server then configures the address information of the user terminal on a target server to enable the user terminal to access the target server.

[0023] The target server is used to receive the address information of the user terminal sent by the authentication server, configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server; broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs, and configure the address information of the user terminal on each of the other servers so that the user terminal has the ability to access each of the other servers.

[0024] In a sixth aspect, embodiments of the present invention also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the server access method as described in either the first or second aspect.

[0025] The embodiments of the above invention have the following advantages or beneficial effects:

[0026] This invention provides a server access method applied to an authentication server. The method includes: determining a first private identifier corresponding to a transmission identifier sent by a user terminal; determining first signature information based on the first private identifier, authentication time, and terminal identifier information sent by the user terminal; determining address information of the user terminal if the first signature information is consistent with second signature information sent by the user terminal, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information; and configuring the address information of the user terminal on a target server to enable the user terminal to access the target server. In the above technical solution, after receiving the transmission identifier and terminal identifier information sent by the user terminal, the authentication server can determine the first private identifier corresponding to the transmission identifier, and sign the authentication time and terminal identifier information based on the first private identifier information to determine the first signature information. The authentication server implements the signing of the authentication time and terminal identifier information, and compares the first signature information with the second signature information obtained by the user terminal signing the terminal identifier information and terminal information based on the second private identifier corresponding to the transmission identifier. Since the signature information includes time information, the identifier information of the current user logged into the client installed on the user terminal, and the terminal information corresponding to the user terminal and the client, if the first signature information and the second signature information are consistent, it can be determined that the user terminal with the client installed and the current user logged into the client can access the target server. Furthermore, the authentication server can determine the address information of the user terminal and send the user terminal's address information to the target server, causing the target server to configure the user terminal's address information in the access whitelist, further enabling the user terminal to access the target server. That is, the business requests sent by the user terminal are trusted business requests, realizing that only trusted business requests are allowed to access the target server, thus improving the security of the target server. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the structure of a server access system provided in an embodiment of the present invention;

[0028] Figure 2 A flowchart of a server access method provided in an embodiment of the present invention;

[0029] Figure 3 A flowchart illustrating another server access method provided in an embodiment of the present invention;

[0030] Figure 4 A flowchart illustrating yet another server access method provided in an embodiment of the present invention;

[0031] Figure 5A flowchart illustrating yet another server access method provided in an embodiment of the present invention;

[0032] Figure 6 A schematic flowchart illustrating a server access method provided in an embodiment of the present invention;

[0033] Figure 7 This is a schematic diagram of the structure of a server access device provided in an embodiment of the present invention;

[0034] Figure 8 This is a schematic diagram of another server access device provided in an embodiment of the present invention;

[0035] Figure 9 This is a schematic diagram of another server access system provided in an embodiment of the present invention;

[0036] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0037] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0038] Before discussing the exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of these operations can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but may also have additional steps not included in the figures. The process can correspond to a method, function, procedure, subroutine, subroutine, etc. Moreover, embodiments and features in the embodiments of the present invention can be combined with each other without conflict.

[0039] Business servers deployed on the public network are typically protected by security systems such as WAF. Specifically, pre-defined security rules can be used to identify business requests, filter out illegal requests that do not comply with the security rules, and only allow business requests that comply with the security rules to access the business server.

[0040] However, security protection rules often misjudge or miss business requests, leaving business servers vulnerable to unauthorized attacks. Furthermore, security protection rules cannot protect against DDoS and other high-volume attacks.

[0041] Therefore, this application proposes a server access method based on a server access system. Figure 1 This is a schematic diagram of the server access system provided in an embodiment of the present invention, such as... Figure 1 As shown, the server access system may include user terminals, authentication servers, and target servers, and the authentication servers and target servers may be deployed in the same server cluster.

[0042] The following will combine Figure 1 The server access system shown provides a detailed description of the server access method proposed in this application.

[0043] Figure 2 This is a flowchart illustrating a server access method provided by an embodiment of the present invention. This embodiment can be applied to an authentication server and is suitable for situations where only trusted business requests are allowed to access the target server. The method can be executed by a server access device, which can be implemented in software and / or hardware. Optionally, the server access device can be configured within the authentication server. Figure 2 The method specifically includes the following steps:

[0044] Step 210: Determine the first private identifier corresponding to the transmission identifier sent by the user terminal, and determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal.

[0045] The user terminal is equipped with a client application, which can be a business application.

[0046] When the client installed on a user terminal starts up, in order to determine whether the user terminal, which has the client installed and the current user logged in within the client, can access the target server, the user terminal can send a transmission identifier and a terminal identifier to the authentication server based on the client. The client stores the identifier information of the current user logged into the client, which includes a transmission identifier and a private identifier. The transmission identifier can be transmitted over the network, while the private identifier can only be calculated and cannot be transmitted over the network. The terminal identifier can be understood as a unique identifier for the user terminal with the client installed.

[0047] Specifically, after receiving the transmission identifier and terminal identifier information sent by the user terminal, the authentication server can look up the first private identifier corresponding to the transmission identifier in a first correspondence table that stores transmission identifiers and private identifiers. Then, based on the first private identifier, the terminal identifier information, and the authentication time, the server determines the first signature information. Specifically, the server identifier information and the authentication time can be signed based on the first private identifier to obtain the first signature information. Therefore, the private identifier stored in the client installed on the user terminal can be set as the second private identifier.

[0048] In this embodiment of the invention, the authentication server can receive transmission identifier and terminal identifier information sent by the user terminal, determine the first private identifier corresponding to the transmission identifier, and sign the authentication time and terminal identifier information based on the first private identifier information to determine the first signature information, thereby realizing the signing of the authentication time and terminal identifier information in the authentication server.

[0049] Step 220: If it is determined that the first signature information is consistent with the second signature information sent by the user terminal, determine the address information of the user terminal.

[0050] The second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information.

[0051] While sending the transmission identifier and terminal identifier information to the authentication server based on the client, the user terminal can also send the second signature information determined by the client to the authentication server. It can be understood that the second signature information is obtained by the client signing the terminal time and terminal identifier information based on the second private identifier corresponding to the transmission identifier.

[0052] Specifically, after the authentication server obtains the first signature information by signing the authentication time and terminal identification information based on the first private identifier, it can compare the first signature information and the second signature information. If the first signature information and the second signature information are consistent, it can be determined that the user terminal with the client installed and the current user logged in on the client has the ability to access the target server.

[0053] Furthermore, the authentication server can determine the user terminal's address information, i.e., obtain the user terminal's network address. This address information is used to configure the target server, enabling service requests issued by the user terminal to access the target server.

[0054] In this embodiment of the invention, when the authentication server determines that the first signature information is consistent with the second signature information sent by the user terminal, it can determine that the user terminal with the client installed and the current user logged in on the client can access the target server. Then, the authentication server can determine the address information of the user terminal. The address information of the user terminal is used to configure the target server and provide a data basis for configuring the target server.

[0055] Step 230: Configure the address information of the user terminal in the target server so that the user terminal has the ability to access the target server.

[0056] Specifically, the authentication server can configure the user terminal's address information in the target server's access whitelist, enabling the user terminal to access the target server. In other words, service requests sent by the user terminal can access the target server.

[0057] Therefore, service requests sent by user terminals can be identified as trusted service requests to ensure that only trusted service requests are allowed to access the target server.

[0058] In this embodiment of the invention, the authentication server sends the address information of the user terminal to the target server, so that the target server configures the address information of the user terminal in the access whitelist, thereby enabling the user terminal to send allowed service requests to access the target server, thus realizing that only trusted service requests are allowed to access the target server.

[0059] The server access method provided in this embodiment of the invention includes: determining a first private identifier corresponding to a transmission identifier sent by a user terminal; determining first signature information based on the first private identifier, authentication time, and terminal identifier information sent by the user terminal; determining address information of the user terminal if the first signature information is consistent with second signature information sent by the user terminal, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information; and configuring the address information of the user terminal on a target server to enable the user terminal to access the target server. In the above technical solution, after receiving the transmission identifier and terminal identifier information sent by the user terminal, the authentication server can determine the first private identifier corresponding to the transmission identifier, and sign the authentication time and terminal identifier information based on the first private identifier information to determine the first signature information. The authentication server implements the signing of the authentication time and terminal identifier information, and compares the first signature information with the second signature information obtained by the user terminal signing the terminal identifier information and terminal time based on the second private identifier corresponding to the transmission identifier. Since the signature information includes time information, the identifier information of the current user logged into the client installed on the user terminal, and the terminal information corresponding to the user terminal and the client, if the first signature information and the second signature information are consistent, it can be determined that the user terminal with the client installed and the current user logged into the client can access the target server. Furthermore, the authentication server can determine the address information of the user terminal and send the user terminal's address information to the target server, causing the target server to configure the user terminal's address information in the access whitelist, further enabling the user terminal to access the target server. That is, the business request issued by the user terminal is a trusted business request, and trusted business requests can access the target server, thus achieving the goal of only allowing trusted business requests to access the target server and improving the security of the target server.

[0060] Figure 3 This is a flowchart illustrating another server access method provided by an embodiment of the present invention. This embodiment is applicable to authentication servers and is suitable for situations where only trusted business requests are allowed to access the target server. Based on the above embodiments, this embodiment adds the following: "The transmission identifier, the terminal identifier information, and the second signature information are packaged by the terminal device into authentication information and sent to the authentication server at preset intervals." and "The second signature information is determined by the user terminal based on the second private identifier, the terminal time, and the terminal identifier information after determining the terminal identifier information based on the second private identifier, the terminal time, and the terminal identifier information, wherein the terminal information includes terminal software information and terminal hardware information." Explanations of terms identical or corresponding to those in the above embodiments are not repeated here. See also... Figure 3 The server access method provided in this embodiment of the invention includes:

[0061] Step 310: Determine the first private identifier corresponding to the transmission identifier sent by the user terminal.

[0062] The authentication server stores the transmission identifier and the privacy identifier in the form of a first correspondence table.

[0063] Specifically, after receiving the transmission identifier sent by the user terminal, the authentication server can look up the transmission identifier in the first correspondence table to determine the first private identifier corresponding to the transmission identifier.

[0064] In this embodiment of the invention, a first private identifier corresponding to a transmission identifier is determined in the authentication server.

[0065] Step 320: Determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal.

[0066] In one implementation, step 320 may specifically include:

[0067] The authentication time and the terminal identification information are signed based on the first private identifier to obtain the first signature information.

[0068] The authentication time can be understood as the current time of the authentication server. The terminal identification information is determined by the client installed on the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal information. The client installed on the user terminal has an extension program deployed within it to determine the terminal identification information. When the client starts, the extension program can start simultaneously, obtaining the identification information, terminal information, and terminal time of the currently logged-in user. The identification information can be understood as a user identity identifier, which includes a corresponding transmission identifier and a private identifier. The transmission identifier can be transmitted over the network, while the private identifier can only be calculated and cannot be transmitted over the network. The terminal information includes terminal hardware information and terminal software information. Terminal hardware information includes the user terminal's device type, operating system version, device specifications, device language, etc., while terminal software information includes the client version information, etc. The terminal time can be understood as the current time of the user terminal. After obtaining the identification information, terminal information, and terminal time, the extension program can sign the terminal information and terminal time based on the private identifier (i.e., the second private identifier) ​​in the identification information to obtain the terminal identification information. Specifically, the second private identifier can be used as the key of the HMAC algorithm to sign the terminal information and the terminal time to obtain the terminal identifier information.

[0069] In practical applications, terminal identification information can be determined based on Formula 1.

[0070] Fingerprint = HMAC(key = SecretKey2, terminal information, terminal time) Formula 1 Wherein, Fingerprint represents terminal identification information, and SecretKey2 represents the second private identifier.

[0071] It should be noted that the terminal identification information is a unique identifier for the user terminal that has the client installed. Therefore, the user terminal can send the transmission identifier and terminal identification information to the authentication server based on the client.

[0072] After receiving the transmission identifier and terminal identifier information sent by the user terminal, the authentication server can query the first correspondence table to determine the first private identifier corresponding to the transmission identifier. Based on the first private identifier, the terminal identifier information and authentication time are signed to obtain the first signature information. Specifically, the first private identifier can be used as the key for the HMAC algorithm to sign the terminal identifier information and authentication time, thus obtaining the first signature information.

[0073] In practical applications, the first signature information can be determined based on Formula 2.

[0074] First signature information = HMAC(key = SecretKey1, Fingerprint, authentication time) Formula 2 Where, SecretKey1 represents the first private identifier.

[0075] In this embodiment of the invention, the authentication server performs a signature based on the first private identifier information on the authentication time and the terminal identifier information to obtain the first signature information.

[0076] Step 330: If it is determined that the first signature information is consistent with the second signature information sent by the user terminal, determine the address information of the user terminal.

[0077] The second signature information is determined by the user terminal after determining the terminal identification information based on the second private identifier, the terminal time, and the terminal identification information. The terminal information includes terminal software information and terminal hardware information.

[0078] As mentioned earlier, the client installed on the user terminal can use the second private identifier as the key for the HMAC algorithm to sign the terminal information and the terminal time to obtain the terminal identification information. Furthermore, the client installed on the user terminal can also use the second private identifier as the key for the HMAC algorithm to sign the terminal identification information and the terminal time to obtain the second signature information.

[0079] In practical applications, the first signature information can be determined based on Formula 3.

[0080] Second signature information = HMAC(key = SecretKey2, Fingerprint, Terminal time) Formula 3

[0081] Of course, while sending the transmission identifier and terminal identifier information to the authentication server based on the client, the user terminal can also send the second signature information to the authentication server.

[0082] Specifically, after the authentication server obtains the first signature information by signing the authentication time and terminal identification information based on the first private identifier, it can compare the first signature information and the second signature information. Since the signature information includes time information, the identification information of the current user who is logged into the client installed on the user terminal, and the terminal information corresponding to the user terminal and the client, if the first signature information and the second signature information are consistent, it can be determined that the user terminal with the client installed and the current user logged into the client can access the target server.

[0083] Furthermore, the authentication server can determine the user terminal's address information, specifically by obtaining the user terminal's network address using the peer address API (getpeername) in the network connection. This user terminal's address information is then used to configure the target server, ensuring that business requests from the user terminal can access the target server.

[0084] In this embodiment of the invention, when the authentication server determines that the first signature information and the second signature information are consistent, it can determine that the user terminal with the client installed and the current user logged in on the client can access the target server. Then, the authentication server can determine the address information of the user terminal. The address information of the user terminal is used to configure the target server and provide a data basis for configuring the target server.

[0085] Step 340: Configure the address information of the user terminal on the target server so that the user terminal has the ability to access the target server.

[0086] In one implementation, configuring the address information of the user terminal on the target server includes:

[0087] The address information of the user terminal is sent to the target server so that the target server configures the address information of the user terminal in the target server's access whitelist.

[0088] Specifically, the authentication server can send the user terminal's address information to the target server, enabling the target server to add the user terminal's address information to its access whitelist, thus allowing the user terminal to access the target server. In other words, it can determine that the service request issued by the user terminal is a trusted service request, and trusted service requests are allowed to access the target server, ensuring that only trusted service requests are permitted to access the target server.

[0089] At this point, a trusted business request initiated by a user terminal that has a client installed and the current user logged in on the client can be authenticated by the target server's firewall and thus access the target server.

[0090] It should be noted that the user terminal can send the transmission identifier, terminal identifier information, and second signature information as authentication information to the authentication server at preset intervals to ensure the real-time nature of the authentication information. The preset interval can be set according to actual needs; for example, it can be set to 10 seconds.

[0091] If the authentication server determines that the first signature information matches the second signature information, it can confirm that the user terminal has passed authentication. Authenticated user terminals can access the target server, while unauthenticated user terminals will be isolated by the target server's firewall, making the target server invisible on the network and avoiding any type of attack on the Internet.

[0092] As described in the previous embodiment, the authentication server sends the address information of the user terminal to the target server, so that the target server configures the address information of the user terminal in the access whitelist, and further enables the allowed business requests issued by the user terminal to access the target server, thereby realizing that only trusted business requests are allowed to access the target server.

[0093] The server access method provided in this embodiment of the invention includes: determining a first private identifier corresponding to a transmission identifier sent by a user terminal; signing the authentication time and the terminal identifier information based on the first private identifier to obtain first signature information; determining the address information of the user terminal when the first signature information is consistent with the second signature information sent by the user terminal, wherein the second signature information is determined by the user terminal based on the second private identifier, the terminal time, and the terminal identifier information after determining the terminal identifier information based on the second private identifier, the terminal time, and the terminal identifier information, and the terminal information includes terminal software information and terminal hardware information; and sending the address information of the user terminal to the target server so that the target server configures the address information of the user terminal in the target server's access whitelist, thereby enabling the user terminal to access the target server. In the above technical solution, after the authentication server receives the transmission identifier and terminal identifier information sent by the user terminal, it can determine the first private identifier corresponding to the transmission identifier, and sign the authentication time and terminal identifier information based on the first private identifier information to determine the first signature information. The authentication server then implements the signing of the authentication time and terminal identifier information based on the first private identifier, and compares the first signature information with the second signature information obtained by the user terminal signing the terminal identifier information and terminal information based on the second private identifier corresponding to the transmission identifier. Since the signature information includes time information and the client information installed on the user terminal... The authentication server obtains the current user's identification information and the terminal information corresponding to the user terminal and the client. Therefore, if the first signature information and the second signature information are consistent, it can be determined that the user terminal with the client installed and the current user logged in on the client can access the target server. Then, the authentication server can determine the address information of the user terminal and send the address information of the user terminal to the target server, so that the target server configures the address information of the user terminal in the access whitelist, further enabling the user terminal to access the target server. That is, the business request issued by the user terminal is a trusted business request, realizing that only trusted business requests are allowed to access the target server, thus improving the security of the target server.

[0094] Figure 4 This is a flowchart illustrating another server access method provided by an embodiment of the present invention. This embodiment can be applied to a target server and is suitable for situations where only trusted business requests are allowed to access the target server. The method can be executed by a server access device, which can be implemented in software and / or hardware. Optionally, the server access device can be configured within the server. Figure 4 The method specifically includes the following steps:

[0095] Step 410: Receive the address information of the user terminal sent by the authentication server, and configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server.

[0096] The target server can be understood as a business server that has deployed business systems, which can be operational systems.

[0097] Specifically, the target server initially operates in whitelist mode, meaning access from all network addresses is disabled by default. After receiving the user terminal's address information from the authentication server, the target server can add that address to its access whitelist. At this point, user terminals with a client installed and logged into that client can access the target server.

[0098] In this embodiment of the invention, after receiving the address information of the user terminal sent by the authentication server, the target server can configure the address information of the user terminal in its access whitelist, so that the user terminal can access the target server.

[0099] Step 420: Broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs, and configure the address information of the user terminal on each of the other servers so that the user terminal has the ability to access each of the other servers.

[0100] The target server can be understood as any server deployed in a server cluster. Each server in the cluster has broadcast and subscription capabilities. After receiving the user terminal's address information from the authentication server, any server can configure the user terminal's address information on other servers. Other servers can then add the user terminal's address information to their access whitelist, allowing the user terminal to access any server in the cluster. Furthermore, when a large number of business requests access the target server, any server in the cluster can receive these requests, improving business processing efficiency.

[0101] In this embodiment of the invention, after the target server receives the address information of the user terminal sent by the authentication server, it can broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs. Other servers can also add the address information of the user terminal to their access whitelist, so that the user terminal can access any server in the server cluster, thereby improving business processing efficiency.

[0102] The server access method provided in this invention includes: receiving address information of a user terminal sent by an authentication server; configuring the address information of the user terminal in an access whitelist of a target server, thereby enabling the user terminal to access the target server; broadcasting the address information of the user terminal to other servers in the server cluster to which the target server belongs, and configuring the address information of the user terminal in each of the other servers, thereby enabling the user terminal to access each of the other servers. In this technical solution, after receiving the address information of the user terminal sent by the authentication server, the target server can configure the address information of the user terminal in its access whitelist, allowing the user terminal to access the target server. The target server can also broadcast the address information of the user terminal to other servers in the server cluster to which it belongs, so that the other servers also add the address information of the user terminal to their access whitelists, enabling the user terminal to access any server in the server cluster, thus improving business processing efficiency.

[0103] Figure 5 This is a flowchart illustrating another server access method provided by an embodiment of the present invention. This embodiment is applicable to target servers and is suitable for situations where only trusted business requests are allowed to access the target server. Based on the above embodiments, this embodiment adds the following: "If the address information of the user terminal is not received again within the access time, delete the address information of the user terminal from the access whitelist." and "If it is determined that the current time meets the access time requirement, allow the user terminal to access the target server; if it is determined that the current time does not meet the access time requirement, prohibit the user terminal from accessing the target server." Explanations of terms that are the same as or corresponding to those in the above embodiments are not repeated here. See also... Figure 5 The server access method provided in this embodiment of the invention includes:

[0104] Step 510: Receive the address information of the user terminal sent by the authentication server, and configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server.

[0105] In one implementation, configuring the address information of the user terminal in the access whitelist of the target server includes:

[0106] Determine whether the access whitelist contains the address information of the user terminal; if the access whitelist does not contain the address information of the user terminal, add the address information of the user terminal to the access whitelist and set an access time for the address information of the user terminal; if the access whitelist contains the address information of the user terminal, extend the access time of the address information of the user terminal.

[0107] Specifically, after receiving the user terminal's address information from the authentication server, the target server can configure the user terminal's address information in its access whitelist. This can be done via firewall commands. Specifically, it can be determined whether the target server's access whitelist contains the received user terminal's address information. If it does not, the received address information can be added to the whitelist, and an access time limit can be set to restrict the user terminal's access to the target server. The access time can be set according to actual needs; for example, it can be set to 30 seconds, meaning that within 30 seconds of the target server receiving the user terminal's address information, the user terminal can access the target server based on business requests. If the target server's access whitelist contains the received user terminal's address information, the access time corresponding to the address information in the whitelist can be extended based on the access time limit. For example, if the access time is 30 seconds, the access time corresponding to the address information in the whitelist can be extended by 30 seconds.

[0108] Additionally, if the address information of the user terminal is not received again within the access period, the address information of the user terminal is deleted from the access whitelist.

[0109] As described in the aforementioned embodiment, the user terminal sends authentication information to the authentication server every 10 seconds, meaning the authentication server receives authentication information every 10 seconds. After confirming that the user terminal has passed authentication and possesses the capability to access the target server, the server sends the user terminal's address information to the target server. Initially, the target server uses the iptables command to set itself to whitelist mode, prohibiting all network addresses from accessing the target server. Upon receiving the user terminal's address information from the authentication server, the target server uses the ipset command to create a set of IP addresses as an access whitelist. If the whitelist does not contain the user terminal's address information, the server adds the user terminal's address information to the whitelist and sets a 30-second access timeout for that address. If the whitelist does contain the user terminal's address information, the access timeout is extended by 30 seconds. To ensure that all addresses in the whitelist meet the 30-second timeout requirement, the access time of each address in the whitelist can be monitored. If an access timeout occurs, the expired address information is removed from the whitelist.

[0110] In this embodiment of the invention, after receiving the address information of the user terminal sent by the authentication server, the target server can configure the address information of the user terminal in its access whitelist, so that the user terminal can access the target server. The access time is set for each address in the access whitelist, which ensures the timeliness of the user terminal's access to the target server and further guarantees the security of the target server.

[0111] Step 520: If the current time meets the access time requirement, allow the user terminal to access the target server; if the current time does not meet the access time requirement, prohibit the user terminal from accessing the target server.

[0112] Specifically, if the target server determines that the access time corresponding to the user terminal's address information has not yet returned to zero (meaning the current time is still within the access time specified by the user terminal's address information), the target server may allow the user terminal to access the target server. If the target server determines that the access time corresponding to the user terminal's address information has already returned to zero (meaning the current time has exceeded the access time specified by the user terminal's address information), the target server may prohibit the user terminal from accessing the target server. This setting ensures that the user terminal can only access the target server within the specified access time. Since the access time is determined by the time the target server receives the user terminal's address information, it further ensures the real-time nature of the user terminal's access to the target server.

[0113] In this embodiment of the invention, the time for a user terminal to access the target server is limited by the current time and the access time. That is, the user terminal can only access the target server within the access time, which further ensures the security of the target server.

[0114] Step 530: Broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs, and configure the address information of the user terminal on each of the other servers so that the user terminal has the ability to access each of the other servers.

[0115] As mentioned earlier, the target server can be understood as any server deployed in a server cluster. Each server in the cluster has broadcast and subscription capabilities. After receiving the user terminal's address information from the authentication server, any server broadcasts this address information to other business servers, thus configuring the user terminal's address information on each of the other servers. Other servers can then add the user terminal's address information to their access whitelist, allowing the user terminal to access any server in the server cluster. Furthermore, when a large number of business requests access the target server, any server in the cluster can receive these requests, improving business processing efficiency.

[0116] Additionally, it should be noted that the authentication server can be either an external server or an internal server within the server cluster. When the authentication server is an internal server, it only has authentication functionality and does not have broadcast or subscription capabilities.

[0117] In this embodiment of the invention, after the target server receives the address information of the user terminal sent by the authentication server, it can broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs. Other servers can also add the address information of the user terminal to their access whitelist, so that the user terminal can access any server in the server cluster, thereby improving business processing efficiency.

[0118] The server access method provided in this embodiment of the invention includes: receiving address information of a user terminal sent by an authentication server; determining whether the address information of the user terminal is included in an access whitelist; if the address information of the user terminal is not included in the access whitelist, adding the address information of the user terminal to the access whitelist and setting an access time for the address information of the user terminal; if the address information of the user terminal is included in the access whitelist, extending the access time of the address information of the user terminal to enable the user terminal to access the target server; if the address information of the user terminal is not received again within the access time, deleting the address information of the user terminal from the access whitelist; if the current time satisfies the access time, allowing the user terminal to access the target server; if the current time does not satisfy the access time, prohibiting the user terminal from accessing the target server; broadcasting the address information of the user terminal to other servers in the server cluster to which the target server belongs, and configuring the address information of the user terminal on each of the other servers to enable the user terminal to access each of the other servers. The above technical solution allows the target server to configure the user terminal's address information in its access whitelist after receiving it from the authentication server. This enables the user terminal to access the target server. The target server can also set access times for each address in the whitelist. If the current time meets the access time requirement, the target server allows the user terminal to access the target server; otherwise, it prohibits access. By limiting the user terminal's access to the target server through the current time and access time, the security of the target server is further ensured. Furthermore, the target server can broadcast the user terminal's address information to other servers in its server cluster, allowing these servers to also add the user terminal's address information to their access whitelists. This enables the user terminal to access any server in the server cluster, improving business processing efficiency.

[0119] Figure 6 This is a flowchart illustrating a server access method provided by an embodiment of the present invention. This embodiment is applicable to situations where only trusted business requests are allowed to access the target server. Based on the above embodiments, this embodiment mainly illustrates the interaction process between the user terminal, the authentication server, and the target server in the server access method. Figure 6 The method specifically includes the following steps:

[0120] Step 610: The user terminal obtains the current user's identification information, terminal information, and terminal time.

[0121] Step 611: The user terminal signs the terminal information and the terminal time based on the second private identifier in the identifier information to obtain the terminal identifier information.

[0122] Step 612: The user terminal signs the terminal identification information and the terminal time based on the second private identifier to obtain the second signature information.

[0123] Step 613: The user terminal packages the transmission identifier, terminal identifier, and second signature information from the identification information into authentication information and sends it to the authentication server.

[0124] Step 614: The authentication server determines the first private identifier corresponding to the transmission identifier.

[0125] Step 615: The authentication server signs the terminal identification information and authentication time based on the first private identifier to obtain the first signature information.

[0126] Step 616: The authentication server determines whether the first signature information and the second signature information are consistent.

[0127] If the first signature information and the second signature information are found to be consistent, proceed to step 617; otherwise, proceed to step 618.

[0128] Step 617: The authentication server determines that the user terminal with the client installed and the current user logged in on the client has passed the authentication and determines the address information of the user terminal.

[0129] Step 619 is executed after step 617.

[0130] Step 618: The authentication server determines that the user terminal with the client installed and the current user logged in on the client has failed authentication and prohibits the user terminal from accessing the target server.

[0131] Step 619: The authentication server sends the user terminal's address information to the target server.

[0132] Step 620: The target server determines whether the access whitelist contains the address information of the user terminal.

[0133] If the target server determines that the access whitelist does not contain the user terminal's address information, proceed to step 621; otherwise, proceed to step 622.

[0134] Step 621: The target server adds the user terminal's address information to the access whitelist and sets the access time for the user terminal's address information.

[0135] Step 622: The target server extends the access time of the user terminal's address information.

[0136] Step 623: If the target server determines that the current time meets the access time requirement, it allows the user terminal to access the target server; if it determines that the current time does not meet the access time requirement, it prohibits the user terminal from accessing the target server.

[0137] Step 624: The target server broadcasts the user terminal's address information to other servers in the server cluster to which the target server belongs, and configures the user terminal's address information on each of the other servers.

[0138] Other servers can add the user terminal's address information to the access whitelist, enabling the user terminal to access any server in the server cluster.

[0139] The embodiments of the present invention have the corresponding beneficial effects of the server access method.

[0140] Figure 7 This is a schematic diagram of a server access device provided in an embodiment of the present invention. This server access device can be configured in an authentication server. This device belongs to the same inventive concept as the server access methods in the above embodiments. Details not described in detail in the embodiments of the server access device can be found in the embodiments of the above server access methods.

[0141] The specific structure of the server access device is as follows: Figure 7 As shown, it includes:

[0142] The signature determination module 710 is used to determine the first private identifier corresponding to the transmission identifier sent by the user terminal, and to determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal.

[0143] Address determination module 720 is used to determine the address information of the user terminal when it is determined that the first signature information is consistent with the second signature information sent by the user terminal, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information;

[0144] The configuration module 730 is used to configure the address information of the user terminal to the target server, so that the user terminal has the ability to access the target server.

[0145] In one embodiment, the transmission identifier, the terminal identifier information, and the second signature information are packaged by the terminal device into authentication information and sent to the authentication server at preset intervals.

[0146] Based on the above embodiments, the signature determination module 710 is specifically used for:

[0147] Determine the first private identifier corresponding to the transmission identifier sent by the user terminal; sign the authentication time and the terminal identifier information based on the first private identifier to obtain the first signature information.

[0148] Optionally, the second signature information is determined by the user terminal based on the second private identifier, the terminal time, and the terminal identifier information after determining the terminal identifier information based on the second private identifier, the terminal time, and the terminal identifier information. The terminal information includes terminal software information and terminal hardware information.

[0149] Based on the above embodiments, the configuration module 730 is specifically used for:

[0150] The address information of the user terminal is sent to the target server so that the target server configures the address information of the user terminal in the target server's access whitelist, thereby enabling the user terminal to access the target server.

[0151] The server access device provided in the embodiments of the present invention can execute the server access method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the server access method.

[0152] It is worth noting that in the above embodiments of the server access device, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0153] Figure 8 This is a schematic diagram of another server access device provided in an embodiment of the present invention. This server access device can be configured in a target server. This device belongs to the same inventive concept as the server access methods in the above embodiments. Details not described in detail in the embodiments of the server access device can be found in the embodiments of the above server access methods.

[0154] The specific structure of the server access device is as follows: Figure 8 As shown, it includes:

[0155] The receiving module 810 is used to receive the address information of the user terminal sent by the authentication server, and configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server.

[0156] The broadcast module 820 is used to broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs, and to configure the address information of the user terminal on each of the other servers, so that the user terminal has the ability to access each of the other servers.

[0157] Based on the above embodiments, the receiving module 810 is specifically used for:

[0158] The system receives the address information of the user terminal sent by the authentication server; determines whether the address information of the user terminal is included in the access whitelist; if the access whitelist does not contain the address information of the user terminal, the system adds the address information of the user terminal to the access whitelist and sets an access time for the address information of the user terminal; if the access whitelist contains the address information of the user terminal, the system extends the access time for the address information of the user terminal.

[0159] In one embodiment, the receiving module 810 is further configured to:

[0160] If the address information of the user terminal is not received again within the access period, the address information of the user terminal is deleted from the access whitelist.

[0161] Based on the above embodiments, the device further includes:

[0162] An execution module is configured to allow the user terminal to access the target server if it is determined that the current time meets the access time requirement, and to prohibit the user terminal from accessing the target server if it is determined that the current time does not meet the access time requirement.

[0163] The server access device provided in the embodiments of the present invention can execute the server access method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the server access method.

[0164] It is worth noting that in the above embodiments of the server access device, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0165] Figure 9 This is a schematic diagram of another server access system provided in an embodiment of the present invention. This system belongs to the same inventive concept as the server access methods in the above embodiments. For details not described in detail in the embodiments of the server access system, please refer to the embodiments of the above server access methods.

[0166] The specific structure of the server access system is as follows: Figure 9 As shown, it includes: authentication server 910 and target server 920.

[0167] Authentication server 910 is used to determine a first private identifier corresponding to a transmission identifier sent by a user terminal, and to determine first signature information based on the first private identifier, authentication time, and terminal identifier information sent by the user terminal; if the first signature information is determined to be consistent with second signature information sent by the user terminal, the address information of the user terminal is determined, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information; and the address information of the user terminal is configured on a target server to enable the user terminal to access the target server.

[0168] The target server 920 is used to receive the address information of the user terminal sent by the authentication server, configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server; broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs, and configure the address information of the user terminal in each of the other servers so that the user terminal has the ability to access each of the other servers.

[0169] The server access system provided in this embodiment of the invention can execute the server access method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects for executing the server access method.

[0170] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Figure 10 A block diagram of an exemplary electronic device 10 suitable for implementing embodiments of the present invention is shown. Figure 10 The electronic device 10 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0171] like Figure 10 As shown, the electronic device 10 is represented in the form of a general-purpose computing electronic device. The components of the electronic device 10 may include, but are not limited to: one or more processors or processing units 16, system memory 28, and bus 18 connecting different system components (including system memory 28 and processing unit 16).

[0172] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0173] Electronic device 10 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by electronic device 10, including volatile and non-volatile media, removable and non-removable media.

[0174] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Electronic device 10 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (… Figure 10 Not shown; usually referred to as a "hard drive"). Although Figure 10 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. System memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of the present invention.

[0175] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of the present invention.

[0176] Electronic device 10 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), and with one or more devices that enable a user to interact with the electronic device 10, and / or with any device that enables the electronic device 10 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed through input / output (I / O) interface 22. Furthermore, electronic device 10 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 20. Figure 10 As shown, network adapter 20 communicates with other modules of electronic device 10 via bus 18. It should be understood that, although... Figure 10 As not shown, other hardware and / or software modules may be used in conjunction with electronic device 10, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0177] Processing unit 16 executes various functional applications and page displays by running programs stored in system memory 28, such as implementing the server access method provided in this embodiment.

[0178] When this method is applied to an authentication server, the method includes:

[0179] Determine the first private identifier corresponding to the transmission identifier sent by the user terminal, and determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal;

[0180] If it is determined that the first signature information is consistent with the second signature information sent by the user terminal, the address information of the user terminal is determined, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information;

[0181] Configure the address information of the user terminal on the target server so that the user terminal has the ability to access the target server.

[0182] When this method is applied to a target server, the method includes:

[0183] Receive the address information of the user terminal sent by the authentication server, and configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server;

[0184] The address information of the user terminal is broadcast to other servers in the server cluster to which the target server belongs, and the address information of the user terminal is configured on each of the other servers so that the user terminal has the ability to access each of the other servers.

[0185] Of course, those skilled in the art will understand that the processor can also implement the technical solutions of the server access method provided in any embodiment of the present invention.

[0186] This invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements, for example, the server access method provided in this invention.

[0187] When this method is applied to an authentication server, the method includes:

[0188] Determine the first private identifier corresponding to the transmission identifier sent by the user terminal, and determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal;

[0189] If it is determined that the first signature information is consistent with the second signature information sent by the user terminal, the address information of the user terminal is determined, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information;

[0190] Configure the address information of the user terminal on the target server so that the user terminal has the ability to access the target server.

[0191] When this method is applied to a target server, the method includes:

[0192] Receive the address information of the user terminal sent by the authentication server, and configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server;

[0193] The address information of the user terminal is broadcast to other servers in the server cluster to which the target server belongs, and the address information of the user terminal is configured on each of the other servers so that the user terminal has the ability to access each of the other servers.

[0194] The computer storage medium of this invention can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. For example, a computer-readable storage medium can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0195] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0196] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0197] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0198] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computing device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0199] It should be noted that the collection, gathering, updating, analysis, processing, use, transmission, and storage of user personal information involved in this disclosed technical solution all comply with relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken to prevent unauthorized access to user personal information data and to safeguard user personal information security, network security, and national security.

[0200] For example, after collecting the identification information of the current user logged in through the client installed on the user terminal, we will use technical means to de-identify the data.

[0201] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A server access method, characterized in that, Applied to an authentication server, the method includes: Determine the first private identifier corresponding to the transmission identifier sent by the user terminal, and determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal; If it is determined that the first signature information is consistent with the second signature information sent by the user terminal, the address information of the user terminal is determined, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information; Configure the address information of the user terminal on the target server so that the user terminal has the ability to access the target server.

2. The server access method according to claim 1, characterized in that, The transmission identifier, the terminal identifier information, and the second signature information are packaged by the terminal device into authentication information and sent to the authentication server at preset intervals.

3. The server access method according to claim 1, characterized in that, The first signature information is determined based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal, including: The authentication time and the terminal identification information are signed based on the first private identifier to obtain the first signature information.

4. The server access method according to claim 1, characterized in that, The second signature information is determined by the user terminal after determining the terminal identification information based on the second private identifier, the terminal time, and the terminal identification information. The terminal information includes terminal software information and terminal hardware information.

5. The server access method according to claim 1, characterized in that, Configuring the address information of the user terminal on the target server includes: The address information of the user terminal is sent to the target server so that the target server configures the address information of the user terminal in the target server's access whitelist.

6. A server access method, characterized in that, Applied to a target server, the method includes: The system receives the address information of a user terminal sent by the authentication server and configures the address information of the user terminal in the access whitelist of the target server, so that the user terminal has the ability to access the target server; wherein, the address information of the user terminal is determined by the authentication server after determining that the first signature information and the second signature information are consistent, the first signature information is determined by the authentication server based on the first private identifier corresponding to the transmission identifier sent by the user terminal, the authentication time, and the terminal identifier information, and the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information; The address information of the user terminal is broadcast to other servers in the server cluster to which the target server belongs, and the address information of the user terminal is configured on each of the other servers so that the user terminal has the ability to access each of the other servers.

7. The server access method according to claim 6, characterized in that, Configure the address information of the user terminal in the access whitelist of the target server, including: Determine whether the access whitelist contains the address information of the user terminal; If it is determined that the address information of the user terminal is not included in the access whitelist, the address information of the user terminal is added to the access whitelist, and an access time is set for the address information of the user terminal. If it is determined that the address information of the user terminal is included in the access whitelist, the access time of the address information of the user terminal shall be extended.

8. The server access method according to claim 7, characterized in that, After adding the user terminal's address information to the access whitelist and setting access time for the user terminal's address information, the method further includes: If the address information of the user terminal is not received again within the access period, the address information of the user terminal is deleted from the access whitelist.

9. The server access method according to claim 8, characterized in that, Also includes: If it is determined that the current time meets the access time requirement, the user terminal is allowed to access the target server; If it is determined that the current time does not meet the access time requirement, the user terminal is prohibited from accessing the target server.

10. A server access device, characterized in that, Configured on an authentication server, the device includes: The signature determination module is used to determine the first private identifier corresponding to the transmission identifier sent by the user terminal, and to determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal. The address determination module is used to determine the address information of the user terminal when it is determined that the first signature information is consistent with the second signature information sent by the user terminal, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information; The configuration module is used to configure the address information of the user terminal to the target server, so that the user terminal has the ability to access the target server.

11. A server access device, characterized in that, Configured on the target server, the device includes: A receiving module is configured to receive address information of a user terminal sent by an authentication server, and configure the address information of the user terminal in the access whitelist of a target server, so that the user terminal has the ability to access the target server; wherein, the address information of the user terminal is determined by the authentication server after determining that the first signature information and the second signature information are consistent, the first signature information is determined by the authentication server based on the first private identifier corresponding to the transmission identifier sent by the user terminal, the authentication time, and the terminal identifier information, and the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information; The broadcast module is used to broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs, and to configure the address information of the user terminal on each of the other servers, so that the user terminal has the ability to access each of the other servers.

12. A server access system, characterized in that, include: An authentication server is used to determine the first private identifier corresponding to the transmission identifier sent by the user terminal, and to determine the first signature information based on the first private identifier, the authentication time, and the terminal identifier information sent by the user terminal. If it is determined that the first signature information is consistent with the second signature information sent by the user terminal, the address information of the user terminal is determined, wherein the second signature information is determined by the user terminal based on the second private identifier corresponding to the transmission identifier, the terminal time, and the terminal identifier information; the address information of the user terminal is configured in the target server so that the user terminal has the ability to access the target server; The target server is used to receive the address information of the user terminal sent by the authentication server, configure the address information of the user terminal in the access whitelist of the target server so that the user terminal has the ability to access the target server; broadcast the address information of the user terminal to other servers in the server cluster to which the target server belongs, and configure the address information of the user terminal on each of the other servers so that the user terminal has the ability to access each of the other servers.

13. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the server access method as described in any one of claims 1-5 or 6-9.

Images