Token-based access verification method, system and storage medium

Abstract

The embodiment of the present invention discloses a Token-based access verification method, system and storage medium. The method belongs to the field of access verification technology, which includes: the authentication center module assigns node identification IDs and generates keys to multiple registered distributed nodes, and sends a key mapping table containing node identification IDs and keys to each distributed node; if any distributed node receives user information submitted by a client, the user information and node identification ID are sent to the authentication center module; the authentication center module verifies the user information, and if the verification passes, authentication information is generated according to the node identification ID and the key mapping table, and the authentication information is sent to the client; the client generates an authentication Token according to the request content and the authentication information, and sends the authentication Token and the request content to any distributed node; if the distributed node verifies that the authentication Token is legal, the request content is processed. The embodiment of the present application improves the security of access verification.

Description

Technical Field

[0001] The present invention relates to the field of access verification technology, and in particular to a Token-based access verification method, system and storage medium. Background Art

[0002] Distributed server cluster refers to the collection of multiple servers to run the same service together. After installing the cluster service on the server, the server can be added to the cluster and multiple servers can be used for parallel computing to achieve high-efficiency and high-availability computing. In practice, it is often used to speed up and distribute the link requests between the client and the server to reduce the peak workload of a single server. At the same time, the establishment of the link and the security verification of login and single sign-on between the client or third-party system and multiple servers in the system has become a problem. In this regard, there are currently three more widely used access verification methods: Session, Cookies+redis and Token. Among them, the disadvantage of the Session method is the waste of resources (the user may only use one function and then exit, but all servers need to store the user's session); Cookie+redis is only applicable to distributed servers with the same domain name and servers sharing redis, and cannot be applied to single sign-on jumps between multiple different systems; the disadvantage of the Token method is that the Token remains unchanged during the validity period. If the Token is leaked or misused, other illegal users can also access resources through the token during the validity period. Even if the Token is symmetrically encrypted, it can still be decrypted and used, making the security of access verification poor. Summary of the invention

[0003] The embodiments of the present invention provide a Token-based access verification method, system and storage medium, aiming to improve the security of existing access verification.

[0004] In a first aspect, an embodiment of the present invention provides a Token-based access verification method, which is applied to an access verification system, wherein the access verification system includes a client, a server, and a plurality of distributed nodes, wherein the server includes an authentication center module, and the method includes:

[0005] The authentication center module allocates node identification IDs to the registered multiple distributed nodes and generates keys, and sends a key mapping table including the node identification IDs and the keys to each of the distributed nodes;

[0006] If any of the distributed nodes receives the user information submitted by the client, it sends the user information and the node identification ID to the authentication center module;

[0007] The authentication center module verifies the user information, and if the verification passes, generates authentication information according to the node identification ID and the key mapping table, and sends the authentication information to the client;

[0008] The client generates an authentication token according to the request content and the authentication information, and sends the authentication token and the request content to any of the distributed nodes;

[0009] If the distributed node verifies that the authentication Token is legal, it processes the request content.

[0010] In a second aspect, an embodiment of the present invention further provides a Token-based access verification system, which includes: a sending unit and a verification unit configured in an authentication center module of a server, a receiving and sending unit and a verification processing unit configured in all distributed nodes, and a generation unit configured in a client, wherein:

[0011] The sending unit is used for the authentication center module to assign node identification IDs to multiple registered distributed nodes and generate keys, and to send a key mapping table including the node identification ID and the key to each of the distributed nodes;

[0012] The receiving and sending unit is used for any of the distributed nodes to send the user information submitted by the client and the node identification ID to the authentication center module;

[0013] The verification unit is used for the authentication center module to verify the user information. If the verification passes, the authentication information is generated according to the node identification ID and the key mapping table, and the authentication information is sent to the client;

[0014] The generating unit is used for the client to generate an authentication token according to the request content and the authentication information, and send the authentication token and the request content to any of the distributed nodes;

[0015] The verification processing unit user processes the request content if the distributed node verifies that the authentication Token is legal.

[0016] In the third aspect, an embodiment of the present invention also provides a Token-based access verification system, which includes a client, a server, and multiple distributed nodes, wherein the client, the server, and the multiple distributed nodes all include a memory and a processor, a computer program is stored in the memory, and the above method is implemented when the processors of the client, the server, and the multiple distributed nodes execute the computer program.

[0017] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program can implement the above method when executed by a processor.

[0018] The embodiment of the present invention provides a Token-based access verification method, system and storage medium. The method includes: the authentication center module assigns node identification IDs and generates keys to multiple registered distributed nodes, and sends a key mapping table containing the node identification ID and the key to each distributed node; if any of the distributed nodes receives the user information submitted by the client, the user information and the node identification ID are sent to the authentication center module; the authentication center module verifies the user information, and if the verification passes, generates authentication information according to the node identification ID and the key mapping table, and sends the authentication information to the client; the client generates an authentication token according to the request content and the authentication information, and sends the authentication token and the request content to any of the distributed nodes; if the distributed node verifies that the authentication token is legal, the request content is processed. The access verification system in the technical solution of the embodiment of the present invention includes a client, a server and multiple distributed nodes. The user information is first authenticated through an authentication center module newly added on the server, and then an authentication Token is dynamically generated in real time in the client according to the request content and authentication information, and the authentication Token is verified through distributed nodes, thereby avoiding resource access when the authentication Token is leaked and misused, and improving the security of access verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0020] Figure 1 A schematic diagram of a Token-based access verification system provided by an embodiment of the present invention;

[0021] Figure 2 A flowchart of a Token-based access verification method provided by an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of a sub-process of a Token-based access verification method provided by an embodiment of the present invention;

[0023] Figure 4A schematic diagram of a sub-process of a Token-based access verification method provided by an embodiment of the present invention;

[0024] Figure 5 A schematic diagram of a sub-process of a Token-based access verification method provided by an embodiment of the present invention;

[0025] Figure 6 A schematic block diagram of a Token-based access verification system provided by an embodiment of the present invention;

[0026] Figure 7 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0029] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0030] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0031] As used in this specification and the appended claims, the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if [described condition or event] is detected" may be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0032] See also Figure 1 , Figure 1 : is a schematic diagram of a Token-based access verification system provided by an embodiment of the present invention. The Token-based access verification system includes a client, a server, and a plurality of distributed nodes, wherein the server includes an authentication center module and a health management module. It should be noted that, in this embodiment, the client communicates with the server to receive the authentication information sent by the authentication center module; the client communicates with the distributed node to submit user information to the distributed node; the distributed node communicates with the server to send the user information and the node identifier to the authentication center module. It should also be noted that, in this embodiment, the user information is first authenticated by the newly added authentication center module on the server, and then the authentication Token is dynamically generated in real time in the client according to the request content and the authentication information, and the authentication Token is verified by the distributed node, which avoids the resource access when the authentication Token is leaked and misappropriated, improves the security of access verification, and solves the problem of malicious access to the server. Not only that, the embodiment of the present invention can also support the verification function of single-point jump between multiple nodes and multiple platforms.

[0033] Figure 2 The flowchart of a token-based access verification method provided by an embodiment of the present invention is shown in FIG. The token-based access verification method of the embodiment of the present invention can be applied to a token-based access verification system. For example, the token-based access verification method can be implemented by a software program configured on the token-based access verification system to improve the security of access verification. Figure 2 As shown, the method includes the following steps S100-S140.

[0034] S100. The authentication center module allocates node identification IDs to multiple registered distributed nodes and generates keys, and sends a key mapping table including the node identification IDs and the keys to each of the distributed nodes.

[0035] In the embodiment of the present invention, the server is started and initialized, the authentication center module performs automatic service registration for multiple distributed nodes, and connects multiple distributed nodes to the health check management module, and assigns a unique node identification ID to each distributed node, and generates a key S1 for all the distributed nodes. i , each key S1 i are all unique, and then send a message containing the node identification ID and the key S1 to each of the distributed nodes. i Specifically, for example, assuming that the total number of distributed nodes is N, the node identification ID assigned to each distributed node is recorded as Ai The key mapping table is denoted as Table. Understandably, the key mapping table records each node A i The corresponding S1 i It should be noted that, in this embodiment, an API interface is provided for single sign-on of the third-party system platform for subsequent key S1 i Update. It should also be noted that, in this embodiment, after receiving the Table, each of the distributed nodes needs to return a successful receipt message to the authentication center module. For example, if the successful receipt message is ok, each of the distributed nodes will save the Table.

[0036] Furthermore, the server also includes a health management module. If the preset update time T is reached, the authentication center module reissues the key to obtain an updated key S i , and sends an update message to all the distributed nodes; the authentication center module updates the key mapping table according to the updated key to obtain an updated key mapping table Tablenew; the health management module queries the health of all the distributed nodes, and determines the target distributed node according to whether the health is in an available state. Specifically, if the health is in an available state, the distributed node is determined as the target distributed node. Conversely, if the health is in an unavailable state, the distributed node is shielded and the key mapping table is not updated, that is, it is not used as the target distributed node; the authentication center module sends the updated key mapping table to the target distributed node; for any distributed node among the target distributed nodes, if the authentication center module does not receive the preset message information replied by the distributed node within the preset number of retries, indicating that the distributed node cannot be sent successfully after multiple reconnections, the health of the distributed node is set to an unavailable state, and the distributed node is forwarded to the health management module for management. It should be noted that, in this embodiment, the reason why the preset number of retries is required is to check whether the distributed node encounters a fault or network problem. It is understandable that the preset number of retries is set according to actual needs. It should also be noted that, in this embodiment, the key mapping table of the distributed node can only be updated when the health of the distributed node is set to an available state; the preset update time T can be defined by the user, but it cannot be less than twice the preset allowed expiration time T1 T1*2, and the default value is 30 minutes.

[0037] Furthermore, after the authentication center module sends the updated key mapping table to the target distributed node, the step further includes: the distributed node deletes the second key mapping table, and uses the updated key mapping table and the first key mapping table as the first key mapping table and the second key mapping table, respectively, wherein the initial value of the first key mapping table is the key mapping table, and the initial value of the second key mapping table is empty. It can be understood that the first key mapping table is Tablenew, and the second key mapping table is Tableold, that is, each distributed node A i Two key mapping tables are stored: Tableold and Tablenew.

[0038] S110. If any of the distributed nodes receives the user information submitted by the client, it sends the user information and the node identification ID to the authentication center module.

[0039] In the embodiment of the present invention, the user information includes a user name and a password. The client submits the user name and password to any distributed node A. i , any distributed node A i Redirect the request to the unified authentication center module and attach distributed node A i The unique node identification ID is given to the authentication center module, and the user information and the node identification ID are sent to the authentication center module.

[0040] S120. The authentication center module verifies the user information. If the verification passes, authentication information is generated according to the node identification ID and the key mapping table, and the authentication information is sent to the client.

[0041] In the embodiment of the present invention, Figure 3As shown, step S120 may include the following steps S121-S122: S121, the authentication center module verifies the user name and the password according to the preset user information table. If the verification is successful, a user ID is generated, and the key is queried from the key mapping table through the node identification ID; S122, the authentication center module generates an access key according to the node identification ID, the key and the user ID through a preset encryption algorithm, and sends the access key, the node identification ID and the user ID as the authentication information to the client. It should be noted that the preset encryption algorithm is the SHA256 encryption algorithm. Specifically, the authentication center module verifies the user name and password; if any information in the user name and password is incorrect, an error prompt message is returned to the client to allow the client to resubmit; if both the user name and password are verified, the access verification system is successfully logged in, and the authentication center module generates a unique user ID userId for the user. At the same time, through A i The information is found in the key mapping table Table and the corresponding S1 is found i After that, the authentication center module is as shown in formula (1), and A i 、S1 i , userid is irreversibly encrypted with SHA256 to obtain the access key S2 i .

[0042] S2 i =SHA256(A i ,S1 i ,userid) (1)

[0043] Finally, the authentication center module will A i 、S2 i , userid is sent to the client, which is used by the client to automatically generate authentication tokens in subsequent requests. i 、S2 i , userid to save.

[0044] S130: The client generates an authentication Token according to the request content and the authentication information, and sends the authentication Token and the request content to any of the distributed nodes.

[0045] In the embodiment of the present invention, the client also obtains the current timestamp Timestamp before sending the request content to any of the distributed nodes. Figure 4As shown, the step S130 may include the following steps S131-S132: S131, the client generates a target access key according to the current timestamp, the request content, the random encryption parameter, the access key and the user ID through the preset encryption algorithm; S132, the client generates the authentication token according to the target access key, the user ID, the current timestamp, the random encryption parameter and the node identification ID. Specifically, after the client logs in successfully, the client needs to generate the target access key S3 each time it requests. T , target access key S3 T The specific calculation of is shown in formula (2), where C is the request content and R is the random encryption parameter.

[0046] S3 T =SHA256(C,S2 i ,Timestamp,userid,R) (2)

[0047] Finally, the target access key S3 T After generation, according to A i ,R,Timestamp,userid,S3 T There are two main ways to generate authentication tokens. The first way is to use A i , R, Timestamp, userid, and S3 T The authentication token (unencrypted) is generated by splicing, as shown in formula (3). i , R, Timestamp, userid, and S3 T After splicing, Token (encrypted) is obtained after encryption using a reversible encryption algorithm such as symmetric or asymmetric encryption.

[0048] Token = A i +R+Timestamp+userid+S3 T (3)

[0049] It should be noted that A can be customized according to actual security requirements. i , R, Timestamp, userid, and S3 T After splicing, select unencrypted or encrypted. The purpose of using asymmetric encryption or symmetric encryption is to allow the server to reverse decrypt the Token and restore the A i ,R,Timestamp,userid,S3 T It should also be noted that, in this embodiment, the client needs to send an authentication Token when sending the request content.

[0050] S140: If the distributed node verifies that the authentication Token is legal, the request content is processed.

[0051] In the embodiment of the present invention, Figure 5 As shown, step S140 specifically includes the following steps S141-S148:

[0052] S141. The distributed node processes the authentication Token to obtain the target access key, the user ID, the current timestamp, the random encryption parameter and the node identification ID; S142. The distributed node obtains the first key from the first key mapping table through the node identification ID; S143. The distributed node calculates the first verification key according to the first key, the node identification ID and the user ID through a preset encryption algorithm, and generates a first target verification key according to the first verification key, the current timestamp, the request content, the random encryption parameter and the user ID; S144. The distributed node compares the first target verification key with the target access key; S145. If the first target verification key is the same as the target access key and the difference between the current timestamp and the current timestamp of the last request sent is within the preset allowed expiration date time range, the authentication Token is determined to be legal, and the request content is processed; S146, if the target verification key is different from the target access key, the distributed node obtains the second key from the second key mapping table through the node identification ID; S147, the distributed node calculates the second verification key according to the second key, the node identification ID and the user ID through a preset encryption algorithm, and generates a second target verification key according to the second verification key, the current timestamp, the request content, the random encryption parameter and the user ID; S148, if the second target verification key is the same as the target access key and the difference between the current timestamp and the current timestamp of the last request sent is within the preset allowed expiration time range, the authentication Token is determined to be legal, the request content is processed, and the access key is resent to the client.

[0053] Specifically, when the distributed node receives the request content and the authentication Token, the distributed node first extracts A from the authentication Token. i ,R,Timestamp,userid,S3 T If the authentication token is encrypted, it is decrypted using a pre-defined symmetric or asymmetric encryption algorithm. iThe value is used to query the key table Tablenew and obtain the corresponding first key S1 i . Then, the node uses A i 、S1 i , userid is calculated through the SHA256 encryption algorithm to obtain the first verification key S2 i .

[0054] S2 i =SHA256(A i ,S1 i ,userid)

[0055] Then, the distributed node responds to the request content C, S2 i , Timestamp, R, userid calculate the first target verification key S3 through the SHA256 encryption algorithm T .

[0056] S3 T =SHA256(C,S2 i ,Timestamp,userid,R)

[0057] Understandably, at this point, the distributed nodes have a total of two S3 T One is the S3 extracted from the user token. T The other is the S3 calculated by the node by disassembling the parameters of the authentication token. T Then, the distributed nodes will connect the two S3 T If the values ​​of two S3 T If the values ​​are the same and the difference T1 (also called the allowed expiration time) between the current timestamp and the current timestamp of the last request is within the preset allowed expiration time range T2, the authentication token is determined to be legal, indicating that the request authentication is successful, and the distributed node starts processing the request content. i , userid, C, Timestamp, R, any one of which is tampered with will result in the final S3 T Illegal. The default value of T1 is 15 minutes (can be modified according to different scenarios). i The certification authority will update it regularly. T The values ​​are different but T1 is within T2, then distributed node A i Think it might be S1 i The value has been updated or the request content C has been tampered with, resulting in illegal authentication. At this time, the distributed node will verify whether it is the key value S1 i Updates resulting in S3 TIf the values ​​are different, the second key will be found from the old key table Tableold (the old S1 i ), recalculate the old S3 i (Second verification key), calculate the old S3 according to the second verification key T (Second target verification key). If the old S3 T S3 with users T If they are the same, then it is considered to be S1 i The verification failure problem caused by the value update is that the request is also legal and valid, that is, the verification token is legal. At the same time, the client will be redirected to the authentication center module, and the recalculated and updated S2 will be directly issued to the client. i If the old S3 T S3 with users T If the two S3 T If the values ​​are the same but the operation time T1 exceeds the allowed expiration time T2, it is considered that the user has not operated for a long time and the user needs to log in again. Understandably, if two S3 T If the values ​​are different and the operation time T1 exceeds the allowed expiration time T2, it is also considered that re-login is required.

[0058] For ease of understanding, the Token-based access verification method is now described by way of the following specific embodiments:

[0059] S1: Server startup;

[0060] S2: Assuming there are 3 distributed nodes in total, the authentication center module performs service registration and discovery for each registered distributed node, and assigns a unique node identification ID to each distributed node, for example, the node identification ID of distributed node A is a, the node identification ID of distributed node B is b, and the node identification ID of distributed node C is c;

[0061] S3: The authentication center module generates a key mapping table Table for the first time, and each node corresponds to a key value S1. As described in Table 1, in Table 1, the key of a is S1A, the key of b is S1B, and the key of c is S1C;

[0062] Table 1

[0063] Node ID Key a S1A b S1B c S1C

[0064] After the key mapping table is generated, the authentication center module sends the key mapping table to all distributed nodes. After receiving it, the distributed nodes return a success message and can officially start providing services to the outside world.

[0065] S4: Log in to the client and enter the correct username and password;

[0066] S5: After receiving the username and password for the first time, distributed node A redirects the information to the authentication center module. After the authentication center module successfully verifies the account and password, it generates a user ID userid for the client, such as 01, and queries the key mapping table Table to obtain the key of distributed node A as S1A. The access key S2A is calculated by formula (1), and then a, 01 and S2A are sent to the client for storage. It should be noted that the access key S2A is a string;

[0067] S6: The client makes a request, such as sending a Json request, accessing a page, etc. When submitting the request content, the client needs to generate the current timestamp and the random number R to generate a real-time authentication token. Assuming the request content is C, the target access key S3 is calculated by formula (2): T , then generate the authentication token according to formula (3). It can be understood that symmetric encryption or asymmetric encryption can also be added to generate the authentication token based on formula (3), depending on the actual needs. After the client calculates the authentication token, it sends the request content C and the authentication token to the server. The server's load balancing may submit the request to any distributed node for processing, such as distributed node B;

[0068] S7: When distributed node B receives the request content and authentication token sent by userid 01, it will verify the authentication token. First, the authentication token is disassembled into node ID, random number R, Timestamp, userid and S3T in a pre-defined manner (users can disassemble by adding separators or specified character positions);

[0069] S8: Distributed node B queries the key mapping table Table and queries the key value S1A of a through the node identification ID. Then, S2A is calculated through formula (1), and then S3T is calculated through formula (2). The calculated S3T is compared with the S3T after the authentication Token is disassembled. If the difference between the current request time timestamp and the last request time timestamp does not exceed 15 minutes (default time), the request is considered to be legitimate, the authentication Token is authenticated and legitimate, and the request content C is processed;

[0070] Assuming that 30 minutes have passed during use (default key mapping table update time), the authentication center module will update and send a new key table Table (new), as shown in Table 2, that is, Table (new) is the first key mapping table;

[0071] Table 2

[0072] Node ID Key value a s1a b s1b c s1c

[0073] The previous key table is changed to the old key table Table(old), as shown in Table 3, that is, Table(old) is the second key mapping table.

[0074] Table 3

[0075] Node ID Key value a S1A b S1B c S1C

[0076] At this time, if the client's S2A value has not been updated, and the distributed node verifies the authentication token according to the key value of Table (new), then the verification must be illegal. At this time, the distributed node will take the value from Table (old) for re-verification, so that it can be verified as legal.

[0077] It should be noted that, in this embodiment, on the basis of the JWT (Json web token) verification mechanism, support for distributed multi-nodes is added to support jump authentication between different platforms; real-time updating of the authentication Token and the key mapping table can solve the problem that after the authentication Token is leaked, other personnel can bypass the verification access system and illegally access the server, thereby improving the security of access verification; the setting of the dual key mapping table avoids the problem that the keys of all users expire at the same time after the key table is updated and they need to log in again, which also enhances security and reduces the risk of key parameter leakage; not only that, the access verification system has strong scalability and decoupling, and can add distributed nodes.

[0078] Figure 6 2 is a schematic block diagram of a Token-based access verification system 200 provided in an embodiment of the present invention. Figure 6 As shown, corresponding to the Token-based access verification method applied to the client, server and multiple distributed nodes, the Token-based access verification system 200 includes a unit for executing the Token-based access verification method. Figure 6 The Token-based access verification system 200 includes a sending unit 101 and a verification unit 102 configured in the authentication center module of the server, a receiving and sending unit 201 and a verification processing unit 202 configured in all distributed nodes, and a generating unit 301 configured in the client.

[0079] Among them, the sending unit 101 is used by the authentication center module to assign node identification IDs and generate keys to multiple registered distributed nodes, and send a key mapping table containing the node identification ID and the key to each distributed node; the receiving and sending unit 201 is used by any of the distributed nodes to send the user information and the node identification ID to the authentication center module if it receives the user information submitted by the client; the verification unit 102 is used by the authentication center module to verify the user information, and if the verification passes, generate authentication information according to the node identification ID and the key mapping table, and send the authentication information to the client; the generation unit 301 is used by the client to generate an authentication Token according to the request content and the authentication information, and send the authentication Token and the request content to any of the distributed nodes; the verification processing unit 202 processes the request content if the distributed node verifies that the authentication Token is legal.

[0080] In some embodiments, such as the present embodiment, the verification unit 102 includes a verification generation unit and a first generation subunit.

[0081] Among them, the verification generation unit is used by the authentication center module to verify the user name and the password according to a preset user information table. If the verification passes, a user ID is generated, and the key is queried from the key mapping table through the node identification ID; the first generation sub-unit is used by the authentication center module to generate an access key according to the node identification ID, the key and the user ID through a preset encryption algorithm, and send the access key, the node identification ID and the user ID as the authentication information to the client.

[0082] In some embodiments, such as this embodiment, the generation unit 301 includes a second generation subunit and a third generation subunit.

[0083] Among them, the second generation subunit is used by the client to generate the target access key according to the current timestamp, the request content, the random encryption parameter, the access key and the user ID through the preset encryption algorithm; the third generation subunit is used by the client to generate the authentication Token according to the target access key, the user ID, the current timestamp, the random encryption parameter and the node identification ID.

[0084] In certain embodiments, such as the present embodiment, the Token-based access verification system 200 further includes an issuing unit, an updating unit, a sending sub-unit, a setting unit and a query unit in a health management module configured in the authentication center module of the server, and a deletion and update unit configured in a distributed node.

[0085] Among them, the issuing unit is used for the authentication center module to re-issue the key to obtain the updated key if the preset update time is reached, and send the update message to all the distributed nodes; the updating unit is used for the authentication center module to update the key mapping table according to the updated key to obtain the updated key mapping table; the query unit is used for the health management module to query the health of all the distributed nodes, and determine the target distributed node according to whether the health is in an available state; the sending subunit is used for the authentication center module to send the updated key mapping table to the target distributed node; the setting unit is used for any distributed node among the target distributed nodes, if the authentication center module does not receive the preset message information replied by the distributed node within the preset number of retries, then the health of the distributed node is set to an unavailable state, and the distributed node is forwarded to the health management module for management; the deletion and update unit is used for the distributed node to delete the second key mapping table, and use the updated key mapping table and the first key mapping table as the first key mapping table and the second key mapping table respectively, wherein the initial value of the first key mapping table is the key mapping table, and the initial value of the second key mapping table is empty.

[0086] In some embodiments, such as the present embodiment, the verification processing unit 202 includes a processing unit, a first acquisition unit, a first calculation generation unit, a comparison unit, a processing unit, a second acquisition unit, a second calculation generation unit, and a processing and sending unit.

[0087] Among them, the processing unit is used by the distributed node to process the authentication Token to obtain the target access key, the user ID, the current timestamp, the random encryption parameter and the node identification ID; the first acquisition unit is used by the distributed node to obtain the first key from the first key mapping table through the node identification ID; the first calculation and generation unit is used by the distributed node to calculate the first verification key according to the first key, the node identification ID and the user ID through a preset encryption algorithm, and generate the first target verification key according to the first verification key, the current timestamp, the request content, the random encryption parameter and the user ID; the comparison unit is used by the distributed node to compare the first target verification key with the target access key; the processing unit is used to compare the first target verification key with the target access key if the first target verification key is the same as the target access key and the difference between the current timestamp and the current timestamp of the last request sent is within a preset allowable range. If the target verification key is within the allowed expiration time range, the authentication Token is determined to be legal, and the request content is processed; the second acquisition unit is used for, if the target verification key is different from the target access key, the distributed node obtains the second key from the second key mapping table through the node identification ID; the second calculation and generation unit is used for the distributed node to calculate the second verification key according to the second key, the node identification ID and the user ID through a preset encryption algorithm, and generate a second target verification key according to the second verification key, the current timestamp, the request content, the random encryption parameter and the user ID; the processing and sending unit is used for, if the second target verification key is the same as the target access key and the difference between the current timestamp and the current timestamp of the last request sent is within the preset allowed expiration time range, then the authentication Token is determined to be legal, the request content is processed, and the access key is resent to the client.

[0088] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned Token-based access verification system 200 and each unit can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and brevity of description, it will not be repeated here.

[0089] The above-mentioned Token-based access verification system can be implemented in the form of a computer program, which can be used in Figure 7 Runs on the computer device shown.

[0090] See also Figure 7 , Figure 7900 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 900 is a device having a Token-based access verification system.

[0091] See also Figure 7 The computer device 900 includes a processor 902 , a memory and an interface 907 connected via a system bus 901 , wherein the memory may include a storage medium 903 and an internal memory 904 .

[0092] The storage medium 903 may store an operating system 9031 and a computer program 9032. When the computer program 9032 is executed, the processor 902 may execute a token-based access verification method.

[0093] The processor 902 is used to provide computing and control capabilities to support the operation of the entire computer device 900 .

[0094] The internal memory 904 provides an environment for the operation of the computer program 9032 in the storage medium 903. When the computer program 9032 is executed by the processor 902, the processor 902 can execute a token-based access verification method.

[0095] The interface 905 is used to communicate with other devices. Those skilled in the art will appreciate that Figure 7 The structure shown in the figure is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device 900 to which the solution of the present application is applied. The specific computer device 900 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0096] The processor 902 of each of the client, the server and the plurality of distributed nodes is used to run a computer program 9032 stored in a memory to implement any embodiment of the above-mentioned Token-based access verification method.

[0097] It should be understood that in the embodiment of the present application, the processor 902 may be a central processing unit (CPU), and the processor 902 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0098] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing related hardware through a computer program. The computer program can be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the wireless communication system to implement the process steps of the embodiment of the above method.

[0099] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program. When the computer program is executed by a processor, the processor executes any embodiment of the above-mentioned Token-based access verification method.

[0100] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0101] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, wireless communication software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0102] In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0103] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the system of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0104] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The wireless communication software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal wireless communication, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0105] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0106] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0107] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A token-based access verification method, applied to an access verification system, characterized in that: The access verification system includes a client, a server, and a plurality of distributed nodes, the server includes an authentication center module, and the method includes: The authentication center module allocates node identification IDs to the registered multiple distributed nodes and generates keys, and sends a key mapping table including the node identification IDs and the keys to each of the distributed nodes; If any of the distributed nodes receives the user information submitted by the client, it sends the user information and the node identification ID to the authentication center module; The authentication center module verifies the user information, and if the verification passes, generates authentication information according to the node identification ID and the key mapping table, and sends the authentication information to the client; The client generates an authentication token according to the request content and the authentication information, and sends the authentication token and the request content to any of the distributed nodes; If the distributed node verifies that the authentication Token is legal, it processes the request content.

2. The Token-based access verification method according to claim 1, characterized in that: The user information includes a user name and a password. The authentication center module verifies the user information. If the verification passes, authentication information is generated according to the node identification ID and the key mapping table, and the authentication information is sent to the client, including: The authentication center module verifies the user name and the password according to the preset user information table, generates a user ID if the verification passes, and queries the key from the key mapping table through the node identification ID; The authentication center module generates an access key according to the node identification ID, the key and the user ID through a preset encryption algorithm, and sends the access key, the node identification ID and the user ID as the authentication information to the client.

3. The Token-based access verification method according to claim 2, characterized in that: The client generates an authentication Token according to the request content and the authentication information, including: The client generates a target access key by using the preset encryption algorithm according to the current timestamp, the request content, the random encryption parameter, the access key and the user ID; The client generates the authentication Token according to the target access key, the user ID, the current timestamp, the random encryption parameter and the node identification ID.

4. The Token-based access verification method according to claim 3, characterized in that: The server further includes a health management module, and the method further includes: If the preset update time is reached, the authentication center module re-issues the key to obtain an updated key, and sends an update message to all the distributed nodes; The authentication center module updates the key mapping table according to the update key to obtain an update key mapping table; The health management module queries the health of all the distributed nodes, and determines the target distributed node according to whether the health is in an available state; The authentication center module sends the updated key mapping table to the target distributed node; For any distributed node among the target distributed nodes, if the authentication center module does not receive the preset message information replied by the distributed node within the preset number of retries, the health of the distributed node is set to an unavailable state, and the distributed node is forwarded to the health management module for management.

5. The Token-based access verification method according to claim 4, characterized in that: After the step of the authentication center module sending the updated key mapping table to the target distributed node, the method further includes: The distributed node deletes the second key mapping table, and uses the updated key mapping table and the first key mapping table as the first key mapping table and the second key mapping table respectively, wherein the initial value of the first key mapping table is the key mapping table, and the initial value of the second key mapping table is empty.

6. The Token-based access verification method according to claim 5, characterized in that: If the distributed node verifies that the authentication Token is legal, the request content is processed, including: The distributed node processes the authentication Token to obtain the target access key, the user ID, the current timestamp, the random encryption parameter and the node identification ID; The distributed node obtains the first key from the first key mapping table through the node identification ID; The distributed node calculates a first verification key according to the first key, the node identification ID and the user ID through a preset encryption algorithm, and generates a first target verification key according to the first verification key, the current timestamp, the request content, the random encryption parameter and the user ID; The distributed node compares the first target verification key with the target access key; If the first target verification key is the same as the target access key and the difference between the current timestamp and the current timestamp of the last request sent is within the preset allowed expiration time range, the authentication Token is determined to be legal, and the request content is processed.

7. The Token-based access verification method according to claim 6, characterized in that: After the step of the distributed node comparing the first target verification key with the target access key, the method further includes: If the first target verification key is different from the target access key, the distributed node obtains the second key from the second key mapping table through the node identification ID; The distributed node calculates a second verification key according to the second key, the node identification ID and the user ID through a preset encryption algorithm, and generates a second target verification key according to the second verification key, the current timestamp, the request content, the random encryption parameter and the user ID; If the second target verification key is the same as the target access key and the difference between the current timestamp and the current timestamp of the last request sent is within the preset allowed expiration time range, the authentication Token is determined to be legal, the request content is processed, and the access key is resent to the client.

8. A Token-based access verification system, characterized in that: The access verification system comprises: a sending unit and a verification unit configured in the authentication center module of the server, a receiving and sending unit and a verification processing unit configured in all distributed nodes, and a generating unit configured in the client, wherein: The sending unit is used for the authentication center module to assign node identification IDs to multiple registered distributed nodes and generate keys, and to send a key mapping table including the node identification ID and the key to each of the distributed nodes; The receiving and sending unit is used for any of the distributed nodes to send the user information submitted by the client and the node identification ID to the authentication center module; The verification unit is used for the authentication center module to verify the user information. If the verification passes, the authentication information is generated according to the node identification ID and the key mapping table, and the authentication information is sent to the client; The generating unit is used for the client to generate an authentication token according to the request content and the authentication information, and send the authentication token and the request content to any of the distributed nodes; The verification processing unit user processes the request content if the distributed node verifies that the authentication Token is legal.

9. A token-based access verification system, characterized in that: The method comprises a client, a server and a plurality of distributed nodes, wherein the client, the server and the plurality of distributed nodes all comprise a memory and a processor, wherein a computer program is stored in the memory, and when the processors of the client, the server and the plurality of distributed nodes execute the computer program, the method as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 can be implemented.

Images