Authentication method and device, readable storage medium and electronic equipment

Abstract

The specification relates to an authentication method, device, readable storage medium and electronic equipment. The authentication method is applied to a server, a first preset cut point of which is pre-injected with a first aspect program. The authentication method comprises the following steps: when a client accesses the server, receiving an access request for accessing the server sent by the client; wherein the access request carries identity information of the client; the first aspect program determines the identity of the client according to the identity information of the client, determines the access authority of the client according to the identity of the client, and then acquires access data according to the access authority of the client; and sending the access data to the client. The authentication method, device, readable storage medium and electronic equipment of the specification realize the authentication function through the aspect program pre-injected at the preset cut point of the client and the server, so that the authentication function is decoupled from other functions of the server, interference to other functions is avoided, and privacy data leakage can be avoided through authentication.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of privacy protection, and more particularly to an authentication method and device, a readable storage medium and an electronic device. BACKGROUND

[0002] Based on the development of Internet technology, users can achieve different functions through various application program clients installed on terminal devices. When implementing its functions, the application program client usually needs to interact with the server, such as accessing the data of the server, calling the interface of the server, and the like.

[0003] Since the server stores a lot of private data (for example, stored in a trusted execution environment), in the prior art, when the client requests data from the server, the server will first confirm the identity of the client, and then return the requested data to the client, thereby avoiding illegal clients from calling private data and causing privacy leakage.

[0004] However, in the prior art, the above function is coupled with other functions of the client and the server, and when the above function needs to be modified, the source code needs to be modified, which causes interference to other functions of the client and the server. SUMMARY

[0005] One of the purposes of the present specification is to provide an authentication method applied to a server, which realizes an authentication function through a first aspect program pre-injected at a first preset join point of the server when a client accesses the server, so as to decouple the authentication function from other functions of the server and avoid interference to other functions.

[0006] In order to achieve the above purpose, the present specification provides an authentication method applied to a server, wherein a first preset join point of the server is pre-injected with a first aspect program, and the authentication method comprises:

[0007] When a client accesses the server, an access request for accessing the server sent by the client is received; wherein the access request carries identity information of the client;

[0008] The first aspect program determines the identity of the client according to the identity information of the client, determines the access authority of the client according to the identity of the client, and then acquires access data according to the access authority of the client;

[0009] The access data is sent to the client.

[0010] Further, in some embodiments, determining the identity of the client according to the identity information of the client specifically comprises:

[0011] comparing the identity information of the client with pre-stored standard identity information to determine the identity of the client.

[0012] Further, in some embodiments, the access permission of the client is determined according to the identity of the client, specifically including:

[0013] The access permission of the client is found in a preset access permission configuration table according to the identity of the client.

[0014] Further, in some embodiments, the access data is obtained according to the access permission of the client, specifically including:

[0015] The accessible fields of the client are determined according to the access permission of the client;

[0016] All the accessible fields of the client are obtained as access data.

[0017] Another object of the present specification is to provide an authentication method applied to a client, which realizes an authentication function by a second aspect program pre-injected at a second preset cut point of the client, so as to decouple the authentication function from other functions of the client and avoid interference with other functions.

[0018] In order to achieve the above object, the present specification provides an authentication method applied to a client, a second preset cut point of the client being pre-injected with a second aspect program, the authentication method comprising:

[0019] When the client accesses a server, an access request for accessing the server is generated;

[0020] Identity information of the client is collected by the second aspect program, and the identity information of the client is inserted into the access request;

[0021] The access request carrying the identity information of the client is sent to the server, so that the server confirms the identity of the client according to the identity information of the client, and determines the access permission of the client according to the identity of the client, then obtains access data according to the access permission of the client and sends the access data to the client;

[0022] The access data sent by the server is received.

[0023] Another object of the present specification is to provide an authentication device applied to a server, which realizes an authentication function by a first aspect program pre-injected at a first preset cut point of the server, so as to decouple the authentication function from other functions of the server and avoid interference with other functions.

[0024] Based on the above purpose, the specification provides an authentication device, applied to a server, a first preset cut point of the server being pre-injected with a first aspect program, the authentication device comprising:

[0025] A first receiving module is configured to receive an access request for accessing the server sent by a client when the client accesses the server, wherein the access request carries identity information of the client;

[0026] A determining module is configured to determine the identity of the client according to the identity information of the client through the first aspect program, determine the access right of the client according to the identity of the client, and then acquire access data according to the access right of the client;

[0027] A first sending module is configured to send the access data to the client.

[0028] Further, in some embodiments, the identity of the client is determined according to the identity information of the client, specifically comprising:

[0029] The identity information of the client is compared with pre-stored standard identity information to determine the identity of the client.

[0030] Further, in some embodiments, the access right of the client is determined according to the identity of the client, specifically comprising:

[0031] The access right of the client is found in a preset access right configuration table according to the identity of the client.

[0032] Further, in some embodiments, the access data is acquired according to the access right of the client, specifically comprising:

[0033] The accessible fields of the client are determined according to the access right of the client;

[0034] All the accessible fields of the client are acquired as access data.

[0035] Another embodiment of the specification provides an authentication device, applied to a client, and the authentication function is realized through a second aspect program pre-injected at a second preset cut point of the client, so that the authentication function is decoupled from other functions of the client, avoiding interference with other functions.

[0036] Based on the above purpose, the specification provides an authentication device, applied to a client, a second preset cut point of the client being pre-injected with a second aspect program, the authentication device comprising:

[0037] generating an access request for accessing the server when the client accesses the server;

[0038] The acquisition module is configured to acquire the identity information of the client through the second facet program and insert the identity information of the client into the access request;

[0039] The second sending module is configured to send the access request carrying the identity information of the client to the server, so that the server confirms the identity of the client according to the identity information of the client, determines the access right of the client according to the identity of the client, and then acquires access data according to the access right of the client and sends the access data to the client;

[0040] The second receiving module is configured to receive the access data sent by the server.

[0041] Another purpose of the present specification is to provide a readable storage medium having a computer program stored thereon, when the computer program is executed in a computer, the computer program causes the computer to implement the authentication method as described above.

[0042] Another purpose of the present specification is to provide a computing device comprising a memory and a processor, the memory having executable code stored therein, when the processor executes the executable code, the processor implements the authentication method as described above. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 a flowchart of an authentication method applied to a server according to an embodiment of the present specification;

[0044] Figure 2 a flowchart of an authentication method applied to a client according to another embodiment of the present specification;

[0045] Figure 3 a structural block diagram of an authentication device applied to a server according to still another embodiment of the present specification;

[0046] Figure 4 a structural block diagram of an authentication device applied to a client according to still another embodiment of the present specification. DETAILED DESCRIPTION

[0047] The preferred embodiments of the present specification will be described in detail below with reference to the accompanying drawings.

[0048] The security aspect refers to a method of dynamically adding or modifying an aspect program for implementing a security aspect function in the running logic of an application without modifying the application by using aspect-oriented programming (AOP). This enables the security aspect function to be implemented while decoupling the program implementing the security aspect function from the application, thereby avoiding development iteration problems caused by high coupling.

[0049] The aspect program mentioned here is an enhanced program for implementing a security aspect function based on a function running logic. The aspect program can be injected into a corresponding join point of the application by using aspect-oriented programming, and the aspect program is triggered to execute during the execution of the application to implement the required security aspect function.

[0050] When the application executes a function, the application usually executes the function through the calling between methods. Therefore, any method in the application can be used as a join point of the aspect program, i.e., the above-mentioned join point, and the aspect program can be injected into the corresponding join point. This enables the application to execute the aspect program injected at the join point when the execution reaches the join point, i.e., when the method of the application corresponding to the join point is called.

[0051] Generally, the code responsible for the process of injecting the aspect program into the join point has high reusability, and therefore, the program implementing this process is usually abstracted as a service module, i.e., an aspect base. The aspect base can obtain the aspect program to be deployed from a server providing a security aspect function and obtain the join point at which the aspect program is injected into the application. After the application container is started, the aspect base is woken up and injects the corresponding aspect program at the join point of the application.

[0052] The application can be an application providing a function service in a server of a function platform. The function service can be a function service provided by the server of the function platform to a user, such as a query function, a payment function, etc. The function service can also be a function service provided by a certain server of the function platform to other servers, such as a settlement function, etc.

[0053] Of course, as described above, in order to decouple the program of the security aspect function from the application, the present specification enables the program of the security aspect function and the application to be interwoven during function execution but to be independently maintained in parallel by using aspect-oriented programming. Therefore, unlike the function provider of the application, a third party providing the security aspect function can manage the content related to the security aspect function, such as the configuration of a security aspect function control policy, the version iteration of the aspect program, the deployment rule configuration of the aspect program, etc. Of course, the provider of the security aspect function can be a third party or a function provider.

[0054] The server can record various configuration information, such as configuration of various policies, deployment rule configuration of aspect programs, and the like, in a configuration file when managing content related to the security aspect function. The aspect base can deploy aspect programs according to the configuration file, or the server can implement the security aspect function according to the configuration file.

[0055] In actual applications, a function provider usually has a machine room including several physical machines or physical servers, and provides physical resources required by an application program through the physical machines. Of course, an application program can not require all physical resources of an entire physical machine, so a virtual hosting technology is usually used to run multiple virtual hosts on one physical machine. The virtual hosts are independent of each other and each enjoys part of the physical resources of the physical machine. Then, an application container can be deployed in the virtual host, and an application program can be run through the application container. The application container usually includes physical resources, such as CPU and memory, allocated to the application container, and a running environment, such as an operating system (OS) or other running environment data, provided to the application container, such as a serial number (SN) of the container, an assigned IP (Influential Property), an application name, a tenant, and an environment variable. The application program can be deployed in the application container to perform a function.

[0056] In a scenario of performing a function based on a security aspect, a server of a function provider or a third party providing a security aspect function can provide a server, manage content related to the security aspect function through the server, and deploy an aspect base in an application container. The aspect base is used to inject an aspect program into an application program in the application container to provide support for the security aspect function for the application container of the function provider.

[0057] Therefore, the aspect base can be deployed in the application container of the function provider in advance. In general, when the application container is started, the operating system provided to the application container can be invoked, and the pre-deployed aspect base can be run to obtain the aspect program and the join point of the application program from the server through the aspect base, and inject the aspect program into the join point of the application program in the application container. In addition, the aspect base can also obtain the aspect program and the join point of the application program from the server during execution of the application program, and inject the aspect program into the join point of the application program in the application container.

[0058] Of course, how the aspect base obtains the information required for deploying the aspect program from the server can be set as needed. For example, the aspect base can actively pull the required information from the server according to a configuration file, or the server can actively issue the required information for the aspect base to receive.

[0059] After the aspect program is injected into the application at the pointcut, the application triggers the aspect program during execution to achieve the corresponding security aspect function.

[0060] The client of the application installed on the terminal device needs to interact with the server when implementing various functions, such as accessing data of the server and calling an interface of the server. Since a lot of sensitive private data is stored in the server, when the client requests data from the server, the server first confirms the identity of the client, and then returns the requested data to the client, so as to avoid illegal clients from calling private data and causing private data leakage. The existing identity confirmation function is coupled with other functions of the client and the server. When the identity confirmation function needs to be modified, the source code needs to be modified, which causes interference to other functions of the client and the server. In addition, after the server confirms that the identity of the client is trusted, the server directly returns the access data requested by the client, without further confirming the access permission of the client, that is, fine-grained authentication cannot be achieved, which may also cause the risk of private data leakage.

[0061] Therefore, an authentication method is provided in the embodiments of the present specification. When the client accesses the server, the authentication function is achieved by injecting an aspect program at a preset pointcut of the client and the server in advance, so that the authentication function is decoupled from other functions of the client and the server, and interference to other functions is avoided. At the same time, the access permission of the client is determined through authentication, and access data is returned according to the access permission, so as to achieve fine-grained access control.

[0062] As shown in Figure 1 An authentication method is provided in an embodiment of the present specification, which is applied to a server. A first aspect program is pre-injected at a first preset pointcut of the server. The authentication method comprises the following steps:

[0063] S110: When the client accesses the server, an access request for accessing the server sent by the client is received. The access request carries identity information of the client.

[0064] When the client accesses the server, the client first generates an access request, then inserts the identity information of the client into the access request, and then sends the access request carrying the identity information of the client to the server. The server receives the access request carrying the identity information of the client.

[0065] In some embodiments, the identity information of the client can include any suitable information for proving the identity of the client, such as the model of the terminal device on which the client is installed, the SN (serial number) of the terminal device, the version number of the application, the terminal identity certificate, the user's mobile phone number, and the like. After the client generates the access request, the identity information of the client can be collected, and then the identity information of the client is inserted into the access request.

[0066] S120: The first aspect procedure determines the identity of the client according to the identity information of the client, determines the access right of the client according to the identity of the client, and then acquires the access data according to the access right of the client.

[0067] The first aspect procedure is pre-injected at a first preset join point of the server. The first aspect procedure can be injected into the first preset join point through a first aspect base pre-deployed on the server. The injection manner can be static injection or dynamic injection. The first aspect procedure can execute a preset authentication function. When the server executes the first preset join point, the first aspect procedure is triggered, and the authentication function is implemented by the first aspect procedure. After the first aspect procedure completes the authentication function, the original execution logic of the server is returned to, so as to implement the original function of the server. The position of the first preset join point can be selected according to needs, and the position of the first preset join point can be different for different clients. For example, the first preset join point can be a function of the server for receiving an access request. In this way, after the server receives an access request through the function of receiving an access request, the first aspect procedure is triggered to implement the authentication function.

[0068] The authentication function of the first aspect procedure is to determine the identity of the client according to the identity information of the client, determine the access right of the client according to the identity of the client, and then acquire the access data according to the access right of the client.

[0069] In some embodiments, determining the identity of the client can be identity authentication of the client, that is, determining whether the client is a legal client. If yes, the identity information of the client is trusted, and the identity of the client is determined as the identity provided in the access request. In some other embodiments, determining the identity of the client can also be not identity authentication of the client, but directly trusting the identity information carried in the access request of the client, and determining the identity of the client as the identity provided in the access request.

[0070] In some embodiments, the standard identity information of the client is pre-stored in the server, and the identity of the client is determined according to the identity information of the client, specifically including:

[0071] Comparing the identity information of the client with the standard identity information of the client in the server to determine the identity of the client.

[0072] The standard identity information of the client can be the registration baseline data of the client, i.e., the device and environment information registered and reported to the server by the terminal device when the client is installed, including the model of the terminal device, the SN (serial number), the application version number, the terminal identity certificate, the user mobile phone number, etc. The identity of the client is determined by comparing the identity information of the client with the standard identity information of the client in the server, which specifically includes a weak consistency authentication method and a strong consistency authentication method.

[0073] The weak consistency authentication method includes comparing part of the identity information of the client (i.e., core information such as the identity certificate, the user mobile phone number, and the SN) with the corresponding part of the standard identity information of the client in the server (i.e., the standard identity certificate, the standard user mobile phone number, and the standard SN). If they are completely consistent, the identity of the client is trusted, and the identity of the client in the access request is determined. Otherwise, the identity of the client is not trusted, and the identity of the client is determined to be illegal. The weak consistency method only needs to compare part of the core information of the identity information of the client, which can reduce the computational complexity of the comparison process, while ensuring a certain authentication accuracy.

[0074] The strong consistency authentication method includes comparing all the identity information of the client with the standard identity information in the server. If they are completely consistent, the identity of the client is trusted, and the identity of the client in the access request is determined. Otherwise, the identity of the client is not trusted, and the identity of the client is determined to be illegal. Since the strong consistency authentication method compares all the identity information, it has high accuracy, but the computational complexity is also large.

[0075] After the identity of the client is determined, the access permission of the client can be determined, and then the access data can be obtained according to the access permission. Specifically, an access permission configuration table is pre-set in the server, which includes the identity of each client and its corresponding access permission. The corresponding access permission of the client can be checked in the access permission configuration table through the identity of the client, for example, the determined identity of the client can be searched in the access permission configuration table. If the corresponding identity of the client is found, the corresponding access permission of the client is obtained, i.e., the access permission of the determined client. If the corresponding identity of the client is not found (i.e., the identity of the client is not in the access permission configuration table), it is determined that the client has no access permission. For the client with access permission, the corresponding access data can be obtained according to the access permission. For the client without access permission, the access data obtained is empty (i.e., no access data can be obtained) or an access error prompt.

[0076] In some embodiments, if the identity of the client is illegal, it can be directly determined that the client has no access right, and the access data obtained is empty; for a legal client, the access right of the client is further searched in the access right configuration table.

[0077] In some embodiments, the access right can be refined to a field, that is, the access right includes the fields that the client can access. The access data is obtained according to the access right of the client, and specifically includes:

[0078] The accessible fields of the client are determined according to the access right of the client.

[0079] All accessible fields of the client are obtained as access data.

[0080] In an exemplary embodiment, the access right includes authorization interfaces and field information. For example, for the client C1, the access right includes the authorization interfaces S1 and S2, the field information of S1 includes the fields A and B, and the field information of S2 includes all fields. It is assumed that the data of S1 includes the fields A, B and C, and the data of S2 includes the fields D and E. The above access right indicates that the client C1 can access the fields A and B of S1 and access the fields D and E of S2, but cannot access the field C of S1. When the client C1 sends an access request for the data of the request S1 and / or S2 to the server, the server will obtain the fields A and B of S1 and / or the fields D and E of S2 as access data and return to the client C1. By refining the access right to the field granularity, unauthorized access can be prevented, and the leakage of private data can be avoided, thereby realizing more secure and fine-grained access control.

[0081] When the access rights of the clients need to be changed, the access right configuration table in the server only needs to be updated, which is very convenient.

[0082] Since the above authentication function is implemented by the first aspect program, when it needs to be changed, the first aspect program only needs to be modified, and then the modified first aspect program is distributed to the first aspect base of the server through the aspect server, and is re-injected to the first preset point through the first aspect base. Then the modified authentication function can be realized without modifying the source code of the server and without affecting other functions of the server, which is very convenient.

[0083] S130: Send the access data to the client.

[0084] After the first aspect program obtains the access data according to the access right of the client, it returns to the original execution logic of the server, and then the original execution logic of the server sends the access data to the client, so that the client can receive the data it can access.

[0085] The authentication method of the embodiments of the present specification is applied to a server, and an authentication function is realized through a first aspect program pre-injected at a first preset join point of the server, so that the authentication function is decoupled from other functions of the server, avoiding interference with other functions; the access authority of the client is determined through authentication, and access data is returned according to the access authority, so as to realize fine-grained access control.

[0086] As shown in Figure 2 Another embodiment of the present specification provides an authentication method applied to a client, a second preset join point of the client pre-injects a second aspect program, and the authentication method comprises the following steps:

[0087] S210: When the client accesses the server, an access request for accessing the server is generated.

[0088] In some embodiments, the access request can include a requested interface, data, etc., so that the server returns data that the client can access according to the access request.

[0089] S220: Collect the identity information of the client through the second aspect program, and insert the identity information of the client into the access request.

[0090] The second aspect program is pre-injected at a second preset join point of the server. It can be injected into the second preset join point through a second aspect base pre-deployed on the server. The injection method can be static injection or dynamic injection. The second aspect program can execute a preset authentication function. When the client executes the second preset join point, the second aspect program will be triggered, and the authentication function of the second aspect program will be realized. After the second aspect program completes the authentication function, it will return to the original execution logic of the client to realize the original function of the client. The position of the second preset join point can be selected as needed, and the position of the second preset join point may be different for different clients. For example, the second preset join point can be a function of the client for generating an access request. In this way, after the client generates an access request through the function of generating an access request, the second aspect program will be triggered to realize the authentication function.

[0091] The authentication function of the second aspect program is to collect the identity information of the client and insert the identity information of the client into the access request.

[0092] In some embodiments, the identity information of the client can include any suitable information for proving the identity of the client, such as the model of the terminal device on which the client is installed, the SN (serial number), the application program version number, the terminal identity certificate, the user's mobile phone number, etc.

[0093] In some embodiments, after the second aspect program collects the identity information of the client, the identity information of the client can be first verified for legality, and if the client is legal, the client is inserted into the access request; otherwise, it is directly determined that the identity information of the client is not legal, and the subsequent process is not performed.

[0094] In some embodiments, after the second aspect program collects the identity information of the client, the identity information of the client can be first preprocessed (for example, hash calculation), and then the preprocessed identity information is inserted into the access request.

[0095] Since the above authentication function is implemented by the second aspect program, when it needs to be changed, only the second aspect program needs to be modified, and then the modified second aspect program is distributed to the second aspect base of the client through the aspect server, and is re-injected to the second cut point through the second aspect base. Then the modified authentication function can be realized, without the need to modify the source code of the client, and without affecting other functions of the client, which is very convenient.

[0096] S230: The access request carrying the identity information of the client is sent to the server, so that the server confirms the identity of the client according to the identity information of the client, and determines the access right of the client according to the identity of the client, and then acquires access data according to the access right of the client and sends the access data to the client.

[0097] After the second aspect program inserts the identity information of the client into the access request, it returns to the original execution logic of the client. The original execution logic of the client sends the access request carrying the identity information of the client to the server, so that the server determines the identity of the client according to the identity information of the client, and determines the access right according to the identity of the client, and then acquires access data according to the access right and sends the access data to the client. The method for the server to determine the identity of the client according to the identity information of the client, and determine the access right according to the identity of the client, and then acquire access data according to the access right can be referred to the previous embodiment, and will not be described here.

[0098] S240: Receive the access data sent by the server.

[0099] The access data sent by the server is the access data acquired by the server after authenticating the client, which can avoid privacy leakage caused by unauthorized access of the client.

[0100] In some embodiments, the access data includes an accessible field, and the server acquires the accessible field of the client according to the field-based access right, which can realize field-granularity authentication access control, thereby realizing more secure and fine-grained access control.

[0101] The authentication method provided by the embodiments of the present specification is applied to a client, and an authentication function is realized by a second aspect program pre-injected at a second preset join point of the client, so that the authentication function is decoupled from other functions of the client, and interference to the other functions is avoided.

[0102] As shown in Figure 3 The authentication device provided by another embodiment of the present specification is applied to a server, and a first aspect program is pre-injected at a first preset join point of the server. The authentication device comprises a first receiving module 11, a determining module 12, and a first sending module 13.

[0103] The first receiving module 11 is configured to receive an access request for accessing the server sent by the client when the client accesses the server, wherein the access request carries identity information of the client.

[0104] When the client accesses the server, the client will first generate an access request, then insert the identity information of the client into the access request, and then send the access request carrying the identity information of the client to the server. The server receives the access request carrying the identity information of the client.

[0105] In some embodiments, the identity information of the client can include any suitable information for proving the identity of the client, such as the model of the terminal device on which the client is installed, the SN (serial number) of the terminal device, the application program version number, the terminal identity certificate, the user's mobile phone number, and the like. After generating the access request, the client can collect the identity information of the client, and then insert the identity information of the client into the access request.

[0106] The determining module 12 is configured to determine the identity of the client according to the identity information of the client by the first aspect program, determine the access right of the client according to the identity of the client, and then obtain the access data according to the access right of the client.

[0107] The first aspect program is pre-injected at the first preset join point of the server. It can be injected into the first preset join point through a first aspect base pre-deployed on the server. The injection method can be static injection or dynamic injection.

[0108] In some embodiments, determining the identity of the client can be identity authentication of the client, that is, determining whether the client is a legal client. If so, the identity information of the client is trusted, and the identity of the client is determined to be the identity provided in the access request. In some other embodiments, determining the identity of the client can also be not identity authentication of the client, but directly trusting the identity information carried in the access request of the client, and determining the identity of the client to be the identity provided in the access request.

[0109] In some embodiments, the standard identity information of the client is pre-stored in the server, and the identity of the client is determined according to the identity information of the client, specifically including:

[0110] The identity information of the client is compared with the standard identity information of the client in the server to determine the identity of the client.

[0111] The standard identity information of the client can be the registration baseline data of the client, that is, the device and environment information registered and reported to the server by the terminal device when installing the client, including the model, SN (serial number), application version number, terminal identity certificate, user mobile phone number, etc. of the terminal device. The identity information of the client is compared with the standard identity information of the client in the server to determine the identity of the client, specifically including a weak consistency authentication method and a strong consistency authentication method. The weak consistency authentication method compares part of the identity information of the client with the corresponding part of the standard identity information, which has smaller calculation amount and can also ensure a certain accuracy; the strong consistency authentication compares all information of the identity information of the client with all information of the standard identity information, which has high accuracy but also has large calculation amount.

[0112] The access permission configuration table is pre-set in the server, and the access permission configuration table includes the identity of each client and the corresponding access permission, and the access permission corresponding to the client can be checked in the access permission configuration table through the identity of the client.

[0113] In some embodiments, if the identity of the client is illegal, it can be directly determined that the client has no access permission, and the access data obtained by the client is empty; for a legal client, the access permission of the client is searched in the access permission configuration table.

[0114] In some embodiments, the access permission can be refined to a field, that is, the access permission includes the field that can be accessed by the client. The access data is obtained according to the access permission of the client, specifically including:

[0115] The accessible field of the client is determined according to the access permission of the client;

[0116] All accessible fields of the client are obtained as access data.

[0117] By refining the access permission to the field granularity, it can be prevented that the access permission is exceeded, and the leakage of private data is avoided, so that more secure and fine access control is realized.

[0118] When the access permission of each client needs to be changed, the access permission configuration table in the server only needs to be updated, which is very convenient.

[0119] Since the above authentication function is realized by the first aspect program, when it needs to be changed, only the first aspect program needs to be modified, and then the modified first aspect program is distributed to the first aspect base of the server through the aspect server, and is re-injected to the first preset join point through the first aspect base, so that the modified authentication function can be realized without modifying the source code of the server and affecting other functions of the server, which is very convenient.

[0120] The first sending module 13 is configured to send the access data to the client.

[0121] The authentication device of the embodiments of the present specification is applied to a server, and the determining module 12 realizes the authentication function through the first aspect program pre-injected at the first preset join point of the server, so that the authentication function is decoupled from other functions of the server, avoiding interference with other functions; the determining module 12 determines the access permission of the client through authentication, and returns access data according to the access permission, so as to realize fine-grained access control.

[0122] As shown in Figure 4 Another embodiment of the present specification provides an authentication device applied to a client, and a second preset join point of the client is pre-injected with a second aspect program. The authentication device comprises a generating module 21, a collecting module 22, a second sending module 23 and a second receiving module 24.

[0123] The generating module 21 is configured to generate an access request for accessing the server when the client accesses the server.

[0124] The collecting module 22 is configured to collect the identity information of the client through the second aspect program, and insert the identity information of the client into the access request.

[0125] The second aspect program is pre-injected at the second preset join point of the server. It can be injected into the second preset join point through the second aspect base pre-deployed on the server. The injection mode can be static injection or dynamic injection.

[0126] In some embodiments, the identity information of the client can include any suitable information for proving the identity of the client, such as the model of the terminal device on which the client is installed, the SN (serial number), the application program version number, the terminal identity certificate, the user's mobile phone number, etc.

[0127] In some embodiments, after the second aspect program collects the identity information of the client, it can first perform legality verification on the identity information to determine whether it is legal, and if so, insert it into the access request; otherwise, directly determine that the identity information of the client is illegal and no longer perform subsequent processes.

[0128] In some embodiments, after the second aspect program collects the identity information of the client, the identity information can also be preprocessed (for example, hash calculation) first, and then the preprocessed identity information is inserted into the access request.

[0129] Since the above authentication function is implemented by the second aspect program, when it needs to be changed, only the second aspect program needs to be modified, and then the modified second aspect program is distributed to the second aspect base of the client through the aspect server, and is re-injected to the second aspect point through the second aspect base, so that the modified authentication function can be implemented, without the need to modify the source code of the client, and without affecting other functions of the client, which is very convenient.

[0130] The second sending module 23 is configured to send the access request carrying the identity information of the client to the server, so that the server confirms the identity of the client according to the identity information of the client, and determines the access right of the client according to the identity of the client, and then acquires the access data according to the access right of the client and sends the access data to the client.

[0131] The second receiving module 24 is configured to receive the access data sent by the server.

[0132] The access data sent by the server is the access data acquired by the server after authenticating the client, which can avoid privacy leakage caused by unauthorized access of the client.

[0133] In some embodiments, the access data includes an accessible field, and the server acquires the accessible field of the client according to the field-based access right, which can realize field-granularity authentication access control, so as to realize more secure and fine access control.

[0134] The authentication device of the embodiments of the present specification is applied to a client, and the collection module 22 realizes the authentication function through the second aspect program pre-injected at the second preset aspect point of the client, so that the authentication function is decoupled from other functions of the client, avoiding interference with other functions.

[0135] Another embodiment of the present specification provides a readable storage medium having a computer program stored thereon, when the computer program is executed in a computer, the computer executes the steps of the authentication method in the above embodiments of the present specification.

[0136] Another embodiment of the present specification provides a computing device including a memory and a processor, the memory having executable code stored therein, when the processor executes the executable code, it executes the steps of the authentication method in the above embodiments of the present specification.

[0137] The systems, apparatuses, modules, or units disclosed in the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0138] For the sake of description, the above apparatuses are described in various units by functions for description. Of course, the functions of the units can be implemented in one or more software and / or hardware in implementing the present specification.

[0139] Those skilled in the art should understand that the embodiments of the present specification can be provided as a method, a system, or a computer program product. Therefore, the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer-usable program code.

[0140] The present specification is described with reference to flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present specification. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and combinations of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the flow Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The functions specified in a flow or multiple flows and / or blocks

[0141] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the flow Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The functions specified in a flow or multiple flows and / or blocks

[0142] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 Figure 1

[0143] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0144] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the processor can execute instructions. The memory can also include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), flash memory, or a combination of non-volatile memories in different types. The memory is an example of computer readable storage media.

[0145] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0146] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0147] ​​Those skilled in the art will appreciate that embodiments of the present specification can be devised for a method, a system, or a computer program product. Accordingly, the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present specification can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer-usable program code.

[0148] The present specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0149] The various embodiments described in the specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0150] The above description is only the preferred embodiment of the present specification, and is not intended to limit the scope of the present specification. The above-described embodiments of the present specification can be variously changed. That is, any simple, equivalent change and modification made according to the present specification, claims and specification contents are included in the scope of the present specification. The present specification does not describe all the conventional technical contents.

Claims

1. An authentication method applied to a server, wherein a first aspect program is pre-injected at a first preset point in the server, the first preset point including a function of the server for receiving access requests; the authentication method includes: When a client accesses a server, the function for receiving access requests receives an access request sent by the client to access the server; wherein, the access request carries the client's identity information; The first segmentation program determines the client's identity based on the client's identity information, determines the client's access permissions based on the client's identity, and then obtains access data based on the client's access permissions; The access data is sent to the client; Obtaining access data based on the client's access permissions specifically includes: The accessible fields of the client are determined based on the client's access permissions; Obtain all accessible fields of the client as access data.

2. The authentication method according to claim 1, wherein determining the identity of the client based on the client's identity information specifically includes: The client's identity information is compared with pre-stored standard identity information to determine the client's identity.

3. The authentication method according to claim 1, wherein determining the client's access permissions based on the client's identity specifically includes: The system searches for the client's access permissions in a preset access permission configuration table based on the client's identity.

4. An authentication method applied to a client, wherein a second aspect is pre-injected at a second preset point in the client, and a first aspect is pre-injected at a first preset point in the server, the first preset point including a function of the server for receiving access requests; the authentication method includes: When the client accesses the server, an access request for accessing the server is generated; The second aspect program collects the client's identity information and inserts the client's identity information into the access request; An access request carrying the client's identity information is sent to the server. When the server receives the access request from the client through the function for receiving access requests, it triggers the first aspect program to verify the client's identity based on the client's identity information, determine the client's access permissions based on the client's identity, and then obtain access data based on the client's access permissions and send the access data to the client. The access data consists of all accessible fields of the client determined and obtained by the first aspect program based on the client's access permissions. Receive access data sent by the server.

5. An authentication device applied to a server, wherein a first aspect program is pre-injected at a first preset point in the server, the first preset point including a function of the server for receiving access requests; the authentication device comprises: The first receiving module is used to receive, when a client accesses a server, an access request sent by the client for accessing the server through the function for receiving access requests; wherein the access request carries the client's identity information; The determination module is used to determine the identity of the client based on the client's identity information through the first aspect program, determine the client's access permissions based on the client's identity, and then obtain access data based on the client's access permissions; The first sending module is used to send the access data to the client; Obtaining access data based on the client's access permissions specifically includes: The accessible fields of the client are determined based on the client's access permissions; Obtain all accessible fields of the client as access data.

6. The authentication device according to claim 5, wherein determining the identity of the client based on the client's identity information specifically includes: The client's identity information is compared with pre-stored standard identity information to determine the client's identity.

7. The authentication device according to claim 5, wherein determining the client's access permissions based on the client's identity specifically includes: The system searches for the client's access permissions in a preset access permission configuration table based on the client's identity.

8. An authentication device applied to a client, wherein a second aspect is pre-injected at a second preset point in the client, and a first aspect is pre-injected at a first preset point in the server, the first preset point including a function of the server for receiving access requests; the authentication device comprises: The generation module is used to generate an access request for accessing the server when the client accesses the server. The acquisition module is used to acquire the client's identity information through the second aspect program and insert the client's identity information into the access request; The second sending module is used to send an access request carrying the client's identity information to the server, so that when the server receives the access request sent by the client for accessing the server through the function for receiving access requests, it triggers the first aspect program to confirm the client's identity based on the client's identity information, determine the client's access permissions based on the client's identity, and then obtain access data based on the client's access permissions and send the access data to the client; wherein, the access data is all accessible fields of the client determined and obtained by the first aspect program based on the client's access permissions; The second receiving module is used to receive access data sent by the server.

9. A readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to implement the authentication method as described in any one of claims 1-4.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the authentication method as described in any one of claims 1-4.

Images