Application access method, device, equipment and storage medium based on multiple authentication modes

Abstract

The present invention discloses an application access method, device, equipment and storage medium based on multiple authentication modes, including: receiving an application access request sent by a client, wherein the application access request includes token information; querying a pre-configured authentication mode, and verifying the token information in the application access request based on the authentication mode, wherein the authentication mode includes an instant authentication mode, a proxy authentication mode or a token authentication mode; when it is determined that the token information is verified, the application resources are retrieved, and the application resources are sent to the client to respond to the application access request. By pre-configuring the authentication mode according to the needs of the application scenario, authentication is performed based on the pre-configured authentication mode when the application access request is obtained. Since the authentication mode includes an instant authentication mode, a proxy authentication mode or a token authentication mode, and different authentication modes correspond to different authentication speeds, the user authentication needs in different application scenarios are met.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an application access method, device, equipment and storage medium based on multiple authentication modes. Background Art

[0002] When accessing an application, it is usually necessary to authenticate the access request to determine whether the accessing user has the right to access the application's resources. Currently, the system usually supports an authentication method for accessing the application. The system authenticates the access request based on the configured authentication method.

[0003] However, when the only authentication method configured by the system is used for authentication, the choices of users and developers are usually limited. Some users may prefer to use different authentication methods, but the system cannot meet the needs of users. In addition, different scenarios may have different requirements for the authentication speed of accessing applications. For example, in a microservice architecture, a request may need to go through multiple services to complete, and each service may need to be authenticated. If the authentication speed is not fast enough, it may cause the entire request to take too long to process. When the system only supports one authentication method, it is usually unable to meet the authentication speed requirements for some specified types of microservice architectures. Summary of the invention

[0004] The present invention provides an application access method based on multiple authentication modes to realize application access under multiple authentication modes.

[0005] According to a first aspect of the present invention, there is provided an application access method based on a multi-authentication mode, comprising: receiving an application access request sent by a client, wherein the application access request includes token information;

[0006] Querying a pre-configured authentication mode, and verifying the token information in the application access request based on the authentication mode, wherein the authentication mode includes an instant verification mode, a proxy verification mode, or a token verification mode;

[0007] When it is determined that the token information verification has passed, the application resource is retrieved and sent to the client to respond to the application access request.

[0008] According to another aspect of the present invention, there is provided an application access device based on a multi-authentication mode, comprising: an application access request receiving module, configured to receive an application access request sent by a client, wherein the application access request includes token information;

[0009] A token information verification module, used to query a pre-configured authentication mode and verify the token information in the application access request based on the authentication mode, wherein the authentication mode includes an instant verification mode, a proxy verification mode or a token verification mode;

[0010] The application resource calling module is used to call the application resource when it is determined that the token information verification is passed, and send the application resource to the client to respond to the application access request.

[0011] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0012] at least one processor; and

[0013] a memory communicatively connected to the at least one processor; wherein,

[0014] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform the method described in any embodiment of the present invention.

[0015] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method described in any embodiment of the present invention when executed.

[0016] The technical solution of the embodiment of the present invention pre-configures the authentication mode according to the requirements of the application scenario, so that when an application access request is obtained, authentication is performed based on the pre-configured authentication mode. Since the authentication mode includes an instant verification mode, a proxy verification mode or a token verification mode, and different authentication modes correspond to different authentication speeds, the authentication needs of users in different application scenarios are met.

[0017] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1is a flowchart of an application access method based on multiple authentication modes provided according to Embodiment 1 of the present invention;

[0020] Figure 2 is a flowchart of an application access method based on multiple authentication modes provided according to Embodiment 2 of the present invention;

[0021] Figure 3 is a schematic diagram of the structure of an application access device based on multiple authentication modes provided according to Embodiment 3 of the present invention;

[0022] Figure 4 It is a schematic diagram of the structure of an electronic device provided by Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] Embodiment 1

[0026] Figure 1 A flowchart of a method for accessing an application based on multiple authentication modes is provided for the first embodiment of the present invention. This embodiment is applicable to the case of accessing an application based on multiple authentication modes. The method can be executed by an application access device based on multiple authentication modes, which can be implemented in the form of hardware and / or software. Figure 1 As shown, the method includes:

[0027] Step S101: receiving an application access request sent by a client.

[0028] Specifically, in this implementation, the application access request sent by the client is authenticated mainly by the server. The server mainly includes a business unit, an authentication unit, a proxy verification unit and a token verification unit, and the server mainly implements the authentication process of the access request based on the interaction process of the above-mentioned multiple units. In this implementation, the types and quantities of the units contained in the server are not limited.

[0029] It should be noted that when the client sends an application access request, it will add token information to the request header of the access request. Specifically, it is added in the Authorization field of the request header. The general form is Bearer <token>The token information in the access request may be the user authentication token fed back during the server user authentication phase, or it may be a fake token written by an illegal user. The content of the token information contained in the application access request is not limited in this implementation. Since there may be fake tokens in the application access request, the server needs to authenticate the token information in the application access request after receiving the application access request sent by the client.

[0030] Step S102: query a pre-configured authentication mode, and verify the token information in the application access request based on the authentication mode.

[0031] Optionally, the token information in the application access request is verified based on the authentication mode, including: when the authentication mode is an instant verification mode, matching the token information with the user authentication token in the local cache through the business unit, and determining that the token information verification is successful when the match is successful; when the authentication mode is a proxy verification mode, transmitting the token information to the proxy verification unit through the business unit, matching the token information with the user authentication token in the database through the proxy verification unit, and determining that the token information verification is successful when the match is successful; when the authentication mode is a token verification mode, transmitting the token information to the token verification unit through the business unit, and verifying the token information through the token verification unit.

[0032] Among them, in this implementation, the administrator can pre-configure different authentication modes in the server according to the needs of the application scenario, such as instant verification mode, proxy verification mode or token verification mode, and the server verifies the token information in the access request in different authentication modes. Among them, the instant verification mode and the proxy verification mode mainly adopt the token comparison method, but the storage location of the user authentication token used for the comparison between the two is different. For the token verification mode, the token information itself is mainly verified without additional comparison with other user authentication tokens. Of course, this implementation is only an example, and the specific type of authentication mode configured by the administrator is not limited.

[0033] In a specific implementation, when the authentication mode is the instant verification mode, since the legitimate user authentication token is stored in the local cache of the business unit during the user authentication stage, the token information in the access request is matched with the user authentication token in the local cache. For example, when the local cache includes user authentication token a, user authentication token b, user authentication token c and user authentication token d, when it is determined that the application access request is user authentication token a, it is determined that the token information in the application access request matches the user authentication token in the local cache successfully, and then it is determined that the token information verification is successful; when it is determined that the application access request is user authentication token aa, since it is different from any user authentication token in the local cache, it can be determined that the token information at this time may be forged by an attacker, and thus it is determined that the token information verification has failed. Of course, this implementation is only an example and does not limit the specific number of user authentication tokens stored in the local cache. In addition, when the authentication mode is the proxy authentication mode, since the legal user authentication token is stored in the database of the proxy authentication unit during the user identity authentication stage, the business unit will transmit the token information to the proxy authentication unit after determining the authentication mode, and match the token information with the user authentication token in the database through the proxy authentication unit. When it is determined that the token information in the application access request matches the user authentication token in the local cache successfully, it is determined that the token information verification is passed. It can be known that the principles of the instant authentication mode and the proxy authentication mode are roughly the same, only when matching, the execution subject and the source location of the user authentication token are different. The execution subject in the instant authentication mode is the business unit, and the user authentication token used for matching is stored in the local cache of the business unit. The execution subject in the proxy authentication mode is the proxy authentication unit, and the user authentication token used for matching is stored in the database of the proxy authentication unit, but the essence of the two modes is to use the token information to compare with the legal user authentication token. However, when the authentication mode is the token authentication mode, the business unit will transmit the token information to the token authentication unit, and the token authentication unit will verify the token information.

[0034] Optionally, the token information is verified by a token verification unit, including: parsing the token information by the token verification unit, and determining that the token information is complete when the header structure, payload structure and signature structure are obtained through the parsing; signing the header structure and payload structure with a private key to generate a verification signature structure, and determining the validity of the signature structure in the token information based on the verification signature structure; when the signature structure in the token information is valid, it is determined that the token information verification has passed.

[0035] Optionally, determining the validity of the signature structure in the token information based on the verification signature structure includes: determining whether the generated verification signature structure is the same as the signature structure in the token information; if so, determining that the signature structure in the token information is valid; otherwise, determining that the signature structure in the token information is invalid.

[0036] Among them, when the authentication mode is the token verification mode, the business unit will transmit the received token information to the token verification unit, and the token verification unit will parse the token information to verify the integrity of the token information. When it is determined through parsing that the header structure, payload structure and signature structure in the token information are all included, it means that the token information is complete, otherwise it is directly determined that the token information is invalid. When it is determined that the token information is complete, the token verification unit will also verify the correctness of the token information. When verifying the correctness, the private key will be used to sign the header structure and payload to generate a verification signature structure, and the verification signature structure will be compared with the parsed signature structure in the token information. If the two are the same, it means that the signature structure is valid. If they are not the same, it means that the signature structure is invalid. Only when it is determined that the token information structure is complete and the signature structure is valid, can it be determined that the token information verification has passed.

[0037] Step S103, when it is determined that the token information verification has passed, the application resource is retrieved and sent to the client to respond to the application access request.

[0038] Specifically, when it is determined that the token information in the application access request has been verified, it means that the accessing user is a registered legitimate user and has the right to access the application resources. At this time, the server will retrieve the application resources according to the application identifier in the application access request and send the retrieved application resources to the client, thereby facilitating the user to access the application based on the application resources obtained by the client.

[0039] It should be noted that when it is determined that the token information verification has failed, it means that the user accessing the application is an unregistered illegal user. Therefore, the server will not retrieve the application resources and send them to the client, but will generate a prompt message and feedback to the client, for example, "You do not have permission to access this application", and the client can display the prompt message in the form of voice or image. Of course, this implementation is only an example and does not limit the specific content and display method of the prompt message.

[0040] In the implementation mode of the present application, the authentication mode is pre-configured according to the requirements of the application scenario, so that when an application access request is obtained, authentication is performed based on the pre-configured authentication mode. Since the authentication mode includes an instant verification mode, a proxy verification mode or a token verification mode, and different authentication modes correspond to different authentication speeds, the authentication needs of users in different application scenarios are met.

[0041] Embodiment 2

[0042] Figure 2 The flowchart of a method for accessing an application based on multiple authentication modes is provided in the second embodiment of the present invention. This embodiment is based on the above embodiment. Before receiving the application access request sent by the client, it also includes: performing user identity authentication on the identity authentication request sent by the client through the authentication unit, and generating a user authentication token when the authentication is successful; querying the pre-configured authentication mode through the business unit, and processing the user authentication token based on the authentication mode. Figure 2 As shown, the method includes:

[0043] Step S201: Perform user identity authentication on the identity authentication request sent by the client through an authentication unit, and generate a user authentication token when the authentication is successful.

[0044] Optionally, the authentication unit performs user authentication on the authentication request sent by the client, and generates a user authentication token when the authentication is successful, including: verifying the account and password in the authentication request through the authentication unit, and obtaining the user identity information corresponding to the account when it is determined that the verification is successful, as well as the pre-set token type and signature algorithm; using the user identity information as the header structure, and using the token type and signature algorithm as the payload structure; using a private key to sign the header structure and the payload structure to generate a signature structure, and concatenating the header structure, the payload structure and the signature structure to generate a user authentication token.

[0045] Specifically, in this embodiment, before verifying the application access request sent by the client, the server will also perform user authentication on the identity authentication request sent by each client through the authentication unit, and will use different methods to process the user authentication token generated in the user authentication stage according to different authentication modes. Among them, when the user sends an identity authentication request to the server through the client, the server will call the authentication unit to verify the account and password in the identity authentication request. When it is determined that the account and password verification are correct, the user identity information corresponding to the account and the pre-configured token type and signature algorithm will be obtained, and the user identity information will be used as the header structure, and the token type and signature algorithm will be used as the payload structure. Of course, the payload structure can also include other meaningful information that needs to be transmitted, such as permission declarations, etc., but it does not contain sensitive information, because the token itself is decodable, but a signature can be used to protect its integrity and authenticity. Therefore, in this embodiment, after obtaining the header structure and the payload structure, the private key will be used to sign the header structure and the payload structure to generate a signature structure, and the obtained header structure, payload structure and signature structure will be spliced ​​together in sequence to generate a user authentication token, and the user authentication token is specifically in the form of a string. In this embodiment, the integrity and authenticity of the user identity information and user permissions are guaranteed by signing the header structure and the payload structure.

[0046] Step S202: query the pre-configured authentication mode through the business unit, and process the user authentication token based on the authentication mode.

[0047] Optionally, the user authentication token is processed based on the authentication mode, including: when the authentication mode is an instant authentication mode, the user authentication token is cached locally on the server through the business unit, and the user authentication token is sent to the client; when the authentication mode is a proxy authentication mode, the user authentication token is sent to the database of the proxy authentication unit for storage through the business unit, and the user authentication token is sent to the client; when the authentication mode is a token authentication mode, the user authentication token is directly sent to the client through the business unit.

[0048] Among them, after the business unit in this embodiment generates a user authentication token according to the identity authentication request, it will query the pre-configured authentication mode, where the type of authentication mode may include instant verification mode, proxy verification mode or token verification mode, etc. Of course, this embodiment is only an example for illustration, and does not limit the specific type of authentication mode, and different methods will be used to process user authentication tokens according to different types of authentication modes.

[0049] For example, when the authentication mode is the instant verification mode, it means that the speed requirement for verification is relatively high when the client accesses the application later. At this time, the business unit directly caches the user authentication token locally on the server and sends the user authentication token to the client. When the authentication mode is the proxy verification mode, it means that there are many users currently undergoing user authentication, and the space occupied by the generated user authentication token is large. At this time, the business unit will send the generated user authentication token to the database of the proxy verification unit for storage, and send the user authentication token to the client. It can be seen that no matter whether it is the instant verification mode or the proxy verification mode, after the user authentication token is generated in the user authentication stage, the generated user authentication token will not be cached locally or saved in the database. However, when the authentication mode is the token verification mode, the user authentication token will be directly sent to the client through the business unit, and the user authentication token will not be stored in the server.

[0050] It should be noted that since the instant authentication mode, proxy authentication mode and token authentication mode have different ways of processing user authentication tokens, and since the instant authentication mode and proxy authentication mode respectively pre-store user authentication tokens, and the user authentication token of the instant authentication mode is stored in the local cache, the user authentication token of the proxy authentication mode is stored in the database, and the token authentication mode does not pre-store user authentication tokens, the authentication speeds of the instant authentication mode, proxy authentication mode and token authentication mode decrease in turn, and administrators can pre-configure corresponding authentication modes in the server system according to the needs of the application scenarios.

[0051] Step S203: receiving an application access request sent by the client.

[0052] Step S204: query the pre-configured authentication mode, and verify the token information in the application access request based on the authentication mode.

[0053] Optionally, the token information in the application access request is verified based on the authentication mode, including: when the authentication mode is an instant verification mode, matching the token information with the user authentication token in the local cache through the business unit, and determining that the token information verification is successful when the match is successful; when the authentication mode is a proxy verification mode, transmitting the token information to the proxy verification unit through the business unit, matching the token information with the user authentication token in the database through the proxy verification unit, and determining that the token information verification is successful when the match is successful; when the authentication mode is a token verification mode, transmitting the token information to the token verification unit through the business unit, and verifying the token information through the token verification unit.

[0054] Optionally, the token information is verified by a token verification unit, including: parsing the token information by the token verification unit, and determining that the token information is complete when the header structure, payload structure and signature structure are obtained through the parsing; signing the header structure and payload structure with a private key to generate a verification signature structure, and determining the validity of the signature structure in the token information based on the verification signature structure; when the signature structure in the token information is valid, it is determined that the token information verification has passed.

[0055] Optionally, determining the validity of the signature structure in the token information based on the verification signature structure includes: determining whether the generated verification signature structure is the same as the signature structure in the token information; if so, determining that the signature structure in the token information is valid; otherwise, determining that the signature structure in the token information is invalid.

[0056] Step S205 , when it is determined that the token information verification has passed, the application resource is retrieved and sent to the client to respond to the application access request.

[0057] In the implementation mode of the present application, the authentication mode is pre-configured according to the requirements of the application scenario, so that when an application access request is obtained, authentication is performed based on the pre-configured authentication mode. Since the authentication mode includes an instant verification mode, a proxy verification mode or a token verification mode, and different authentication modes correspond to different authentication speeds, the authentication needs of users in different application scenarios are met.

[0058] Embodiment 3

[0059] Figure 3 The schematic diagram of the structure of an application access device based on multiple authentication modes provided in the third embodiment of the present invention. Figure 3 As shown, the device includes: an application access request receiving module 310, a token information verification module 320 and an application resource calling module 330.

[0060] The application access request receiving module 310 is used to receive an application access request sent by a client, wherein the application access request includes token information;

[0061] A token information verification module 320, used to query a pre-configured authentication mode and verify the token information in the application access request based on the authentication mode, wherein the authentication mode includes an instant authentication mode, a proxy authentication mode or a token authentication mode;

[0062] The application resource calling module 330 is used to call the application resource when it is determined that the token information verification is passed, and send the application resource to the client to respond to the application access request.

[0063] Optionally, the device further comprises: a user authentication token generation module, which is used to perform user identity authentication on the identity authentication request sent by the client through the authentication unit, and generate a user authentication token when the authentication is successful;

[0064] The user authentication token processing module is used to query the pre-configured authentication mode through the business unit and process the user authentication token based on the authentication mode.

[0065] Optionally, a user authentication token generation module is used to verify the account number and password in the identity authentication request through the authentication unit, and when it is determined that the verification is successful, obtain the user identity information corresponding to the account number, as well as the preset token type and signature algorithm;

[0066] Use user identity information as the header structure, and token type and signature algorithm as the payload structure;

[0067] The private key is used to sign the header and payload to generate a signature structure, and the header structure, payload structure and signature structure are concatenated to generate a user authentication token.

[0068] Optionally, a user authentication token processing module is used to cache the user authentication token locally on the server through the business unit when the authentication mode is the instant verification mode, and send the user authentication token to the client;

[0069] When the authentication mode is the proxy authentication mode, the user authentication token is sent to the database of the proxy authentication unit through the business unit for storage, and the user authentication token is sent to the client;

[0070] When the authentication mode is token verification mode, the user authentication token is directly sent to the client through the business unit.

[0071] Optionally, a token information verification module is used to match the token information with the user authentication token cached locally through the business unit when the authentication mode is the instant verification mode, and determine that the token information verification is successful when the match is successful;

[0072] When the authentication mode is the proxy authentication mode, the token information is transmitted to the proxy authentication unit through the business unit, and the token information is matched with the user authentication token in the database through the proxy authentication unit. When the match is successful, it is determined that the token information verification is passed;

[0073] When the authentication mode is the token verification mode, the token information is transmitted to the token verification unit through the business unit, and the token information is verified by the token verification unit.

[0074] Optionally, a token information verification module is used to parse the token information through the token verification unit, and determine that the token information is complete when the header structure, payload structure and signature structure are obtained through the parsing;

[0075] The header structure and the payload structure are signed with a private key to generate a verification signature structure, and the validity of the signature structure in the token information is determined based on the verification signature structure;

[0076] When the signature structure in the token information is valid, it is determined that the token information verification is successful.

[0077] Optionally, a token information verification module is used to determine whether the generated verification signature structure is the same as the signature structure in the token information. If so, the signature structure in the token information is determined to be valid.

[0078] Otherwise, the signature structure in the token information is determined to be invalid.

[0079] The application access device based on multiple authentication modes provided in the embodiment of the present invention can execute the application access method based on multiple authentication modes provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0080] Embodiment 4

[0081] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0082] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0083] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0084] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as an application access method based on a multi-authentication mode.

[0085] In some embodiments, the application access method based on multiple authentication modes may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the application access method based on multiple authentication modes described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the application access method based on multiple authentication modes in any other appropriate manner (e.g., by means of firmware).

[0086] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0087] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0088] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0089] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0090] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0091] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0092] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0093] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.< / token>

Claims

1. An application access method based on multiple authentication modes, characterized in that: Applicable to servers, including: Receiving an application access request sent by a client, wherein the application access request includes token information; Querying a pre-configured authentication mode, and verifying the token information in the application access request based on the authentication mode, wherein the authentication mode includes an instant verification mode, a proxy verification mode, or a token verification mode; When it is determined that the token information verification is passed, the application resource is retrieved and the application resource is sent to the client to respond to the application access request; The server includes a business unit and an authentication unit, and before receiving the application access request sent by the client, it also includes: Performing user identity authentication on the identity authentication request sent by the client through the authentication unit, and generating a user authentication token when the authentication is successful; querying the pre-configured authentication mode through the business unit, and processing the user authentication token based on the authentication mode; The server further includes a token verification unit, and the verification of the token information in the application access request based on the authentication mode includes: When the authentication mode is an instant verification mode, the token information is matched with the user authentication token in the local cache by the business unit, and when the match is successful, it is determined that the token information is verified; When the authentication mode is a proxy authentication mode, the token information is transmitted to a proxy authentication unit through the business unit, and the token information is matched with the user authentication token in the database through the proxy authentication unit, and when the match is successful, it is determined that the token information is authenticated; When the authentication mode is a token verification mode, the token information is transmitted to the token verification unit through the service unit, and the token information is verified by the token verification unit.

2. The method according to claim 1, characterized in that The authentication unit performs user authentication on the identity authentication request sent by the client, and generates a user authentication token when the authentication is successful, including: Verifying the account number and password in the identity authentication request through the authentication unit, and obtaining the user identity information corresponding to the account number, as well as the preset token type and signature algorithm when it is determined that the verification is successful; The user identity information is used as a header structure, and the token type and the signature algorithm are used as a payload structure; The header structure and the payload structure are signed with a private key to generate a signature structure, and the header structure, the payload structure and the signature structure are concatenated to generate the user authentication token.

3. The method according to claim 1, characterized in that The processing of the user authentication token based on the authentication mode includes: When the authentication mode is the instant verification mode, the user authentication token is cached locally on the server through the business unit, and the user authentication token is sent to the client; When the authentication mode is a proxy authentication mode, the user authentication token is sent to the database of the proxy authentication unit through the business unit for storage, and the user authentication token is sent to the client; When the authentication mode is a token verification mode, the user authentication token is directly sent to the client through the service unit.

4. The method according to claim 1, characterized in that: The verifying the token information by the token verification unit includes: The token information is parsed by the token verification unit, and when the header structure, the payload structure and the signature structure are obtained through the parsing, it is determined that the token information is complete; Using a private key to sign the header structure and the payload structure to generate a verification signature structure, and determining the validity of the signature structure in the token information according to the verification signature structure; When the signature structure in the token information is valid, it is determined that the token information is verified.

5. The method according to claim 4, characterized in that Determining the validity of the signature structure in the token information according to the verification signature structure includes: Determine whether the generated verification signature structure is the same as the signature structure in the token information, and if so, determine that the signature structure in the token information is valid, Otherwise, it is determined that the signature structure in the token information is invalid.

6. An application access device based on multiple authentication modes, characterized in that: include: An application access request receiving module, used to receive an application access request sent by a client, wherein the application access request includes token information; A token information verification module, used to query a pre-configured authentication mode and verify the token information in the application access request based on the authentication mode, wherein the authentication mode includes an instant verification mode, a proxy verification mode or a token verification mode; An application resource calling module, used to call application resources when it is determined that the token information verification is passed, and send the application resources to the client to respond to the application access request; The device further comprises: a user authentication token generation module, which is used to perform user identity authentication on the identity authentication request sent by the client through the authentication unit, and generate a user authentication token when the authentication is passed; A user authentication token processing module, used to query the pre-configured authentication mode through the business unit, and process the user authentication token based on the authentication mode; The token information verification module is used to match the token information with the user authentication token in the local cache through the business unit when the authentication mode is the instant verification mode, and determine that the token information verification is passed when the match is successful; When the authentication mode is the proxy authentication mode, the token information is transmitted to the proxy authentication unit through the business unit, and the token information is matched with the user authentication token in the database through the proxy authentication unit, and when the match is successful, it is determined that the token information is authenticated; When the authentication mode is a token verification mode, the token information is transmitted to the token verification unit through the service unit, and the token information is verified by the token verification unit.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 5 when executed.

Images