A cloud platform account authentication method and system

Abstract

The present invention designs a cloud platform account authentication method and system. The user initiates a login request by inputting a user name and password. The authentication server verifies the validity of the user information, generates an encrypted authentication token, and sets a validity period. If the verification fails, the user will receive a corresponding error message. Once the authentication is successful, the user end will store the authentication token and send it to the cloud platform server at each request. The cloud platform server parses the authentication token and uses the same encryption algorithm to verify its legitimacy and validity period. If the authentication token is invalid or expired, the cloud platform server will reject the request and prompt the user to log in again. For a valid and legal authentication token, the user can perform corresponding operations. The authentication server will refresh the authentication token when the authentication token is close to expiration, and return the new authentication token to the cloud platform server to maintain the user's login status.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing and information security technology, and more specifically, to a cloud platform account authentication method and system. Background Art

[0002] With the continuous development of cloud computing technology, more and more enterprises and individuals choose to use cloud platforms to store and manage data. On the cloud platform, users need to verify their identities through account authentication to ensure that only legitimate users can access and operate data and resources on the cloud platform. At present, common cloud platform account authentication methods mainly include username and password authentication, SMS verification code authentication, two-factor authentication, etc. However, these authentication methods have some security risks and inconveniences. Therefore, a more secure and convenient cloud platform account authentication method and system are needed to meet user needs.

[0003] The existing authentication method needs to store the state information related to the client, which will increase the load of the server and may be blocked when transmitting in different domains. Summary of the invention

[0004] In order to overcome the problems in the prior art that the need to store status information related to the client during authentication increases the load on the server, and that transmission in different domains may be blocked, the present invention designs a cloud platform account authentication method and system that can effectively solve the above problems.

[0005] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0006] A cloud platform account authentication method includes the following steps:

[0007] S1. The user enters the user name and password through the user terminal to initiate a login request, and the user terminal sends the login request to the authentication server;

[0008] S2, the authentication server receives the login request and retrieves the user information from the database;

[0009] S3. If the user information identity authentication is passed, the authentication server generates a unique authentication token using an encryption algorithm, sets the authentication token transmission rules, stores it in the database, and sets the expiration time of the authentication token. If the user information matching the user name and password is not retrieved in the database, the authentication server returns the authentication failure information to the user end;

[0010] S4. The authentication server returns the generated authentication token to the user end. The user end stores the received authentication token locally and sends it to the cloud platform server in subsequent requests.

[0011] S5. The cloud platform server receives the request from the user and parses and verifies the authentication token;

[0012] S6. The cloud platform server uses an encryption algorithm to verify the legitimacy of the authentication token and checks whether the authentication token has expired. If the authentication token is illegal or expired, the cloud platform server returns information that the account authentication has failed to the user and requires the user to log in again.

[0013] S7. If the authentication token is legal and has not expired, the cloud platform server allows the user to perform corresponding operations, and the cloud platform server requests the authentication server to refresh the authentication token at 80% of the validity period of the authentication token;

[0014] S8. After receiving the request to refresh the authentication token, the authentication server generates a new authentication token using an encryption algorithm, stores it in the database, updates the corresponding authentication token information in the database, and then returns the new authentication token to the cloud platform server.

[0015] Preferably, the authentication token uses the JWT format, and the JWT authentication token includes a header, a payload, and a signature. The header includes an algorithm identifier and an encryption key, the payload includes user information and permission information, and the signature is the result of encrypting the header and the payload. The algorithm identifier is used to indicate the encryption algorithm used by the authentication server, and the encryption key is used to encrypt the header and the payload.

[0016] The specific steps of generating the JWT authentication token in step S3 are:

[0017] S31, after the user logs in, the authentication server generates the JWT authentication token according to the user information;

[0018] S32, using the encryption algorithm RSA to generate a public key and a private key pair, the private key is used to sign the JWT authentication token, and the public key is used to verify the signature;

[0019] S33, the header of the JWT authentication token contains metadata of the authentication token, including algorithm, type and encryption key;

[0020] S34, the payload of the JWT authentication token contains the actual data to be transmitted, including the user's identity information and permissions;

[0021] S35. Sign the header and the payload using the private key to generate a signature part;

[0022] S36. Concatenate the header, the payload, and the signature part into a complete JWT string.

[0023] Preferably, the header and the payload are encrypted using the HMAC-SHA256 algorithm, and the specific steps are as follows:

[0024] S21, generating a random encryption key;

[0025] S22, using the HMAC-SHA256 algorithm to perform hash processing on the random encryption key and the user information to obtain an HMAC summary;

[0026] S23, concatenating the HMAC digest and the random encryption key to obtain the header and the payload of the JWT authentication token;

[0027] S24. Encode the header and the payload using Base64 encoding to obtain a string representation of the JWT authentication token;

[0028] S25, storing the string representation of the JWT authentication token in a database and setting an expiration time;

[0029] S26. Add an access control list. When storing the JWT authentication token, apply the access control list to the database entry to restrict access to the JWT authentication token. Only authorized users or system components can read, update or delete the JWT authentication token entry.

[0030] S27. Establish a token revocation list in the database. When the JWT authentication token is stolen, the user actively logs out, or other security incidents occur, the token revocation list can immediately revoke the JWT authentication token.

[0031] Preferably, the specific transmission rules of the JWT authentication token are:

[0032] Add the Authorization field in the HTTP header of each request and use the Bearer scheme to pass the JWT authentication token;

[0033] The JWT authentication token is stored in the LocalStorage or SessionStorage of the client, or is passed in the Authorization header of each request and sent to the cloud platform server with each request. The cloud platform server obtains the JWT authentication token by parsing;

[0034] The JWT authentication token can only be passed under a specific URL path;

[0035] The JWT authentication token can only be verified by its own signature and validity period;

[0036] The JWT authentication token is only valid within a specific time frame;

[0037] The JWT authentication token is set to be one-time use, that is, it will become invalid after being used once;

[0038] The JWT authentication token includes multiple Payload parts, each of which corresponds to different permissions or information.

[0039] Preferably, the specific steps of verifying the JWT authentication token are:

[0040] S61, the cloud platform server receives the user's request and obtains the JWT authentication token;

[0041] S62, split the JWT authentication token, and decode the header and the payload respectively;

[0042] S63. Use the same key and algorithm to sign the concatenated string to generate a signature value;

[0043] S64. Compare the generated signature value with the signature in the JWT authentication token to verify the authenticity and integrity of the JWT authentication token;

[0044] S64. Check the expiration time in the JWT authentication token to ensure that the authentication token has not expired.

[0045] A cloud platform account authentication system includes a user terminal module, an authentication server module, a database module, a cloud platform server module, an encryption algorithm module, an authentication token management module and an authentication failure processing module;

[0046] The user-side module is used to allow the user to enter a username and password and send a login request to the authentication server; receive and store the authentication token and send it to the cloud platform server in subsequent requests;

[0047] The authentication server module is used to receive a user's login request, verify the user's identity, generate an authentication token, set authentication token transfer rules, and store them in a database, receive a request to refresh the authentication token, generate a new authentication token and update the database;

[0048] The database module is used to store user information, authentication tokens and related authentication information;

[0049] The cloud platform server module is used to receive requests from the user end, parse and verify the authentication token, verify its legitimacy and whether it is expired, and when the authentication token is legal and not expired, allow the user to perform corresponding operations and request the authentication server to refresh the authentication token.

[0050] The encryption algorithm module is used to generate and verify the legitimacy of the authentication token to ensure the security and uniqueness of the token;

[0051] The authentication token management module is used to manage the generation, storage, update and verification of authentication tokens, including setting expiration time and refreshing token functions;

[0052] The authentication failure processing module is used to process authentication failures, return corresponding failure information to the user end, and require the user to log in again;

[0053] The user-end module and the authentication server module are bidirectionally connected, the authentication server module and the database module are connected, and the authentication server module and the cloud platform server module are bidirectionally connected; the cloud platform server module and the database module are connected; the cloud platform server module and the encryption algorithm module are connected; the authentication server module and the encryption algorithm module are connected, the encryption algorithm module is connected to the database module, the authentication server module and the authentication token management module are connected; the authentication server module and the authentication failure processing module are connected.

[0054] Preferably, the authentication token uses the JWT format, and the JWT authentication token includes a header, a payload and a signature. The header contains an algorithm identifier and an encryption key, the payload contains user information and permission information, the signature is the result of encrypting the header and the payload, the algorithm identifier is used to indicate the encryption algorithm used by the authentication server, and the encryption key is used to encrypt the header and the payload.

[0055] The specific steps for the authentication server module to generate a JWT authentication token are:

[0056] S31, after the user logs in, the authentication server generates the JWT authentication token according to the user information;

[0057] S32, using the encryption algorithm RSA to generate a public key and a private key pair, the private key is used to sign the JWT authentication token, and the public key is used to verify the signature;

[0058] S33, the header of the JWT authentication token contains metadata of the authentication token, including algorithm, type and encryption key;

[0059] S34, the payload of the JWT authentication token contains the actual data to be transmitted, including the user's identity information and permissions;

[0060] S35. Sign the header and the payload using the private key to generate a signature part;

[0061] S36. Concatenate the header, the payload, and the signature part into a complete JWT string.

[0062] Preferably, the encryption algorithm module uses the HMAC-SHA256 algorithm to encrypt the header and the payload, and the specific steps are as follows:

[0063] S21, generating a random encryption key;

[0064] S22, using the HMAC-SHA256 algorithm to perform hash processing on the random encryption key and the user information to obtain an HMAC summary;

[0065] S23, concatenating the HMAC digest and the random encryption key to obtain the header and the payload of the JWT authentication token;

[0066] S24. Encode the header and the payload using Base64 encoding to obtain a string representation of the JWT authentication token;

[0067] S25, storing the string representation of the JWT authentication token in a database and setting an expiration time;

[0068] S26. Add an access control list. When storing the JWT authentication token, apply the access control list to the database entry to restrict access to the JWT authentication token. Only authorized users or system components can read, update or delete the JWT authentication token entry.

[0069] S27. Establish a token revocation list in the database. When the JWT authentication token is stolen, the user actively logs out, or other security incidents occur, the token revocation list can immediately revoke the JWT authentication token.

[0070] Preferably, the specific transmission rules of the JWT authentication token are:

[0071] Add the Authorization field in the HTTP header of each request and use the Bearer scheme to pass the JWT authentication token;

[0072] The JWT authentication token is stored in the LocalStorage or SessionStorage of the client, or is passed in the Authorization header of each request and sent to the cloud platform server with each request. The cloud platform server obtains the JWT authentication token by parsing;

[0073] The JWT authentication token can only be passed under a specific URL path;

[0074] The JWT authentication token can only be verified by its own signature and validity period;

[0075] The JWT authentication token is only valid within a specific time frame;

[0076] The JWT authentication token is set to be one-time use, that is, it will become invalid after being used once;

[0077] The JWT authentication token includes multiple Payload parts, each of which corresponds to different permissions or information.

[0078] Preferably, the specific steps of the cloud platform server module verifying the JWT authentication token are:

[0079] S61, the cloud platform server receives the user's request and obtains the JWT authentication token;

[0080] S62, split the JWT authentication token, and decode the header and the payload respectively;

[0081] S63. Use the same key and algorithm to sign the concatenated string to generate a signature value;

[0082] S64. Compare the generated signature value with the signature in the JWT authentication token to verify the authenticity and integrity of the JWT authentication token;

[0083] S64. Check the expiration time in the JWT authentication token to ensure that the authentication token has not expired.

[0084] Compared with the prior art, the beneficial effects of the technical solution of the present invention are as follows: a cloud platform account authentication method and system designed by the present invention sets the JWT authentication token on the authentication server, and the JWT authentication token realizes cross-domain authentication by carrying the authentication token in the header or request parameters of the HTTP request. When a cross-domain request is made, the browser will automatically send the JWT authentication token to the cloud platform server without the need for special cross-domain configuration, so it is not restricted by the browser's homology policy and can be freely transferred between different domains; in addition, the JWT authentication token is stateless, and the cloud platform server does not need to store any status information in the session. The JWT authentication token contains the user's authentication information and related permission information. The cloud platform server can verify the user's identity based on the JWT authentication token and extract necessary information from it for authorization and access control without storing any session status information on the cloud platform server, thereby effectively reducing the server load. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived based on the provided drawings without paying any creative work.

[0086] Figure 1 This is a step diagram of a cloud platform account authentication method;

[0087] Figure 2 This is a structural diagram of a cloud platform account authentication system.

[0088] Among them, 1. User-side module; 2. Authentication server module; 3. Database module; 4. Cloud platform server module; 5. Encryption algorithm module; 6. Authentication token management module; 7. Authentication failure processing module. DETAILED DESCRIPTION

[0089] The drawings are for illustrative purposes only and should not be construed as limiting the present patent;

[0090] In order to better illustrate the present embodiment, some parts in the drawings may be omitted, enlarged or reduced, and do not represent the size of the actual product;

[0091] It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0092] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0093] Example 1

[0094] A cloud platform account authentication method, such as Figure 1 As shown, the following steps are included:

[0095] S1. The user enters the user name and password through the user terminal to initiate a login request, and the user terminal sends the login request to the authentication server;

[0096] S2, the authentication server receives the login request and retrieves the user information from the database;

[0097] S3. If the user information identity authentication is passed, the authentication server generates a unique authentication token using an encryption algorithm, sets the authentication token transmission rules, stores it in the database, and sets the expiration time of the authentication token. If the user information matching the user name and password is not retrieved in the database, the authentication server returns the authentication failure information to the user end;

[0098] S4. The authentication server returns the generated authentication token to the user end. The user end stores the received authentication token locally and sends it to the cloud platform server in subsequent requests.

[0099] S5. The cloud platform server receives the request from the user and parses and verifies the authentication token;

[0100] S6. The cloud platform server uses an encryption algorithm to verify the legitimacy of the authentication token and checks whether the authentication token has expired. If the authentication token is illegal or expired, the cloud platform server returns information that the account authentication has failed to the user and requires the user to log in again.

[0101] S7. If the authentication token is legal and has not expired, the cloud platform server allows the user to perform corresponding operations, and the cloud platform server requests the authentication server to refresh the authentication token at 80% of the validity period of the authentication token;

[0102] S8. After receiving the request to refresh the authentication token, the authentication server generates a new authentication token using an encryption algorithm, stores it in the database, updates the corresponding authentication token information in the database, and then returns the new authentication token to the cloud platform server.

[0103] The authentication token uses the JWT format. The JWT authentication token includes a header, a payload, and a signature. The header includes an algorithm identifier and an encryption key. The payload includes user information and permission information. The signature is the result of encrypting the header and the payload. The algorithm identifier is used to indicate the encryption algorithm used by the authentication server. The encryption key is used to encrypt the header and the payload.

[0104] The specific steps of generating the JWT authentication token in step S3 are:

[0105] S31, after the user logs in, the authentication server generates the JWT authentication token according to the user information;

[0106] S32, using the encryption algorithm RSA to generate a public key and a private key pair, the private key is used to sign the JWT authentication token, and the public key is used to verify the signature;

[0107] S33, the header of the JWT authentication token contains metadata of the authentication token, including algorithm, type and encryption key;

[0108] S34, the payload of the JWT authentication token contains the actual data to be transmitted, including the user's identity information and permissions;

[0109] S35. Sign the header and the payload using the private key to generate a signature part;

[0110] S36. Concatenate the header, the payload, and the signature part into a complete JWT string.

[0111] The header and the payload are encrypted using the HMAC-SHA256 algorithm, and the specific steps are as follows:

[0112] S21, generating a random encryption key;

[0113] S22, using the HMAC-SHA256 algorithm to perform hash processing on the random encryption key and the user information to obtain an HMAC summary;

[0114] S23, concatenating the HMAC digest and the random encryption key to obtain the header and the payload of the JWT authentication token;

[0115] S24. Encode the header and the payload using Base64 encoding to obtain a string representation of the JWT authentication token;

[0116] S25, storing the string representation of the JWT authentication token in a database and setting an expiration time;

[0117] S26. Add an access control list. When storing the JWT authentication token, apply the access control list to the database entry to restrict access to the JWT authentication token. Only authorized users or system components can read, update or delete the JWT authentication token entry.

[0118] S27. Establish a token revocation list in the database. When the JWT authentication token is stolen, the user actively logs out, or other security incidents occur, the token revocation list can immediately revoke the JWT authentication token.

[0119] The specific delivery rules of the JWT authentication token are:

[0120] Add the Authorization field in the HTTP header of each request and use the Bearer scheme to pass the JWT authentication token; the Authorization field is part of the HTTP request header and is used to carry the authentication token (AccessToken) or other authentication information. In the Bearer authentication scheme, the format of the Authorization field is usually "Bearer <token>",in <token>is the actual value of the authentication token.

[0121] The JWT authentication token is stored in the client's LocalStorage or SessionStorage, or is passed in the Authorization header of each request and sent to the cloud platform server with each request. The cloud platform server obtains the JWT authentication token by parsing; the LocalStorage and SessionStorage are both client storage mechanisms.

[0122] The JWT authentication token can only be passed under a specific URL path;

[0123] The JWT authentication token can only be verified by its own signature and validity period;

[0124] The JWT authentication token is only valid within a specific time frame;

[0125] The JWT authentication token is set to be one-time use, that is, it will become invalid after being used once;

[0126] The JWT authentication token contains multiple Payload parts, each of which corresponds to different permissions or information. The above transmission rules ensure the secure transmission and effective use of the JWT authentication token, while providing flexibility and scalability to adapt to different application scenarios and security requirements.

[0127] The specific steps of verifying the JWT authentication token are:

[0128] S61, the cloud platform server receives the user's request and obtains the JWT authentication token;

[0129] S62, split the JWT authentication token, and decode the header and the payload respectively;

[0130] S63. Use the same key and algorithm to sign the concatenated string to generate a signature value;

[0131] S64. Compare the generated signature value with the signature in the JWT authentication token to verify the authenticity and integrity of the JWT authentication token;

[0132] S64. Check the expiration time in the JWT authentication token to ensure that the authentication token has not expired; by verifying the signature and expiration time, the cloud platform server can confirm the authenticity of the JWT authentication token and ensure that the JWT authentication token is used within the validity period.

[0133] Example 2

[0134] A cloud platform account authentication system, such as Figure 2 As shown, it includes a user terminal module 1, an authentication server module 2, a database module 3, a cloud platform server module 4, an encryption algorithm module 5, an authentication token management module 6 and an authentication failure processing module 7;

[0135] The user-side module 1 is used to allow the user to enter a username and password and send a login request to the authentication server; receive and store the authentication token and send it to the cloud platform server in subsequent requests;

[0136] The authentication server module 2 is used to receive a user's login request, verify the user's identity, generate an authentication token, set authentication token transfer rules, and store them in a database, receive a request to refresh the authentication token, generate a new authentication token and update the database;

[0137] The database module 3 is used to store user information, authentication tokens and related authentication information;

[0138] The cloud platform server module 4 is used to receive requests from the user end, parse and verify the authentication token, verify its legitimacy and whether it is expired, and allow the user to perform corresponding operations when the authentication token is legitimate and not expired; and request the authentication server to refresh the authentication token.

[0139] The encryption algorithm module 5 is used to generate and verify the legitimacy of the authentication token to ensure the security and uniqueness of the token;

[0140] The authentication token management module 6 is used to manage the generation, storage, update and verification of authentication tokens, including setting expiration time and refreshing token functions;

[0141] The authentication failure processing module 7 is used to process authentication failures, return corresponding failure information to the user end, and require the user to log in again;

[0142] The user-end module 1 is bidirectionally connected to the authentication server module 2, the authentication server module 2 is connected to the database module 3, and the authentication server module 2 is bidirectionally connected to the cloud platform server module 4; the cloud platform server module 4 is connected to the database module 3; the cloud platform server module 4 is connected to the encryption algorithm module 5; the authentication server module 2 is connected to the encryption algorithm module 5, the encryption algorithm module 5 is connected to the database module 3, the authentication server module 2 is connected to the authentication token management module 6; the authentication server module 2 is connected to the authentication failure processing module 7.

[0143] The authentication token uses the JWT format. The JWT authentication token includes a header, a payload and a signature. The header contains an algorithm identifier and an encryption key. The payload contains user information and permission information. The signature is the result of encrypting the header and the payload. The algorithm identifier is used to indicate the encryption algorithm used by the authentication server. The encryption key is used to encrypt the header and the payload.

[0144] The specific steps of the authentication server module 2 generating a JWT authentication token are as follows:

[0145] S31, after the user logs in, the authentication server generates the JWT authentication token according to the user information;

[0146] S32, using the encryption algorithm RSA to generate a public key and a private key pair, the private key is used to sign the JWT authentication token, and the public key is used to verify the signature;

[0147] S33, the header of the JWT authentication token contains metadata of the authentication token, including algorithm, type and encryption key;

[0148] S34, the payload of the JWT authentication token contains the actual data to be transmitted, including the user's identity information and permissions;

[0149] S35. Sign the header and the payload using the private key to generate a signature part;

[0150] S36. Concatenate the header, the payload, and the signature part into a complete JWT string.

[0151] The encryption algorithm module 5 uses the HMAC-SHA256 algorithm to encrypt the header and the payload, and the specific steps are as follows:

[0152] S21, generating a random encryption key;

[0153] S22, using the HMAC-SHA256 algorithm to perform hash processing on the random encryption key and the user information to obtain an HMAC summary;

[0154] S23, concatenating the HMAC digest and the random encryption key to obtain the header and the payload of the JWT authentication token;

[0155] S24. Encode the header and the payload using Base64 encoding to obtain a string representation of the JWT authentication token;

[0156] S25, storing the string representation of the JWT authentication token in a database and setting an expiration time;

[0157] S26. Add an access control list. When storing the JWT authentication token, apply the access control list to the database entry to restrict access to the JWT authentication token. Only authorized users or system components can read, update or delete the JWT authentication token entry.

[0158] S27. Establish a token revocation list in the database. When the JWT authentication token is stolen, the user actively logs out, or other security incidents occur, the token revocation list can immediately revoke the JWT authentication token.

[0159] The specific delivery rules of the JWT authentication token are:

[0160] Add the Authorization field in the HTTP header of each request and use the Bearer scheme to pass the JWT authentication token;

[0161] The JWT authentication token is stored in the LocalStorage or SessionStorage of the client, or is passed in the Authorization header of each request and sent to the cloud platform server with each request. The cloud platform server obtains the JWT authentication token by parsing;

[0162] The JWT authentication token can only be passed under a specific URL path;

[0163] The JWT authentication token can only be verified by its own signature and validity period;

[0164] The JWT authentication token is only valid within a specific time frame;

[0165] The JWT authentication token is set to be one-time use, that is, it will become invalid after being used once;

[0166] The JWT authentication token includes multiple Payload parts, each of which corresponds to different permissions or information.

[0167] The specific steps of the cloud platform server module 4 verifying the JWT authentication token are:

[0168] S61, the cloud platform server receives the user's request and obtains the JWT authentication token;

[0169] S62, split the JWT authentication token, and decode the header and the payload respectively;

[0170] S63. Use the same key and algorithm to sign the concatenated string to generate a signature value;

[0171] S64. Compare the generated signature value with the signature in the JWT authentication token to verify the authenticity and integrity of the JWT authentication token;

[0172] S64. Check the expiration time in the JWT authentication token to ensure that the authentication token has not expired.

[0173] The beneficial effect of the technical solution of the present invention is that a cloud platform account authentication method and system designed by the present invention sets the JWT authentication token on the authentication server. The JWT authentication token realizes cross-domain authentication by carrying the authentication token in the header or request parameters of the HTTP request. When a cross-domain request is made, the browser will automatically send the JWT authentication token to the cloud platform server without the need for special cross-domain configuration. Therefore, it is not restricted by the browser's homology policy and can be freely transferred between different domains. In addition, the JWT authentication token is stateless, and the cloud platform server does not need to store any status information in the session. The JWT authentication token contains the user's authentication information and related permission information. The cloud platform server can verify the user's identity based on the JWT authentication token and extract necessary information from it for authorization and access control without storing any session status information on the cloud platform server side, thereby effectively reducing the server load.

[0174] The same or similar reference numerals correspond to the same or similar components;

[0175] The terms used in the drawings to describe positional relationships are only used for illustrative purposes and should not be construed as limiting this patent;

[0176] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not limitations on the implementation methods of the present invention. For ordinary technicians in the relevant field, other different forms of changes or modifications can be made on the basis of the above description. It is not necessary and impossible to list all the implementation methods here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.< / token> < / token>

Claims

1. A cloud platform account authentication method, characterized in that: The following steps are involved: S1. The user enters the user name and password through the user terminal to initiate a login request, and the user terminal sends the login request to the authentication server; S2, the authentication server receives the login request and retrieves the user information from the database; S3. If the user information identity authentication passes, the authentication server generates a unique authentication token using an encryption algorithm, sets the authentication token transmission rules, and stores it in the database. At the same time, the expiration time of the authentication token is set. If the user information matching the user name and password is not retrieved in the database, the authentication server returns the authentication failure information to the user end. The authentication token uses the JWT format. The JWT authentication token includes a header, a payload, and a signature. The header contains an algorithm identifier and an encryption key. The payload contains user information and permission information. The signature is the result of encrypting the header and the payload. The algorithm identifier is used to indicate the encryption algorithm used by the authentication server. The encryption key is used to encrypt the header and the payload. The specific steps for generating the JWT authentication token in step S3 are as follows: S31. After the user logs in, the authentication server generates the JWT authentication token according to the user information; S32, using the encryption algorithm RSA to generate a public key and a private key pair, the private key is used to sign the JWT authentication token, and the public key is used to verify the signature; S33, the header of the JWT authentication token contains metadata of the authentication token, including algorithm, type and encryption key; S34, the payload of the JWT authentication token contains the actual data to be transmitted, including the user's identity information and permissions; S35. Sign the header and the payload using the private key to generate a signature part; S36, concatenating the header, the payload and the signature part into a complete JWT string; The header and the payload are encrypted using the HMAC-SHA256 algorithm, and the specific steps are as follows: S21, generating a random encryption key; S22, using the HMAC-SHA256 algorithm to perform hash processing on the random encryption key and the user information to obtain an HMAC summary; S23, concatenating the HMAC digest and the random encryption key to obtain the header and the payload of the JWT authentication token; S24. Encode the header and the payload using Base64 encoding to obtain a string representation of the JWT authentication token; S25, storing the string representation of the JWT authentication token in a database and setting an expiration time; S26. Add an access control list. When storing the JWT authentication token, apply the access control list to the database entry to restrict access to the JWT authentication token. Only authorized users or system components can read, update or delete the JWT authentication token entry. S27, establishing a token revocation list in the database, wherein when the JWT authentication token is stolen or the user actively logs out, the token revocation list can immediately revoke the JWT authentication token; S4. The authentication server returns the generated JWT authentication token to the client. The client stores the received JWT authentication token locally and sends it to the cloud platform server in subsequent requests. S5. The cloud platform server receives the request from the user and parses and verifies the JWT authentication token; S6. The cloud platform server uses an encryption algorithm to verify the legitimacy of the JWT authentication token and checks whether the JWT authentication token has expired. If the JWT authentication token is illegal or expired, the cloud platform server returns information that the account authentication failed to the user terminal and requires the user to log in again. S7. If the JWT authentication token is legal and has not expired, the cloud platform server allows the user to perform corresponding operations, and the cloud platform server requests the authentication server to refresh the JWT authentication token at 80% of the validity period of the JWT authentication token; S8. After receiving the request to refresh the JWT authentication token, the authentication server generates a new JWT authentication token using an encryption algorithm, stores it in the database, updates the corresponding JWT authentication token information in the database, and then returns the new JWT authentication token to the cloud platform server.

2. A cloud platform account authentication method according to claim 1, characterized in that: The specific delivery rules of the JWT authentication token are: Add the Authorization field in the HTTP header of each request and use the Bearer scheme to pass the JWT authentication token; The JWT authentication token is stored in the LocalStorage or SessionStorage of the client, or is passed in the Authorization header of each request and sent to the cloud platform server with each request. The cloud platform server obtains the JWT authentication token by parsing; The JWT authentication token can only be passed under a specific URL path; The JWT authentication token can only be verified by its own signature and validity period; The JWT authentication token is only valid within a specific time frame; The JWT authentication token is set to be one-time use, that is, it will become invalid after being used once; The JWT authentication token includes multiple Payload parts, each of which corresponds to different permissions or information.

3. A cloud platform account authentication method according to claim 1, characterized in that: The specific steps to verify the JWT authentication token are: S61, the cloud platform server receives the user's request and obtains the JWT authentication token; S62, split the JWT authentication token, and decode the header and the payload respectively; S63. Use the same key and algorithm to sign the concatenated string to generate a signature value; S64. Compare the generated signature value with the signature in the JWT authentication token to verify the authenticity and integrity of the JWT authentication token; S64. Check the expiration time in the JWT authentication token to ensure that the authentication token has not expired.

4. A cloud platform account authentication system, characterized in that: It comprises a user end module (1), an authentication server module (2), a database module (3), a cloud platform server module (4), an encryption algorithm module (5), an authentication token management module (6) and an authentication failure processing module (7); The user-end module (1) and the authentication server module (2) are bidirectionally connected, the authentication server module (2) and the database module (3) are connected, the authentication server module (2) and the cloud platform server module (4) are bidirectionally connected, the cloud platform server module (4) and the database module (3) are connected, the cloud platform server module (4) and the encryption algorithm module (5) are connected, the authentication server module (2) and the encryption algorithm module (5) are connected, the encryption algorithm module (5) and the database module (3) are connected, the authentication server module (2) and the authentication token management module (6) are connected, and the authentication server module (2) and the authentication failure processing module (7) are connected; The user terminal module (1) is used to allow the user to input a user name and password, and send a login request to the authentication server, receive and store the authentication token, and send it to the cloud platform server in a subsequent request; The authentication server module (2) is used to receive a user's login request, verify the user's identity, generate an authentication token, set authentication token transmission rules, and store the authentication token in a database, receive a request to refresh the authentication token, generate a new authentication token, and update the database; The database module (3) is used to store user information, authentication tokens and related authentication information; The cloud platform server module (4) is used to receive a request from a user terminal, parse and verify the authentication token, verify the legitimacy and whether it is expired, and when the authentication token is legitimate and not expired, allow the user to perform corresponding operations and request the authentication server to refresh the authentication token; The encryption algorithm module (5) is used to generate and verify the legitimacy of the authentication token to ensure the security and uniqueness of the token; The authentication token management module (6) is used to manage the generation, storage, update and verification of authentication tokens, including setting expiration time and refreshing token functions; The authentication failure processing module (7) is used to process authentication failures, return corresponding failure information to the user end, and require the user to log in again.

5. A cloud platform account authentication system according to claim 4, characterized in that: The authentication token uses the JWT format. The JWT authentication token includes a header, a payload, and a signature. The header includes an algorithm identifier and an encryption key. The payload includes user information and permission information. The signature is the result of encrypting the header and the payload. The algorithm identifier is used to indicate the encryption algorithm used by the authentication server. The encryption key is used to encrypt the header and the payload. The authentication server module (2) generates a JWT authentication token in the following specific steps: S31. After the user logs in, the authentication server generates the JWT authentication token according to the user information; S32, using the encryption algorithm RSA to generate a public key and a private key pair, the private key is used to sign the JWT authentication token, and the public key is used to verify the signature; S33, the header of the JWT authentication token contains metadata of the authentication token, the metadata including algorithm, type and encryption key; S34, the payload of the JWT authentication token contains the actual data to be transmitted, including the user's identity information and permissions; S35. Sign the header and the payload using the private key to generate a signature part; S36. Concatenate the header, the payload, and the signature part into a complete JWT string.

6. A cloud platform account authentication system according to claim 5, characterized in that: The encryption algorithm module (5) uses the HMAC-SHA256 algorithm to encrypt the header and the payload, and the specific steps are as follows: S21, generating a random encryption key; S22, using the HMAC-SHA256 algorithm to perform hash processing on the random encryption key and the user information to obtain an HMAC summary; S23, concatenating the HMAC digest and the random encryption key to obtain the header and the payload of the JWT authentication token; S24. Encode the header and the payload using Base64 encoding to obtain a string representation of the JWT authentication token; S25, storing the string representation of the JWT authentication token in a database and setting an expiration time; S26. Add an access control list. When storing the JWT authentication token, apply the access control list to the database entry to restrict access to the JWT authentication token. Only authorized users or system components can read, update or delete the JWT authentication token entry. S27. Establish a token revocation list in the database. When the JWT authentication token is stolen or the user actively logs out, the token revocation list can immediately revoke the JWT authentication token.

7. A cloud platform account authentication system according to claim 5, characterized in that: The specific delivery rules of the JWT authentication token are: Add the Authorization field in the HTTP header of each request and use the Bearer scheme to pass the JWT authentication token; The JWT authentication token is stored in the LocalStorage or SessionStorage of the client, or is passed in the Authorization header of each request and sent to the cloud platform server with each request. The cloud platform server obtains the JWT authentication token by parsing; The JWT authentication token can only be passed under a specific URL path; The JWT authentication token can only be verified by its own signature and validity period; The JWT authentication token is only valid within a specific time frame; The JWT authentication token is set to be one-time use, that is, it will become invalid after being used once; The JWT authentication token includes multiple Payload parts, each of which corresponds to different permissions or information.

8. A cloud platform account authentication system according to claim 5, characterized in that: The specific steps of the cloud platform server module (4) verifying the JWT authentication token are: S61, the cloud platform server receives the user's request and obtains the JWT authentication token; S62, split the JWT authentication token, and decode the header and the payload respectively; S63. Use the same key and algorithm to sign the concatenated string to generate a signature value; S64. Compare the generated signature value with the signature in the JWT authentication token to verify the authenticity and integrity of the JWT authentication token; S64. Check the expiration time in the JWT authentication token to ensure that the authentication token has not expired.

Images