A permission authentication method, device, apparatus and storage medium

Abstract

The application discloses a permission authentication method, device and equipment and a storage medium. When a service device accesses authentication, an authentication request is input to an authentication component; a token request is initiated to a first token bucket corresponding to the authentication component to obtain a token in the first token bucket; wherein the first token bucket is used to obtain tokens from a second token bucket at a preset token obtaining speed, and when the token request is received and the first token bucket has tokens, the tokens are distributed to the authentication component; if the authentication component obtains the tokens within a preset time length, the authentication component is used to perform authentication processing on the authentication request, and an authentication result is output; the authentication result is authentication failure or authentication success; if the authentication component does not obtain the tokens within the preset time length, an authentication result of authentication failure is output. The application controls the flow of the permission authentication process, prevents network congestion and access timeout caused by a large number of devices accessing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a permission authentication method and device, equipment and storage medium. BACKGROUND

[0002] With the rapid development of Internet technology, the demand for permission authentication is also growing, and the means of permission authentication is becoming diversified and complex. In the prior art, various authentication components are set to realize the authentication processing of the business device.

[0003] However, the inventors have found that the prior art at least has the following problems: when the business device accesses the network for authentication at the same time, the network is heavily burdened and has insufficient flexibility, so that the authentication processing becomes a traffic bottleneck, a large number of devices will be blocked in the authentication processing process, resulting in network congestion or access timeout, and subsequent services are down due to excessive traffic. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a permission authentication method, device, equipment and storage medium, which controls the flow of the permission authentication process to prevent network congestion and access timeout when a large number of devices access.

[0005] To achieve the above-mentioned purpose, the embodiments of the present application provide a permission authentication method, comprising:

[0006] When the business device accesses the authentication, input the authentication request to the authentication component;

[0007] Initiate a token request to a first token bucket corresponding to the authentication component to obtain a token in the first token bucket; wherein the first token bucket is used to obtain tokens from a second token bucket at a preset token acquisition speed, and when the token request is received and there is a token, the token is distributed to the authentication component;

[0008] If the authentication component obtains the token within a preset time, the authentication request is authenticated by the authentication component, and an authentication result is output; the authentication result is authentication failure or authentication success;

[0009] If the authentication component does not obtain the token within a preset time, an authentication result of authentication failure is output.

[0010] As an improvement of the above-mentioned scheme, when the business device accesses the authentication, the authentication request is input to the authentication component, comprising:

[0011] When the business device accesses the authentication, obtain the permission authentication chain and the permission authentication strategy corresponding to the authentication request, wherein the permission authentication chain comprises a plurality of authentication components, and the authentication components correspond one by one to the first token bucket;

[0012] According to the priority order of each authentication component, authentication components in the permission authentication chain are selected in sequence, and the authentication request is input to the currently selected authentication component;

[0013] The method further comprises:

[0014] After obtaining the authentication result of the currently selected authentication component, it is determined whether the authentication result placement condition corresponding to the permission authentication strategy is met;

[0015] If it is met, the final authentication result of the authentication request is determined according to the authentication result of each authentication component input by the authentication request;

[0016] If it is not met, the authentication request is input to the next authentication component until it is determined that the authentication result placement condition corresponding to the permission authentication strategy is met.

[0017] As an improvement of the above scheme, the method further comprises:

[0018] A weight distribution strategy of a first token bucket corresponding to each authentication component is determined;

[0019] When the weight distribution strategy is an equal weight distribution strategy, the weight value of the first token bucket corresponding to each authentication component is the same;

[0020] When the weight distribution strategy is a custom weight distribution strategy, the weight value of the first token bucket corresponding to each authentication component is determined according to the custom weight distribution strategy;

[0021] According to the weight value of each first token bucket, the token acquisition speed of each first token bucket is determined; wherein the token acquisition speed and the weight value are in a positive correlation.

[0022] As an improvement of the above scheme, when the weight distribution strategy is an equal weight distribution strategy, after initiating a token request to the first token bucket corresponding to the authentication component, the method further comprises:

[0023] If there is no token in the first token bucket corresponding to the authentication component, within the preset time length, the token acquisition speed of the first token bucket corresponding to the authentication component is increased by a first speed adjustment step, and the token acquisition speed of the first token bucket corresponding to other authentication components in the permission authentication chain is reduced by a second speed adjustment step.

[0024] As an improvement of the above scheme, after inputting the authentication request to the authentication component, the method further comprises:

[0025] When there is no previous authentication component or no previous authentication component obtains the token, a step is performed: a token request is initiated to a first token bucket corresponding to the authentication component to obtain a token in the first token bucket;

[0026] When there is a previous authentication component and any previous authentication component has obtained the token, the authentication request is directly authenticated by the authentication component, and an authentication result is output.

[0027] As an improvement of the above scheme, the permission authentication strategy is all authentication success, any authentication success or specified authentication success;

[0028] The authentication result placement condition corresponding to the all authentication success is that the current authentication component outputs an authentication failure result or the current authentication component is the last authentication component in the permission authentication chain.

[0029] The authentication result placement condition corresponding to the any authentication success is that the current authentication component outputs an authentication success result or the current authentication component is the last authentication component in the permission authentication chain.

[0030] The authentication result placement condition corresponding to the specified authentication success is that the current authentication component is a preset specified authentication component and outputs an authentication success result or the current authentication component is the last authentication component in the permission authentication chain.

[0031] As an improvement of the above scheme, the authentication request is authenticated by the authentication component, and an authentication result is output, including:

[0032] The unique identification information and access password of the service device contained in the authentication request are obtained.

[0033] The unique identification information and the access password are matched with all authentication information stored in the authentication component by using a preset authentication mode corresponding to the authentication component, to obtain an authentication result and output.

[0034] Embodiments of the application also provide a permission authentication device, comprising:

[0035] An authentication component acquisition module is configured to input an authentication request to an authentication component when a service device accesses authentication.

[0036] A token request module is configured to initiate a token request to a first token bucket corresponding to the authentication component to obtain a token in the first token bucket; wherein the first token bucket is configured to obtain a token from a second token bucket at a preset token obtaining speed, and distribute the token to the authentication component when the token request is received and the token exists.

[0037] The authentication result output module is configured to, if the token is acquired by the authentication component within a preset time length, perform authentication processing on the authentication request by using the authentication component, and output an authentication result; the authentication result is authentication failure or authentication success; and if the token is not acquired by the authentication component within the preset time length, output an authentication result of authentication failure.

[0038] The embodiment of the application further provides a permission authentication device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the permission authentication method according to any one of the above when executing the computer program.

[0039] The embodiment of the application further provides a computer readable storage medium, including a stored computer program, wherein the computer readable storage medium controls a device where the computer readable storage medium is located to execute the permission authentication method according to any one of the above when the computer program runs.

[0040] Compared with the prior art, the permission authentication method, device, equipment and storage medium disclosed by the application can realize flow control of the authentication component performing the authentication processing process by the way of issuing a token, can guarantee that the authentication component is not a blocking point in the scene of a large number of business devices accessing, prevent subsequent services from being down due to too large flow, effectively prevent network congestion and access timeout, and prevent the adverse effects of malicious and abnormal devices continuously logging in on services and networks. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 is a flow diagram of a permission authentication method provided by the embodiment of the application;

[0042] Figure 2 is a principle diagram of the authentication component requesting a token in the embodiment of the application;

[0043] Figure 3 is a principle diagram of a permission authentication chain in the embodiment of the application;

[0044] Figure 4 is a structure diagram of a permission authentication device provided by the embodiment of the application;

[0045] Figure 5 is a structure diagram of a permission authentication device provided by the embodiment of the application. DETAILED DESCRIPTION

[0046] With reference to the drawings and briefly describing the technical schemes in the embodiments of the present application, obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0047] In the description and claims of the specification, it is to be understood that the terms first, second, etc. are used only for the purpose of description and are not to be construed as indicating or implying relative importance or an indicated number of features. They are not necessarily used in the order or time sequence described. Terms are interchangeable under appropriate circumstances. Thus, features defined with "first", "second" can explicitly or implicitly include at least one of the features.

[0048] Referring to Figure 1 is a flowchart of a permission authentication method provided by an embodiment of the present application. The embodiment of the present application provides a permission authentication method, which specifically includes the following steps S11 to S14:

[0049] S11, when a service device accesses authentication, input an authentication request to an authentication component;

[0050] S12, initiate a token request to a first token bucket corresponding to the authentication component to obtain a token in the first token bucket; wherein the first token bucket is used to obtain tokens from a second token bucket at a preset token obtaining speed, and when the token request is received and there is a token in the first token bucket, the token is distributed to the authentication component;

[0051] S13, if the authentication component obtains the token within a preset time length, the authentication request is authenticated and processed by the authentication component, and an authentication result is output; the authentication result is authentication failure or authentication success;

[0052] S14, if the authentication component does not obtain the token within a preset time length, an authentication result of authentication failure is output.

[0053] It should be noted that the service device refers to an intelligent device that needs to access a corresponding application platform to realize a corresponding service function, for example, the service device is an Internet of Things device, which is used to access an Internet of Things platform to realize ubiquitous connection of things and people, realize intelligent perception, identification and management of things and processes, and when the Internet of Things device accesses the Internet of Things platform, permission authentication is needed to avoid possible security problems. It can be understood that the service device can also be other intelligent devices, which are not limited here.

[0054] In the embodiment of the present application, an authentication component is pre-configured to perform authentication processing when the service device accesses, which can adopt an authentication component in the prior art, and optionally, the authentication component includes but is not limited to: a MongoDB authentication component, a Redis authentication component, a MySQL authentication component and an HTTP authentication component.

[0055] Optionally, the authentication component can also be other authentication components customized by a user, and the user can also add an HTTP authentication component to implement an HTTP authentication service according to an interface specification, or can also implement a custom component, as long as the input and output are consistent, which can be freely and dynamically accessed to the authentication chain to achieve the purpose of custom authentication. For example, the SOFA framework of Alibaba can dynamically implement the plug-in and plug-out of the component by rewriting the hook function and configuring the mounting point method HookPoint at the calling side, and the authentication component is registered and the method of the corresponding mounting point is called through the @SofaReference annotation.

[0056] By using the technical means of the embodiment of the present application, custom authentication can be achieved by developing an HTTP authentication service or a custom authentication component, the component is stateless, supports service hot plug-in, has good expansibility, and has wide application scope. It can also meet the rapid compatibility of domesticization, for example, the domestic SM9 only needs to develop a response authentication component for replacement, and meets the domesticization process.

[0057] Further, referring to Figure 2 is a principle diagram of the authentication component requesting a token in the embodiment of the present application. The embodiment of the present application sets a high bucket and a bucket group to implement flow control on the authentication processing process. The high bucket is the second token bucket, and the bucket group includes at least one first token bucket. The authentication component has a one-to-one correspondence with the first token bucket. In the application process, first, the second token bucket generates tokens at a certain rate, which is greater than the token acquisition speed of any first token bucket. Generally, it is the product of the number of first token buckets and the initial token acquisition speed of the first token bucket. The second token bucket is used to issue tokens to each token bucket. The token issuance speed of the second token bucket is also the token acquisition speed, which is pre-configured. The first token bucket is used to issue existing tokens to the corresponding authentication component when a token request is acquired. The authentication component needs to acquire tokens to perform authentication processing on the authentication request.

[0058] In the application process, when a service device access platform is detected, a corresponding authentication request is generated, and an authentication component currently used for authentication processing is selected. The authentication request is input into the currently selected authentication component. Then, a token request is initiated to a first token bucket corresponding to the currently selected authentication component. At this time, if there is a token in the first token bucket, the token is assigned to the current authentication component, and the authentication component can perform authentication processing on the authentication request after obtaining the token to obtain an authentication result. If there is no token in the first token bucket, the authentication request is cached in a preset request queue for a preset time period, and if the first token bucket obtains a token from a second token bucket within the preset time period, the token is issued. The authentication component can perform authentication processing on the authentication request after obtaining the token to obtain an authentication result. If the first token bucket does not obtain a token within the preset time period, the authentication request is not authenticated, and an authentication failure result is directly output.

[0059] Optionally, the authentication processing of the authentication request by the authentication component and the output of the authentication result include:

[0060] Obtaining unique identification information and access passwords of the service device included in the authentication request;

[0061] Using a preset authentication mode corresponding to the authentication component, matching the unique identification information and the access passwords with all authentication information stored in the authentication component to obtain an authentication result and output.

[0062] As an example, first define the following authentication triplets for authentication, including a username, a service device ID, and an access password. Generally, the username or the service device ID, or the username + service device ID is used as the unique identification information of the service device. After the authentication component receives the authentication triplets, the corresponding authentication information is searched in the storage medium corresponding to the authentication component according to the unique identification for authentication. It is assumed that the authentication information is found according to the unique identification, and the password matches, then the authentication is successful. It is assumed that the authentication information is found according to the unique identification, but the password does not match, then the authentication fails. It is assumed that the authentication information is not found according to the unique identification, or an abnormality occurs, then the authentication fails.

[0063] The authentication data of the existing different inventory intelligent devices can be stored in different media (such as MongoDB, Redis, and MySQL), and the authentication modes of different authentication components are also different, which will not be described here.

[0064] By means of the technical means of the embodiment of the present application, the flow control of the authentication processing procedure performed on the authentication component is realized by issuing tokens, and in the case of massive service device access, the authentication component can be ensured not to become a blocking point, the subsequent service can be prevented from being down due to excessive flow, network congestion and access timeout can be effectively prevented, and the adverse effects of malicious and abnormal devices on the service and network caused by continuous login can be prevented.

[0065] As a preferred embodiment, the embodiment of the present application is further implemented on the basis of the above-mentioned embodiment, and the authentication processing of the authentication request is realized by means of the permission authentication chain. Then, step S11, that is, inputting the authentication request to the authentication component during the service device access authentication, comprises:

[0066] During the service device access authentication, the permission authentication chain and the permission authentication strategy corresponding to the authentication request are obtained, wherein the permission authentication chain comprises a plurality of authentication components, and the authentication components correspond to the first token bucket one by one; according to the priority order of each authentication component, the authentication components in the permission authentication chain are selected in turn, and the authentication request is input to the currently selected authentication component.

[0067] Then, the method further comprises steps S14 to S16:

[0068] S14, after obtaining the authentication result of the currently selected authentication component, it is judged whether the authentication result placement condition corresponding to the permission authentication strategy is met;

[0069] S15, if yes, the final authentication result of the authentication request is determined according to the authentication result of each authentication component input by the authentication request;

[0070] S16, if no, the authentication request is input to the next authentication component until it is determined that the authentication result placement condition corresponding to the permission authentication strategy is met.

[0071] Preferably, the permission authentication strategy is all authentication success, any authentication success or specified authentication success. The all authentication success strategy means that the authentication request needs to pass through each authentication component in the permission authentication chain for authentication processing, and all the authentication components need to be authenticated successfully, so that the final authentication result of authentication success can be output. The any authentication success strategy means that the authentication request passes through any authentication component in the permission authentication chain for authentication processing and is authenticated successfully, so that the final authentication result of authentication success can be output. The specified authentication success strategy means that the authentication request passes through the specified authentication component in the permission authentication chain for authentication processing and is authenticated successfully, so that the final authentication result of authentication success can be output.

[0072] The authentication result setting condition corresponding to the all-authentication-success is that the current authentication component outputs an authentication failure result or the current authentication component is the last authentication component in the permission authentication chain;

[0073] The authentication result setting condition corresponding to the any-authentication-success is that the current authentication component outputs an authentication success result or the current authentication component is the last authentication component in the permission authentication chain;

[0074] The authentication result setting condition corresponding to the specified-authentication-success is that the current authentication component is a preset specified authentication component and outputs an authentication success result or the current authentication component is the last authentication component in the permission authentication chain.

[0075] In the embodiment of the application, referring to Figure 3 is a principle schematic diagram of the permission authentication chain in the embodiment of the application, in the embodiment of the application, the permission authentication chain is preset, the permission authentication chain is composed of a plurality of different authentication components, whether the authentication components are enabled and the priority order of the enabled authentication components are configured by a user according to actual conditions, thereby generating a permission authentication strategy. Moreover, each authentication component in the permission authentication chain has a corresponding first token bucket.

[0076] Taking the permission authentication strategy of all-authentication-success in which three different authentication components in the permission authentication chain are set as an example, the three authentication components are arranged according to the priority order and are respectively an authentication component 1, an authentication component 2 and an authentication component 3, and three first token buckets are also respectively set in the bucket group and are allocated as a bucket 1, a bucket 2 and a bucket 3.

[0077] When the service device access platform is detected, a corresponding authentication request is generated. According to the priority order of each authentication component in the permission authentication chain, the first authentication component 1 is selected, and the authentication request is input into the authentication component 1. Then, a token request is initiated to the first token bucket corresponding to the currently selected authentication component 1, that is, bucket 1. If the authentication component 1 obtains a token within a preset time period, the authentication processing of the authentication request is performed, an authentication result is obtained, and if the authentication result is authentication success, the authentication request is transparently transmitted to the next authentication component 2. A token request is initiated to the first token bucket corresponding to the currently selected authentication component 2, that is, bucket 2. If the authentication component 2 obtains a token within a preset time period, the authentication processing of the authentication request is performed, an authentication result is obtained, and if the authentication component 2 also successfully authenticates, the authentication request is transparently transmitted to the next selected authentication component 3. A token request is initiated to the first token bucket corresponding to the currently selected authentication component 3, that is, bucket 3. If the authentication component 3 obtains a token within a preset time period, the authentication processing of the authentication request is performed, an authentication result is obtained, and if the authentication component 3 also successfully authenticates, the authentication result output condition is triggered, and the final authentication result is authentication success.

[0078] If the authentication component 1 does not obtain a token within a preset time period, the authentication request is not authenticated, and an authentication failure authentication result is directly output. Similarly, if the authentication component 1 or the authentication component 3 does not obtain a token within a preset time period, the authentication request is not authenticated, and an authentication failure authentication result is directly output. At this time, the authentication result output condition is also triggered, and the final authentication result is authentication failure.

[0079] It can be understood that the authentication process corresponding to any authentication success permission authentication strategy or specified authentication success permission authentication strategy is similar, which is not described here.

[0080] As a preferred embodiment, step S11, that is, after the authentication request is input into the authentication component, the method further comprises:

[0081] When there is no previous authentication component or the previous authentication component does not obtain the token, the step of initiating a token request to the first token bucket corresponding to the authentication component to obtain the token in the first token bucket is performed.

[0082] When there is a previous authentication component and any previous authentication component has obtained the token, the authentication request is authenticated by the authentication component, and an authentication result is output.

[0083] In the embodiments of the present application, in order to simplify the authentication processing procedure and not to affect the flow control of the authentication processing, the authentication component currently selected carries out a judgment on whether it needs to acquire a token from the corresponding first token bucket after receiving the authentication request. When the authentication component is the first selected authentication component or is not the first authentication component but all the preceding authentication components have not acquired a token, the current authentication component needs to initiate a token request to the corresponding first token bucket, and carries out the authentication processing after acquiring the token. If the authentication component is not the first authentication component and any of the preceding authentication components has acquired a token, it is not necessary to initiate a token request to the corresponding first token bucket.

[0084] Taking the permission authentication policy of adopting all authentication success as an example, when detecting that a business device accesses the platform, a corresponding authentication request is generated. According to the priority order of each authentication component in the permission authentication chain, the first authentication component 1 is selected, and the authentication request is input into the authentication component 1. Then, a token request is initiated to the first token bucket corresponding to the currently selected authentication component 1, that is, bucket 1. If the authentication component 1 acquires a token within a preset time length, the authentication processing of the authentication request is carried out, the authentication result is obtained, if the authentication result is authentication success, the authentication request is transparently transmitted to the next authentication component 2, at this time, the authentication component 2 does not need to acquire a token from the bucket 2, but directly carries out the authentication processing of the authentication request to obtain the authentication result, if the authentication component 2 also authenticates successfully, the authentication request is transparently transmitted to the next selected authentication component 3. At this time, the authentication component 3 also does not need to acquire a token from the bucket 3, but directly carries out the authentication processing of the authentication request to obtain the authentication result, if the authentication component 3 also authenticates successfully, the authentication result output condition is triggered, and the final authentication result is authentication success.

[0085] Taking the permission authentication policy of adopting all authentication success as an example, when detecting that a business device accesses the platform, a corresponding authentication request is generated. According to the priority order of each authentication component in the permission authentication chain, the first authentication component 1 is selected, and the authentication request is input into the authentication component 1. Then, a token request is initiated to the first token bucket corresponding to the currently selected authentication component 1, that is, bucket 1. If the authentication component 1 acquires a token within a preset time length, the authentication processing of the authentication request is carried out, the authentication result is obtained, if the authentication result is authentication success, the authentication request is transparently transmitted to the next authentication component 2, at this time, the authentication component 2 does not need to acquire a token from the bucket 2, but directly carries out the authentication processing of the authentication request to obtain the authentication result, if the authentication component 2 also authenticates successfully, the authentication request is transparently transmitted to the next selected authentication component 3. At this time, the authentication component 3 also does not need to acquire a token from the bucket 3, but directly carries out the authentication processing of the authentication request to obtain the authentication result, if the authentication component 3 also authenticates successfully, the authentication result output condition is triggered, and the final authentication result is authentication success.

[0086] The technical means of the embodiment of the present application is adopted, the permission authentication chain is formed by setting multiple different authentication components, and the authentication processing of the service device is realized by cooperating with the permission authentication strategy set by the user. The access authentication information is supported to be stored in multiple storage media, and only the corresponding storage component needs to be expanded and enabled, which conforms to the flexible and variable service scene of the Internet of Things, is convenient to expand and modify, greatly reduces the cost overhead caused by changes. In a specific case, as long as one of the components is normal, the authentication request can be completed, which can be used for disaster recovery backup and improve service availability. And each authentication component is loosely coupled, only the input and output need to be guaranteed, the development is simple, and it is flexible and variable.

[0087] As a preferred embodiment, the embodiment of the present application is further implemented on the basis of any of the above embodiments, and the embodiment of the present application sets and dynamically adjusts the token acquisition speed of each first token bucket in the bucket group, to further optimize the authentication process. Specifically, the method further comprises:

[0088] determining a weight distribution strategy of the first token bucket corresponding to each of the authentication components;

[0089] when the weight distribution strategy is a balanced weight distribution strategy, the weight value of the first token bucket corresponding to each of the authentication components is the same;

[0090] when the weight distribution strategy is a self-defined weight distribution strategy, the weight value of the first token bucket corresponding to each of the authentication components is determined according to the self-defined weight distribution strategy;

[0091] determining the token acquisition speed of each of the first token buckets according to the weight value of each of the first token buckets; wherein the token acquisition speed and the weight value are in a positive correlation.

[0092] Therefore, when the weight distribution strategy is a balanced weight distribution strategy, after initiating a token request to the first token bucket corresponding to the authentication component, the method further comprises:

[0093] if there is no token in the first token bucket corresponding to the authentication component, then within the preset time length, the token acquisition speed of the first token bucket corresponding to the authentication component is increased by a first speed adjustment step, and the token acquisition speed of the first token bucket corresponding to other authentication components in the permission authentication chain is reduced by a second speed adjustment step.

[0094] In the embodiment of the present application, the weight distribution strategy of the first token bucket corresponding to each authentication component is set according to the user's demand, and the weight distribution strategy includes a balanced weight distribution strategy and a self-defined weight distribution strategy. If the balanced weight distribution strategy is selected, the weight value of the first token bucket corresponding to each authentication component is the same, and the token acquisition speed of each first token bucket is also the same. If the self-defined weight distribution strategy is selected, the user can define the weight value of the first token bucket corresponding to different authentication components, thereby defining the token acquisition speed of different first token buckets. Wherein, the greater the weight value is, the greater the token acquisition speed is, but cannot exceed the token generation rate of the second token bucket.

[0095] In the case where the user selects the balanced weight distribution strategy, when the authentication request is input to the currently selected authentication component, the authentication component needs to acquire tokens from the corresponding first token bucket. If the token cannot be acquired, the authentication request is cached into the request queue, and the flow control service automatically increases the token acquisition speed of the first token bucket corresponding to the current authentication component, while reducing the token acquisition speed of other first token buckets in the bucket group, so that the first token bucket corresponding to the current authentication component can acquire tokens as much as possible within a preset time length, and the flow distribution of the entire authentication processing process is more balanced and effective.

[0096] By using the technical means of the embodiment of the present application, the flow control of the authentication component performing the authentication processing process is realized by issuing tokens, which can guarantee that the authentication component is not a blocking point in the case of massive business device access, prevent subsequent services from being down due to excessive flow, effectively prevent network congestion and access timeout, and prevent the adverse effects of continuous login of malicious and abnormal devices on services and networks. Moreover, the dynamic flow control of each authentication component in the permission authentication chain is supported, the weight of each authentication component is dynamically regulated by the user while guaranteeing the overall flow control, multi-target and multi-time granularity flow control can be realized in a non-intrusive manner, and the authentication of the user's attention is fully supported. Moreover, the user can also allocate weights according to the performance of different authentication components, for example, the weight of the mysql authentication is higher than that of the redis authentication, and the service performance is fully utilized.

[0097] Referring to Figure 4 is a structural schematic diagram of a permission authentication device provided by the embodiment of the present application, and the embodiment of the present application further provides a permission authentication device 20, which comprises:

[0098] The authentication component acquisition module 21 is configured to input an authentication request to an authentication component when a business device accesses authentication.

[0099] The token request module 22 is configured to initiate a token request to a first token bucket corresponding to the authentication component to obtain a token in the first token bucket; wherein the first token bucket is configured to obtain tokens from a second token bucket at a preset token obtaining speed, and distribute the tokens to the authentication component when the token request is received and the first token bucket has tokens.

[0100] The authentication result output module 23 is configured to perform authentication processing on the authentication request by using the authentication component if the authentication component obtains the token within a preset time length, and output an authentication result; the authentication result is an authentication failure or an authentication success; and output an authentication result of authentication failure if the authentication component does not obtain the token within the preset time length.

[0101] By using the technical means of the embodiment of the present application, the flow control of the authentication processing process performed on the authentication component is realized by issuing tokens, which can guarantee that the authentication component is not a blocking point in the case of massive business device access, prevent subsequent services from being down due to excessive traffic, effectively prevent network congestion and access timeout, and prevent malicious and abnormal devices from continuously logging in to cause adverse effects on services and networks.

[0102] As a preferred embodiment, the authentication component obtaining module 21 is specifically configured to:

[0103] obtain a permission authentication chain and a permission authentication strategy corresponding to an authentication request when a business device accesses authentication, wherein the permission authentication chain includes a plurality of authentication components, and the authentication components correspond one-to-one to the first token bucket;

[0104] select the authentication components in the permission authentication chain in turn according to a priority order of each authentication component, and input the authentication request to the currently selected authentication component.

[0105] The device further includes a final authentication result determination module configured to:

[0106] determine whether a condition for outputting an authentication result corresponding to the permission authentication strategy is met after obtaining the authentication result of the currently selected authentication component;

[0107] If the condition is met, determine a final authentication result of the authentication request according to the authentication result of each authentication component input by the authentication request.

[0108] If the condition is not met, input the authentication request to a next authentication component until it is determined that the condition for outputting the authentication result corresponding to the permission authentication strategy is met.

[0109] As a preferred embodiment, the device further includes a weight distribution module configured to:

[0110] determining a weight distribution policy of a first token bucket corresponding to each of the authentication components;

[0111] when the weight distribution policy is the balanced weight distribution policy, the weight value of the first token bucket corresponding to each of the authentication components is the same;

[0112] when the weight distribution policy is the self-defined weight distribution policy, the weight value of the first token bucket corresponding to each of the authentication components is determined according to the self-defined weight distribution policy;

[0113] determining a token acquisition speed of each of the first token buckets according to the weight value of each of the first token buckets, wherein the token acquisition speed and the weight value are in a positive correlation.

[0114] As a preferred implementation, the device further comprises a token acquisition speed adjustment module, configured to:

[0115] when the weight distribution policy is the balanced weight distribution policy, after initiating a token request to the first token bucket corresponding to the authentication component, if there is no token in the first token bucket corresponding to the authentication component, within the preset time length, the token acquisition speed of the first token bucket corresponding to the authentication component is increased by a first speed adjustment step, and the token acquisition speed of the first token bucket corresponding to other authentication components in the permission authentication chain is decreased by a second speed adjustment step.

[0116] As a preferred implementation, the device further comprises a token judgment module, configured to: after inputting an authentication request to an authentication component, when there is no previous authentication component or no previous authentication component has acquired the token, execute the following steps by the token request module: initiating a token request to the first token bucket corresponding to the authentication component to acquire the token in the first token bucket; when there is a previous authentication component and any previous authentication component has acquired the token, execute the following steps by the authentication result output module: directly using the authentication component to perform authentication processing on the authentication request and outputting an authentication result.

[0117] It should be noted that the permission authentication device provided by the embodiments of the present application is used to execute all process steps of the permission authentication method provided by the above-mentioned embodiments, and the working principles and beneficial effects of the two are one-to-one correspondence, so they will not be repeated here.

[0118] Referring to Figure 5 is a structural schematic diagram of a permission authentication device provided by the embodiments of the present application, the embodiments of the present application further provide a permission authentication device 30, comprising a processor 31, a memory 32, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the permission authentication method provided by any one of the above-mentioned embodiments when executing the computer program.

[0119] The embodiment of the present application further provides a computer readable storage medium, which comprises a stored computer program, wherein the computer program controls a device where the computer readable storage medium is located to execute the permission authentication method provided by any one of the above embodiments when the computer program is running.

[0120] It should be noted that the permission authentication device provided by the embodiment of the present application is used to execute all process steps of the permission authentication method of the above embodiments, and the working principles and advantages of the two are one-to-one corresponding, thus not being described in detail.

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware, and the program can be stored in a computer readable storage medium. When the program is executed, the program can include the processes of the above-mentioned embodiments of the methods. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM) or a random access memory (RAM) and the like.

[0122] The above is the preferred embodiment of the present application, and it should be noted that those skilled in the art can make several improvements and refinements without departing from the principles of the present application, and these improvements and refinements are also considered to be within the protection scope of the present application.

Claims

1. A method of authenticating rights, characterized by The method comprises the following steps: When a service device accesses for authentication, an authentication request is input to an authentication component; A token request is initiated to a first token bucket corresponding to the authentication component to obtain a token in the first token bucket; wherein the first token bucket is used to obtain tokens from a second token bucket at a preset token obtaining speed, and when the token request is received and there is a token in the first token bucket, the token is distributed to the authentication component; If the authentication component obtains the token within a preset time period, the authentication request is authenticated by using the authentication component, and an authentication result is output; the authentication result is authentication failure or authentication success; If the authentication component does not obtain the token within the preset time period, an authentication result of authentication failure is output; The method further comprises the following steps: When the service device accesses for authentication, a permission authentication chain and a permission authentication strategy corresponding to the authentication request are obtained, wherein the permission authentication chain comprises a plurality of authentication components, and the authentication components correspond to the first token buckets one by one; According to the priority order of each authentication component, the authentication components in the permission authentication chain are selected in sequence, and the authentication request is input to the currently selected authentication component; The method further comprises the following steps: After obtaining the authentication result of the currently selected authentication component, it is determined whether the authentication result meets the authentication result placement condition corresponding to the permission authentication strategy; If yes, the final authentication result of the authentication request is determined according to the authentication result of each authentication component input by the authentication request; If no, the authentication request is input to the next authentication component until it is determined that the authentication result meets the authentication result placement condition corresponding to the permission authentication strategy.

2. The rights authentication method of claim 1, wherein, The method further comprises the following steps: A weight distribution strategy of a plurality of first token buckets corresponding to the authentication components is determined; When the weight distribution strategy is an equal weight distribution strategy, the weight values of the first token buckets corresponding to each authentication component are the same; When the weight distribution strategy is a self-defined weight distribution strategy, the weight values of the first token buckets corresponding to each authentication component are determined according to the self-defined weight distribution strategy; According to the weight values of each first token bucket, the token obtaining speed of each first token bucket is determined; wherein the token obtaining speed and the weight value are in a positive correlation.

3. The rights authentication method of claim 2, wherein, When the weight distribution strategy is an equal weight distribution strategy, after the token request is initiated to the first token bucket corresponding to the authentication component, the method further comprises the following steps: If there is no token in the first token bucket corresponding to the authentication component, within the preset time period, the token obtaining speed of the first token bucket corresponding to the authentication component is increased by a first speed adjustment step, and the token obtaining speed of the first token buckets corresponding to other authentication components in the permission authentication chain is reduced by a second speed adjustment step.

4. The rights authentication method of claim 1, wherein, After the authentication request is input to the authentication component, the method further comprises the following steps: When there is no previous authentication component, or no previous authentication component obtains the token, the step of initiating a token request to the first token bucket corresponding to the authentication component to obtain a token in the first token bucket is performed. When there is a previous authentication component and any previous authentication component has obtained the token, the authentication request is directly authenticated by the authentication component, and an authentication result is output.

5. The rights authentication method of claim 1, wherein, The permission authentication strategy is all authentication success, any authentication success, or specified authentication success; The authentication result placement condition corresponding to the all authentication success is that the current authentication component outputs an authentication failure result, or the current authentication component is the last authentication component in the permission authentication chain; The authentication result placement condition corresponding to the any authentication success is that the current authentication component outputs an authentication success result, or the current authentication component is the last authentication component in the permission authentication chain; The authentication result placement condition corresponding to the specified authentication success is that the current authentication component is a preset specified authentication component and outputs an authentication success result, or the current authentication component is the last authentication component in the permission authentication chain.

6. The rights authentication method according to any one of claims 1 to 4, wherein The authentication request is authenticated by the authentication component, and an authentication result is output, including: Obtaining unique identification information and an access password of the service device included in the authentication request; The unique identification information and the access password are matched with all authentication information stored in the authentication component by a preset authentication mode corresponding to the authentication component, to obtain an authentication result and output.

7. An authority authentication apparatus characterized by comprising: Including: An authentication component acquisition module is configured to input an authentication request to an authentication component when a service device accesses authentication; A token request module is configured to initiate a token request to a first token bucket corresponding to the authentication component, to obtain a token in the first token bucket; wherein the first token bucket is configured to obtain tokens from a second token bucket at a preset token acquisition speed, and distribute the tokens to the authentication component when the token request is received and the first token bucket has tokens. An authentication result output module is configured to authenticate the authentication request by the authentication component if the authentication component obtains the token within a preset time period, and output an authentication result; the authentication result is authentication failure or authentication success; if the authentication component does not obtain the token within the preset time period, an authentication failure result is output. The authentication component acquisition module is specifically configured to: When a service device accesses authentication, obtain a permission authentication chain and a permission authentication strategy corresponding to an authentication request, wherein the permission authentication chain includes a plurality of authentication components, and the authentication components correspond one by one to the first token bucket; According to the priority order of each authentication component, authentication components in the permission authentication chain are selected in turn, and the authentication request is input to the currently selected authentication component; The device further includes a final authentication result determination module configured to: After obtaining the authentication result of the currently selected authentication component, determine whether the authentication result placement condition corresponding to the permission authentication strategy is met; If yes, determine a final authentication result of the authentication request according to the authentication result of each authentication component input by the authentication request. If not, the authentication request is input to a next authentication component until a condition of the authentication result corresponding to the permission authentication policy is satisfied.

8. An authority authentication apparatus characterized by comprising: A processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the computer program, when executed by the processor, implements the permission authentication method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program, wherein the computer readable storage medium controls a device where the computer readable storage medium is located to execute the permission authentication method according to any one of claims 1 to 6 when the computer program runs.

Images