Application authentication method and device

Abstract

The invention discloses an application authentication method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the following steps: in response to a received authentication service calling request, determining an authentication level according to the authentication service calling request; and under the condition that the authentication level is interface verification, obtaining a service system identifier, an application identifier and an interface authentication code according to the authentication service calling request, and performing interface verification according to the service system identifier, the application identifier and the interface authentication code. According to the implementation mode, the development and maintenance time of codes is saved, the universality, configurability and expandability of authentication services are improved, the situation that authentication codes are counterfeited across systems can be avoided, and the security of interface calling and system access is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for application authentication. Background Art

[0002] Internet applications are becoming more and more mature, system capabilities are becoming more and more powerful, there are more and more internal and external users, the system architecture is becoming more and more complex, and the interface calls between systems are increasing. However, many interfaces cannot provide services for all other systems. At the same time, we often need to count and control the system throughput of the caller of the interface. In order to better protect the stability and security of the system interface, the authentication of the system interface or method (resource) is becoming more and more important. The authentication of the interface or method (resource) is also an indispensable requirement. Usually, interface authentication can be achieved by customizing the authentication code (for example, token) or dynamically generating the authentication code at the time of request.

[0003] In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art: the authentication code generation methods are diverse, and different systems may generate the same authentication code when the authentication code generation rules are the same. Forged authentication codes may occur across systems, making it impossible to guarantee the security of interface calls; at the same time, different systems need to repeat the coding in their own systems to implement authentication services, which is not configurable and has poor versatility. At the same time, the development efficiency is low and the scalability is not strong. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a method and device for application authentication, which can separate the authentication service from the business system. Different systems do not need to repeat the coding in their own systems separately, which saves code development and maintenance time, improves the versatility, configurability and scalability of the authentication service, and for different business systems and applications, regardless of whether the same authentication code generation rules are used, the occurrence of cross-system authentication code forgery can be avoided, thereby improving the security of interface calls and system access.

[0005] To achieve the above object, according to one aspect of an embodiment of the present invention, a method for application authentication is provided, comprising: In response to receiving the authentication service invocation request, determining an authentication level according to the authentication service invocation request; When the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained according to the authentication service call request, and interface verification is performed according to the business system identifier, the application identifier and the interface authentication code.

[0006] Optionally, interface verification is performed based on the business system identifier, the application identifier and the interface authentication code, including: obtaining an application authentication table of the corresponding business system based on the business system identifier; obtaining an application authentication code corresponding to the application identifier from the application authentication table, and performing interface verification on the application based on the application authentication code and the interface authentication code.

[0007] Optionally, the application authentication code is generated based on the business system identifier and the application identifier.

[0008] Optionally, the method further includes: when the authentication level is resource verification, obtaining a business system identifier, an application identifier and a resource identifier according to the authentication service call request, and performing resource access permission verification according to the business system identifier, the application identifier and the resource identifier.

[0009] Optionally, resource access permission verification is performed based on the business system identifier, the application identifier and the resource identifier, including: obtaining an access permission table for the corresponding resource based on the business system identifier and the resource identifier; searching from the access permission table for whether there is a resource authorization code corresponding to the application identifier; if there is a resource authorization code corresponding to the application identifier in the access permission table, the application has access permission to the resource.

[0010] Optionally, annotations are added to the interface classes and resource methods that need to be authenticated in the business system to trigger the authentication service call request when the application accesses the business system; the authentication level is determined according to the authentication service call request, including: determining the authentication level according to the annotation category that triggers the authentication service call request, the annotation category including interface class annotations and resource method annotations.

[0011] Optionally, when the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained according to the authentication service call request, including: when the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained from the interface class annotation that triggers the authentication service call request; when the authentication level is resource verification, the business system identifier, application identifier and resource identifier are obtained according to the authentication service call request, including: when the authentication level is resource verification, the business system identifier, application identifier and resource identifier are obtained from the resource method annotation that triggers the authentication service call request.

[0012] Optionally, before performing interface verification based on the business system identifier, the application identifier and the interface authentication code, or performing resource access permission verification based on the business system identifier, the application identifier and the resource identifier, it also includes: obtaining an authentication whitelist, and determining whether interface verification or resource access permission verification is required based on the authentication whitelist.

[0013] According to another aspect of an embodiment of the present invention, there is provided a device for application authentication, including: A level determination module, configured to, in response to receiving an authentication service call request, determine an authentication level according to the authentication service call request; The interface verification module is used to obtain the business system identifier, application identifier and interface authentication code according to the authentication service call request when the authentication level is interface verification, and perform interface verification according to the business system identifier, the application identifier and the interface authentication code.

[0014] According to another aspect of an embodiment of the present invention, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for application authentication provided by an embodiment of the present invention.

[0015] According to another aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored. When the program is executed by a processor, the method for application authentication provided by an embodiment of the present invention is implemented.

[0016] An embodiment of the above invention has the following advantages or beneficial effects: by responding to receiving an authentication service call request, determining the authentication level according to the authentication service call request; when the authentication level is interface verification, obtaining the business system identifier, application identifier and interface authentication code according to the authentication service call request, and performing interface verification according to the business system identifier, application identifier and interface authentication code. This technical solution realizes the separation of the authentication service from the business system, and different systems do not need to repeat the coding in their own systems separately, saving code development and maintenance time, improving the versatility, configurability and scalability of the authentication service, and for different business systems and applications, regardless of whether the same authentication code generation rules are used, the occurrence of cross-system authentication code forgery can be avoided, thereby improving the security of interface calls and system access.

[0017] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention. Figure 1 is a schematic diagram of main steps of a method for application authentication according to an embodiment of the present invention; Figure 2 It is a schematic diagram of the application authentication process of an embodiment of the present invention; Figure 3 is a schematic diagram of main modules of an apparatus for application authentication according to an embodiment of the present invention; Figure 4 is an exemplary system architecture diagram to which embodiments of the present invention may be applied; Figure 5 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0020] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution disclosed in the present invention are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0021] In order to solve the problems existing in the prior art, the present invention provides a lightweight authentication service software package, which can exist in the form of a component for business systems that need to perform interface and method authorization to rely on and call, with the purpose of providing a general interface and method authentication strategy and the realization of general authentication capabilities. The business system can access the authentication service software package of the present invention, encapsulate a service based on the authentication service software package, including a page authentication service, to provide authentication capabilities for other systems that need authentication. The business system that needs authentication can also directly rely on the authentication service software package of the present invention, use the interface and method authentication annotations provided by the authentication service software package, and realize the general authentication capability in a lightweight manner. After the business system is connected to the authentication service software package, it is necessary to add the data source configuration file for authentication configuration in the business system (including the path URL of the database table where the authentication table is located, the username username and password password, etc.). At the same time, the connected business system needs to add the authentication table provided by this authentication service (for example, including system table, application table, resource table and permission table). By entering the business system identifier (sys_code), the application identifier (app_code) connected to the business system, the interface method name identifier (res_code) provided by the business system and the resource permission data identifier (auth_code) authorized by the current system to a certain application in each table; then add the @DoInterfaceAuth annotation above the interface class file that requires user authentication, so that the application identifier app_code and interface authentication code t oken, where app_code is configured for the access application of the business system in the application table, and token is generated when app_code is configured; at the same time, the @DoMethodAuth annotation can be added above the method (resource) that needs to be authenticated to authenticate the current method. Adding the @DoMethodAuth annotation method indicates that the application accessing the business system needs to configure the method (resource) permission for the app_code of the current application before it can access it. Otherwise, the method (resource) will directly throw the public exception (AuthFailException) of authentication failure provided by the authentication service component, thereby achieving consistent authentication rules for multiple access applications, and the interface authentication code token is globally unique to prevent token forgery. At the same time, it provides general authentication capabilities, and the business system is easily accessed without hard coding, with strong scalability, improving code development and maintenance efficiency.

[0022] The present invention is based on the idea of ​​dynamic proxy and authentication configuration, encapsulates the authentication implementation of interface dimension and method (resource) dimension, and provides configurable authentication strategy based on system-application-resource-authority dimension, which is safe and universal. The business system accesses the authentication service software package of the present invention, with almost zero development, and only a little configuration (data source configuration + authentication annotation configuration) is needed to complete the authentication service access of the interface and method. The core idea of ​​the present invention is to use the dynamic proxy idea, provide annotations that can specify class paths, and realize the verification of the core logic of authentication. At the same time, a whitelist configuration for priority authentication is performed in a specified format through a configuration center (or other storage media provides a configuration address), and the specified format is: ({sys_code+”_”+app_code+”_”+res_code:0 / 1} or {sys_code+”_”+app_code+”_”+auth_code:0 / 1}, and the resource or permission auth_code of the specified app_code can be set for authorization release (1 means release, 0 means authentication required), and unconfigured interfaces or resources are required to be authenticated by default, and specific logic processing is performed; through the authentication logic mapping of system-application-resource-authority, the design of the underlying data storage is completed, a reusable and scalable authentication service architecture is provided, and a general out-of-the-box basic authentication capability is provided for the business system. At the same time, the business system can be easily secondary developed based on the authentication service software package of the present invention, providing more complex authentication capabilities, which are flexible and scalable.

[0023] The present invention provides a system-application-resource-authority data table template, which implements the authorization of the method (resource) res_code by the business system sys_code and the application app_code docked with the system. Before authorization, the permission status of the specified method (resource) of the specified application can be set preferentially through the sys_code_app_code_res_code template. After authorization, the permission status after allocation can be processed through the sys_code_app_code_auth_code template, and priority can be given without performing permission logic verification; at the same time, a data source configuration template datasource.cfg.xml is provided, so that the business system can configure the data source information by itself. When the business system is started, the authentication service component of the present invention will automatically load the data source configuration, and create a data source instance by instantiating the data source factory object. The annotations in the authentication service can operate the specified data table (for example, including the system table, application table, resource table and permission table) according to the data source instance, and the data tables can also be added, deleted, modified and checked. The relevant objects and specific implementation principles involved in the present invention are as follows.

[0024] (1) Authentication table template (system-application-resource-authority). The present invention provides an authentication table template. The system table stores the code sys_code of the business system. After the business system accesses the authentication service software package of the present invention, if the interface and method authentication capabilities of the present invention are used directly on its own system, the system table only needs to store the sys_code of the current business system. If the business system is secondary developed based on the present invention and provides services for uniformly using the authentication capabilities of the present invention for several systems, the system table stores multiple sys_codes for accessing business systems. The application table is a downstream application for accessing the business system. For different access applications, the table is configured with an access application identifier app_code corresponding to the business system identifier sys_code and a globally unique application authentication code token generated based on the business system sys_code + application app_code combined with the snowflake algorithm. The resource table stores the authorizable method (resource) name and code res_code provided by the current business system for the accessed application, as well as the system or application where the resource is located. The authority table authorizes the accessed application app_code for the resource res_code of the current business system sys_code. After authorization, the generated auth_code globally unique identifier is saved as the resource authorization code.

[0025] (2) Authentication data source configuration template (datasource.cfg.xml). The component of the present invention provides an authentication data source configuration file template, which provides parameter configurations such as the path, user name, password, data source driver, maximum and minimum number of connections, number of idle connections, and timeout time of the data source corresponding to the authentication service. After the business system installs the authentication service software package of the present invention, when the business system is started, the business system will dynamically load datasource.cfg.xml, instantiate the data source factory object, and create a data source object based on the data source driver class through the factory mode. The object will query the permission auth_code information of the access application in the authentication annotation and put it into the memory cache for the annotation to perform permission verification.

[0026] (3) Interface authentication annotation (DoInterfaceAuth). This annotation provides class attributes. The business system decides whether an interface needs to be authenticated (whether an application needs to be connected to the current system to access the interface). If necessary, add this annotation configuration above the interface file and set the class attribute to the path of the current interface. Based on the idea of ​​dynamic proxy, this annotation obtains all methods and method input parameters under the current interface, parses the input parameters, obtains the application identifier app_code and the interface authentication code token field, and queries the authentication application table to verify whether the current app_code and token are correct, thereby achieving the authentication effect in the interface dimension.

[0027] (4) Method authentication annotation (DoMethodAuth), which provides syscodekey and authKey attributes. Syscodekey is the sys_code of the current business system, and authkey is the method name (i.e., resource name) configured in the resource table. The business system decides whether a method needs to be authenticated (whether the method access rights have been configured for a certain application to access the current method). If necessary, add the annotation configuration above the method, and configure syscodekey as the sys_code of the current system, and configure authkey as the resource name res_code. Based on the idea of ​​dynamic proxy, the annotation will obtain the syscodekey, authkey, and parameter list of the method configured in the annotation, parse the parameter list, obtain the app_code of the current request, and query the permission table through app_code, syscodekey, and authkey to see whether the resource authorization code corresponding to the app_code has been configured and whether the resource authorization code is effective, thereby achieving the authentication effect of the method dimension.

[0028] (5) Authentication whitelist configuration. The present invention uses the configuration center and the specified configuration template to configure interface or method permissions in priority to authentication annotations. This is mainly used in certain scenarios where authentication needs to be released or authentication is downgraded. The specified configuration template format is, for example: {'sys_code'_'app_code'_'res_code': status value 0 / 1} and {'sys_code'_'app_code'_'auth_code': status value 0 / 1}, which respectively configure whether the current business system needs authentication or release for the accessed application. If the status value is configured to 0, it means authentication is required, and if it is configured to 1, it means release. If it is not configured, it defaults to authentication. The whitelist configuration has a higher priority than the annotation configuration.

[0029] Based on the above configuration, when a user requests a business system interface method, the authentication service component of the present invention will be called, and then the authentication service component will parse whether the interface or method is configured with an authentication annotation. If so, it will obtain the request parameters and annotation attributes, and perform interface-level and method-level authentication verification. The interface-level authentication is to verify whether the application is connected to the current system and has generated app_code and token. The method-level authentication verifies whether the app_code is configured with the permissions of the current method (resource). There is no need for the business system to implement it by itself, which improves R&D efficiency.

[0030] Figure 1 It is a schematic diagram of main steps of the method for application authentication according to an embodiment of the present invention. Figure 1It shows how the authentication service component performs application authentication in an embodiment of the present invention. Figure 1 As shown, the application authentication method of the embodiment of the present invention mainly includes the following steps S101 to S102.

[0031] Step S101: in response to receiving an authentication service call request, determining an authentication level according to the authentication service call request. After the business system introduces the authentication service component to perform authentication service operations, the authentication service component can be called every time an authentication service is performed.

[0032] According to an embodiment of the present invention, by adding annotations to the interface classes and resource methods that need to be authenticated in the business system, an authentication service call request is triggered when the application accesses the business system. In addition, the authentication level is determined according to the authentication service call request, which may specifically include: determining the authentication level according to the annotation category that triggers the authentication service call request, and the annotation category includes interface class annotations and resource method annotations. The interface class annotation is the annotation of the interface class that needs to be authenticated, and the resource method annotation is the annotation of the resource method that needs to be authenticated.

[0033] Step S102: When the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained according to the authentication service call request, and interface verification is performed according to the business system identifier, application identifier and interface authentication code.

[0034] According to one embodiment of the present invention, interface verification is performed based on the business system identifier, application identifier and interface authentication code, which may specifically include: obtaining the application authentication table of the corresponding business system based on the business system identifier; obtaining the application authentication code corresponding to the application identifier from the application authentication table, and performing interface verification on the application based on the application authentication code and the interface authentication code. Among them, the application authentication code is generated based on the business system identifier and the application identifier. In the embodiment of the present invention, the application authentication table is the application table described in the aforementioned embodiment, which records the application identifiers of the applications allowed to access by the current business system, and the globally unique application authentication code of the application generated based on the business system identifier + application identifier combined with the snowflake algorithm. Here, other algorithms can also be used to generate application authentication codes, and the present invention does not limit this.

[0035] According to an embodiment of the present invention, when the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained according to the authentication service call request, which can specifically include: when the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained from the interface class annotation that triggers the authentication service call request. Specifically, within the interface class annotation that triggers the authentication service call request, all methods and method input parameters under the current interface will be obtained based on the idea of ​​dynamic proxy, and the method input parameters will be parsed to obtain the application identifier app_code and the interface authentication code field, and the authentication application table will be queried to verify whether the current app_code and interface authentication code are correct, so as to achieve the authentication effect of the interface dimension.

[0036] According to an embodiment of the present invention, the application authentication method may further include the following step S103 (not shown in Figure 1 ).

[0037] Step S103: when the authentication level is resource verification, the business system identifier, application identifier and resource identifier are obtained according to the authentication service call request, and resource access permission verification is performed according to the business system identifier, application identifier and resource identifier.

[0038] According to an embodiment of the present invention, resource access permission verification is performed based on the business system identifier, application identifier and resource identifier, which may specifically include: obtaining the access permission table of the corresponding resource based on the business system identifier and resource identifier; searching the access permission table for whether there is a resource authorization code corresponding to the application identifier; if there is a resource authorization code corresponding to the application identifier in the access permission table, the application has access permission to the resource. In an embodiment of the present invention, the access permission table is the permission table introduced in the aforementioned embodiment, which records the resource authorization code generated by the resource res_code of the current business system sys_code for the access application app_code.

[0039] According to an embodiment of the present invention, when the authentication level is resource verification, obtaining the business system identifier, application identifier and resource identifier according to the authentication service call request may specifically include: when the authentication level is resource verification, obtaining the business system identifier, application identifier and resource identifier from the resource method annotation that triggers the authentication service call request. Specifically, within the resource method annotation that triggers the authentication service call request, based on the idea of ​​dynamic proxy, the business system identifier, resource identifier and parameter list of the method configured in the current annotation are obtained, the parameter list is parsed, the application identifier of the current request is obtained, the permission table is queried through the application identifier, business system identifier and resource identifier, and it is determined whether there is a resource authorization code corresponding to the application in the permission table and whether the resource authorization code has taken effect, thereby achieving the authentication effect of the method dimension.

[0040] According to another embodiment of the present invention, before performing interface verification based on the business system identifier, application identifier and interface authentication code, or performing resource access permission verification based on the business system identifier, application identifier and resource identifier, it may also include: obtaining an authentication whitelist, and determining whether interface verification or resource access permission verification is required based on the authentication whitelist.

[0041] Figure 2 FIG. 1 is a schematic diagram of an application authentication process according to an embodiment of the present invention. Figure 2 As shown, in one embodiment of the present invention, the application authentication process is mainly as follows: after receiving the authentication service call request, the authentication level is first determined according to the authentication service call request. If the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained, and the interface verification is performed according to the business system identifier, application identifier and interface authentication code. If the verification is successful, the interface can be called, otherwise the authentication failure is returned; if the authentication level is resource verification, the business system identifier, application identifier and resource identifier are obtained, and the resource access permission verification is performed according to the business system identifier, application identifier and resource identifier. If the verification is successful, the resource method can be accessed, otherwise the authentication failure is returned.

[0042] Figure 3 FIG. 1 is a schematic diagram of the main modules of the device for application authentication according to an embodiment of the present invention. Figure 3 As shown, the device 300 for application authentication according to the embodiment of the present invention mainly includes: a level determination module 301 and an interface verification module 302 .

[0043] The level determination module 301 is used to determine the authentication level according to the authentication service call request in response to receiving the authentication service call request; The interface verification module 302 is used to obtain the business system identifier, application identifier and interface authentication code according to the authentication service call request when the authentication level is interface verification, and perform interface verification according to the business system identifier, application identifier and interface authentication code.

[0044] According to one embodiment of the present invention, the interface verification module 302 can also be used to: obtain the application authentication table of the corresponding business system according to the business system identifier; obtain the application authentication code corresponding to the application identifier from the application authentication table, and perform interface verification on the application based on the application authentication code and the interface authentication code.

[0045] According to an embodiment of the present invention, the application authentication code is generated based on the service system identifier and the application identifier.

[0046] According to another embodiment of the present invention, the application authentication device 300 may also apply for a resource verification module 303 ( Figure 3), which is used to obtain the business system identifier, application identifier and resource identifier according to the authentication service call request when the authentication level is resource verification, and perform resource access permission verification according to the business system identifier, application identifier and resource identifier.

[0047] According to another embodiment of the present invention, the resource verification module 303 can also be used to: obtain the access permission list of the corresponding resource based on the business system identifier and the resource identifier; search from the access permission list whether there is a resource authorization code corresponding to the application identifier; if there is a resource authorization code corresponding to the application identifier in the access permission list, the application has access permission to the resource.

[0048] According to another embodiment of the present invention, annotations are added to the interface classes and resource methods that need to be authenticated in the business system to trigger an authentication service call request when the application accesses the business system; and the level determination module 301 can also be used to determine the authentication level based on the annotation category that triggers the authentication service call request, and the annotation category includes interface class annotations and resource method annotations.

[0049] According to another embodiment of the present invention, the interface verification module 302 can also be used to: when the authentication level is interface verification, obtain the business system identifier, application identifier and interface authentication code from the interface class annotation that triggers the authentication service call request. The resource verification module 303 can also be used to: when the authentication level is resource verification, obtain the business system identifier, application identifier and resource identifier from the resource method annotation that triggers the authentication service call request.

[0050] According to another embodiment of the present invention, the application authentication device 300 may further include a whitelist authentication module (not shown in the figure), which is used to: before performing interface verification based on the business system identifier, application identifier and interface authentication code, or performing resource access permission verification based on the business system identifier, application identifier and resource identifier, obtain an authentication whitelist, and determine whether interface verification or resource access permission verification is required based on the authentication whitelist.

[0051] According to the technical solution of the embodiment of the present invention, by responding to receiving an authentication service call request, the authentication level is determined according to the authentication service call request; when the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained according to the authentication service call request, and the interface verification is performed according to the business system identifier, application identifier and interface authentication code. This technical solution realizes the separation of the authentication service from the business system, and different systems do not need to repeat the coding in their own systems separately, which saves code development and maintenance time, improves the versatility, configurability and scalability of the authentication service, and for different business systems and applications, regardless of whether the same authentication code generation rules are used, the occurrence of cross-system authentication code forgery can be avoided, thereby improving the security of interface calls and system access.

[0052] Figure 4 An exemplary system architecture 400 is shown to which the method for application authentication or the apparatus for application authentication according to the embodiment of the present invention can be applied.

[0053] like Figure 4 As shown, system architecture 400 may include terminal devices 401, 402, 403, network 404 and server 405. Network 404 is used to provide a medium for communication links between terminal devices 401, 402, 403 and server 405. Network 404 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0054] Users can use terminal devices 401, 402, 403 to interact with server 405 through network 404 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 401, 402, 403, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0055] The terminal devices 401 , 402 , and 403 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0056] The server 405 may be a server that provides various services, such as a background management server that provides support for websites browsed by users using terminal devices 401, 402, and 403 (only as an example). The background management server may respond to the received authentication service call request and other data, and determine the authentication level according to the authentication service call request; when the authentication level is interface verification, the business system identifier, application identifier, and interface authentication code are obtained according to the authentication service call request, and interface verification and other processing are performed according to the business system identifier, application identifier, and interface authentication code, and the processing result (such as application authentication result - only as an example) is fed back to the terminal device.

[0057] It should be noted that the application authentication method provided in the embodiment of the present invention is generally executed by the server 405 , and accordingly, the application authentication device is generally set in the server 405 .

[0058] It should be understood that Figure 4 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0059] Reference below Figure 5 , which shows a schematic diagram of the structure of a computer system 500 of a terminal device or a server suitable for implementing an embodiment of the present invention. Figure 5 The terminal device or server shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0060] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0061] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0062] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present invention are executed.

[0063] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0064] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0065] The units or modules involved in the embodiments of the present invention may be implemented in software or hardware. The units or modules described may also be arranged in a processor. For example, they may be described as: a processor includes a level determination module and an interface verification module. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves. For example, the level determination module may also be described as "a module for determining an authentication level according to an authentication service call request in response to receiving an authentication service call request."

[0066] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: in response to receiving an authentication service call request, determining an authentication level according to the authentication service call request; when the authentication level is interface verification, obtaining a business system identifier, an application identifier, and an interface authentication code according to the authentication service call request, and performing interface verification according to the business system identifier, the application identifier, and the interface authentication code.

[0067] According to the technical solution of the embodiment of the present invention, by responding to receiving an authentication service call request, the authentication level is determined according to the authentication service call request; when the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained according to the authentication service call request, and the interface verification is performed according to the business system identifier, application identifier and interface authentication code. This technical solution realizes the separation of the authentication service from the business system, and different systems do not need to repeat the coding in their own systems separately, which saves code development and maintenance time, improves the versatility, configurability and scalability of the authentication service, and for different business systems and applications, regardless of whether the same authentication code generation rules are used, the occurrence of cross-system authentication code forgery can be avoided, thereby improving the security of interface calls and system access.

[0068] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for application authentication, characterized in that: include: In response to receiving the authentication service invocation request, determining an authentication level according to the authentication service invocation request; When the authentication level is interface verification, the business system identifier, application identifier and interface authentication code are obtained according to the authentication service call request, and interface verification is performed according to the business system identifier, the application identifier and the interface authentication code.

2. The method according to claim 1, characterized in that Performing interface verification according to the business system identifier, the application identifier and the interface authentication code includes: According to the business system identifier, obtaining an application authentication table of the corresponding business system; The application authentication code corresponding to the application identifier is obtained from the application authentication table, and an interface verification is performed on the application based on the application authentication code and the interface authentication code.

3. The method according to claim 2, characterized in that The application authentication code is generated based on the business system identifier and the application identifier.

4. The method according to claim 1, characterized in that: The method further comprises: When the authentication level is resource verification, the business system ID, application ID and resource ID are obtained according to the authentication service call request, and the resource access permission is verified according to the business system ID, application ID and resource ID.

5. The method according to claim 4, characterized in that Performing resource access permission verification according to the business system identifier, the application identifier, and the resource identifier includes: According to the business system identifier and the resource identifier, obtaining an access permission table of the corresponding resource; Searching the access permission table for a resource authorization code corresponding to the application identifier; When the resource authorization code corresponding to the application identifier exists in the access permission table, the application has the access permission for the resource.

6. The method according to claim 4, characterized in that By adding annotations to the interface classes and resource methods that need to be authenticated in the business system, the authentication service call request is triggered when the application accesses the business system; Determining the authentication level according to the authentication service call request includes: The authentication level is determined according to the annotation category that triggers the authentication service call request, and the annotation category includes interface class annotation and resource method annotation.

7. The method according to claim 6, characterized in that When the authentication level is interface verification, obtaining the business system identifier, application identifier and interface authentication code according to the authentication service call request includes: When the authentication level is interface verification, obtaining the business system identifier, application identifier and interface authentication code from the interface class annotation that triggers the authentication service call request; When the authentication level is resource verification, obtaining a business system identifier, an application identifier, and a resource identifier according to the authentication service call request includes: When the authentication level is resource verification, the business system identifier, application identifier and resource identifier are obtained from the resource method annotation that triggers the authentication service call request.

8. The method according to claim 4, characterized in that Before performing interface verification according to the business system identifier, the application identifier and the interface authentication code, or performing resource access permission verification according to the business system identifier, the application identifier and the resource identifier, the method further includes: Obtain an authentication whitelist, and determine whether interface verification or resource access permission verification is required based on the authentication whitelist.

9. A device for application authentication, characterized in that: include: A level determination module, configured to, in response to receiving an authentication service call request, determine an authentication level according to the authentication service call request; The interface verification module is used to obtain the business system identifier, application identifier and interface authentication code according to the authentication service call request when the authentication level is interface verification, and perform interface verification according to the business system identifier, the application identifier and the interface authentication code.

10. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 8.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images