Service signature verification method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a service signature verification method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: receiving a business service request from a client; the business service request comprises a token and a target business identifier, and the token and the target business identifier are distributed by a service signature verification system in the login process of the client; based on the token and a target service identifier, obtaining a signature verification code and a first preset number of signature verification judgment statements corresponding to the target service identifier; determining a signature verification rule based on the signature verification code and the signature verification judgment statement; verifying the business service request based on the signature verification rule; and if the verification is passed, processing the business service request and sending a processing result to the client. By adopting the method, different service identifiers can be set for different clients, and different signature verification rules can be flexibly set according to requirements of different services and permissions of different clients.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a service signature verification method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] Interface security is a key challenge in modern Internet services. As the number of service interfaces increases, the traditional single signature verification rule can no longer meet the complex and changing security requirements. Unified signature verification rules can no longer meet the diverse security requirements of different businesses and users. Fields with extremely high requirements for data security, such as financial institutions and healthcare providers, require complex and strict signature verification methods; while services with high real-time requirements, such as instant messaging, may seek faster but relatively low-security solutions. This one-size-fits-all approach cannot adapt to complex business situations and exposes the limitations of existing systems in the selection of security verification methods. In addition, different roles have different authentication levels. For example, administrator authentication involving sensitive and important data requires higher and stricter authentication, while users with visitor identities generally only access public resources and tend to use faster and simpler authentication.

[0003] Therefore, different business scenarios have different requirements for security and efficiency, and existing signature verification methods lack the necessary flexibility and adaptability to effectively respond to emerging security threats or meet the complex needs of international business. Summary of the invention

[0004] Based on this, it is necessary to provide a service signature verification method, device, computer equipment, computer-readable storage medium and computer program product that can flexibly generate signature verification rules to address the above technical problems.

[0005] In a first aspect, the present application provides a service signature verification method, comprising:

[0006] Receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by the service signature verification system during the client login process;

[0007] Based on the token and the target service identifier, obtaining a first preset number of signature verification judgment statements corresponding to the signature verification code and the target service identifier;

[0008] Determining a signature verification rule based on the signature verification code and the signature verification judgment statement;

[0009] Verifying the business service request based on the signature verification rule;

[0010] If the verification is successful, the business service request is processed and the processing result is sent to the client.

[0011] In one embodiment, determining a signature verification rule based on the signature verification code and the signature verification judgment statement includes:

[0012] The determining of the signature verification rule based on the signature verification code and the signature verification judgment statement includes:

[0013] The signature verification code is converted into a binary digital sequence of a second preset number of bits; based on the binary digital sequence, the signature verification judgment statement corresponding to the current binary flag bit is searched in order from high bit to low bit; if the value of the current binary flag bit is the first preset value, it is necessary to verify the signature object of the signature verification judgment statement corresponding to the current binary flag bit; if the value of the current binary flag bit is the second preset value, it is not necessary to verify the signature object of the signature verification judgment statement corresponding to the binary flag bit, and obtain the signature verification judgment result corresponding to the current bit; the signature verification judgment results corresponding to each bit in the binary digital sequence are combined to obtain the signature verification rule.

[0014] In one embodiment, the method further comprises:

[0015] Receive a permission update request from an operation and maintenance client; based on the update request, update the service identification, signature verification code and token of the corresponding client.

[0016] In one embodiment, before receiving the service request from the client, the method further includes:

[0017] Receive a permission request from a client; the permission request includes a token; based on the token, determine the business identifier and signature verification statement of the business service that the client can access; based on the business identifier, set the value of the flag bit of the binary digital sequence of a second preset number of digits corresponding to the signature verification statement to a first preset value, and set the remaining flag bits of the binary digital sequence of the second preset number of digits to a second preset value; obtain a binary digital sequence of a second preset number of digits for signature verification; convert the binary digital sequence of the second preset number of digits for signature verification into a decimal digital sequence to obtain a signature verification code; send the business identifier and the signature verification code to the client.

[0018] In one embodiment, before receiving the permission request from the client, the method further includes:

[0019] Receive a login request from a client; the login request includes an account number and a password; verify the account number and password; if the verification is successful, send a token and a key corresponding to the account number to the client.

[0020] In one embodiment, the method further comprises:

[0021] If the verification fails, an error message is returned.

[0022] In the second aspect, the present application also provides a service signature verification system, including: a gateway, a login service, a rights management service, and a background service;

[0023] The gateway receives a business service request from a client; the business service request includes a token, a target business identifier and a signature, the token is allocated by the login service during the client login process; the target business identifier is allocated by the authority management service during the client login process;

[0024] The gateway obtains the signature verification code corresponding to the token from the rights management service based on the token; determines the signature verification rule based on the target service identifier and the signature verification code; verifies the signature of the service request based on the signature verification rule; if the verification passes, sends the service request to the background service;

[0025] The backend service processes the service request and sends the processing result to the client through the gateway.

[0026] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0027] Receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by the service signature verification system during the client login process;

[0028] Based on the token, obtain the signature verification code corresponding to the token;

[0029] Determining a signature verification rule based on the target service identifier and the signature verification code;

[0030] Verifying the business service request based on the signature verification rule;

[0031] If the verification is successful, the business service request is processed and the processing result is sent to the client.

[0032] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0033] Receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by the service signature verification system during the client login process;

[0034] Based on the token, obtain the signature verification code corresponding to the token;

[0035] Determining a signature verification rule based on the target service identifier and the signature verification code;

[0036] Verifying the business service request based on the signature verification rule;

[0037] If the verification is successful, the business service request is processed and the processing result is sent to the client.

[0038] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0039] Receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by the service signature verification system during the client login process;

[0040] Based on the token, obtain the signature verification code corresponding to the token;

[0041] Determining a signature verification rule based on the target service identifier and the signature verification code;

[0042] Verifying the business service request based on the signature verification rule;

[0043] If the verification is successful, the business service request is processed and the processing result is sent to the client.

[0044] The above-mentioned service signature verification method, device, computer equipment, computer-readable storage medium and computer program product receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are assigned by the service signature verification system during the client login process; based on the token and the target business identifier, obtain the signature verification code and the first preset number of signature verification judgment statements corresponding to the target business identifier; based on the signature verification code and the signature verification judgment statement, determine the signature verification rules; based on the signature verification rules, verify the business service request; if the verification passes, process the business service request and send the processing result to the client. By setting different business identifiers for different clients, different signature verification rules can be flexibly set according to the needs of different businesses and the security permissions of different clients. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 This is an application environment diagram of a service signature verification method in an embodiment;

[0047] FIG2 is a schematic diagram of a flow chart of a service signature verification method in one embodiment;

[0048] FIG3 is a schematic diagram of determining a signature verification rule according to a signature verification code in one embodiment;

[0049] FIG4 is a schematic diagram of a process of updating permissions in one embodiment;

[0050] FIG5 is a flowchart of a service signature verification method in one embodiment;

[0051] FIG6 is a structural block diagram of a service signature verification system in one embodiment;

[0052] FIG. 7 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] The service signature verification method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the client 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Receive a business service request from the client; the business service request includes a token and a target business identifier, and the token and the target business identifier are assigned by the service verification system during the client login process; based on the token and the target business identifier, obtain the verification code and the first preset number of verification judgment statements corresponding to the target business identifier; based on the verification code and the verification judgment statement, determine the verification rule; based on the verification rule, verify the business service request; if the verification is passed, process the business service request and send the processing result to the client. Among them, the client 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head mounted device may be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0055] In an exemplary embodiment, as shown in FIG2 , a service signature verification method is provided, and the method is applied to Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0056] In one embodiment, as shown in FIG2 , a service signature verification method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0057] Step 202, receiving a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by a service signature verification system during the client login process.

[0058] The business service request is a request for a service that the client wants to access.

[0059] Optionally, the business service request may be a data query request.

[0060] The token is used to identify the client's identity and the business services it can access.

[0061] The business identifier is used to identify each business service; the target business identifier is the target business service currently being accessed.

[0062] Exemplarily, a business service request is received from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by the service signature verification system during the client login process.

[0063] Step 204: Based on the token and the target service identifier, obtain a first preset number of signature verification judgment statements corresponding to the signature verification code and the target service identifier.

[0064] Optionally, the first preset number may be 13.

[0065] Optionally, the signature verification statement includes: whether to verify the path, whether to verify the key, whether to verify the timestamp, etc.

[0066] The signature verification code and the signature verification judgment statement together generate the information that the client needs to verify when accessing business data.

[0067] Exemplarily, a list of services accessible to the client is determined based on the token, and a service currently desired to be accessed is determined based on a target service identifier. If the service currently desired to be accessed is in the list of services accessible to the client, a signature verification code and a first preset number of signature verification judgment statements corresponding to the target service identifier are obtained. If the service currently desired to be accessed is not in the list of services accessible to the client, a prompt of insufficient authority is returned.

[0068] Step 206: Determine a signature verification rule based on the signature verification code and the signature verification judgment statement.

[0069] Optionally, the signature verification code can be a string of numbers, which together with the signature verification statement determine the information that needs to be verified.

[0070] Exemplarily, the signature verification code and the signature verification judgment statement are matched and judged to determine the signature verification rule.

[0071] Step 208: verify the business service request based on the signature verification rule.

[0072] Optionally, the signature verification rules include: signature verification path, non-signature verification key, signature verification timestamp, etc.

[0073] Exemplarily, the business service requests are verified one by one based on the contents to be verified according to the signature verification rule.

[0074] Step 210: If the verification is successful, the business service request is processed and the processing result is sent to the client.

[0075] Among them, the business service requests are verified one by one based on the contents to be verified by the signature verification rules. If all are correct, the verification passes, otherwise it fails.

[0076] Exemplarily, if the verification is successful, the business service request is processed and the processing result is sent to the client.

[0077] The above-mentioned service signature verification method, device, computer equipment, computer-readable storage medium and computer program product receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are assigned by the service signature verification system during the client login process; based on the token and the target business identifier, obtain the signature verification code and the first preset number of signature verification judgment statements corresponding to the target business identifier; based on the signature verification code and the signature verification judgment statement, determine the signature verification rules; based on the signature verification rules, verify the business service request; if the verification passes, process the business service request and send the processing result to the client. By setting different business identifiers for different clients, different signature verification rules can be flexibly set according to the needs of different businesses and the security permissions of different clients.

[0078] In an exemplary embodiment, determining the signature verification rule based on the signature verification code and the signature verification judgment statement includes:

[0079] The determining of the signature verification rule based on the signature verification code and the signature verification judgment statement includes:

[0080] The signature verification code is converted into a binary digital sequence of a second preset number of bits; based on the binary digital sequence, the signature verification judgment statement corresponding to the current binary flag bit is searched in order from high bit to low bit; if the value of the current binary flag bit is the first preset value, it is necessary to verify the signature object of the signature verification judgment statement corresponding to the current binary flag bit; if the value of the current binary flag bit is the second preset value, it is not necessary to verify the signature object of the signature verification judgment statement corresponding to the binary flag bit, and obtain the signature verification judgment result corresponding to the current bit; the signature verification judgment results corresponding to each bit in the binary digital sequence are combined to obtain the signature verification rule.

[0081] Optionally, the second preset value may be 16; the first preset value may be 1, and the second preset value may be 0.

[0082] As shown in FIG3 , the signature verification code includes 13 signature verification judgment statements, including: whether to verify the path path, whether to verify the URL (Uniform Resource Locator, url) parameter, whether to verify the secret key (sk), whether to verify the request body, whether to verify the timestamp, whether to verify the random number, whether to verify the grayscale flag, whether to verify the request body form parameter, whether to verify the user identifier userid, whether to verify the device identifier deviceid, whether to verify the user agent user-agent, whether to verify the network identifier fingerprint and whether to verify the request body; when verifying the request body, the maximum verification node length is 1024.

[0083] Among them, when the flag corresponding to a signature verification statement is 1, the signature is verified, and when it is 0, the signature is not verified.

[0084] Exemplarily, as shown in FIG3 , the business identifiers of different business services may be different or the same. The business identifiers of the single sign-on service (SSO) and the security service (security) are the same, both of which are 56824. The business identifier of the message service that sends the message is different from them, which is 52488. Taking the business identifier of the message service that sends the message as an example, the decimal digital sequence 52488 of the message is converted into a 16-bit binary digital sequence 1101110100001000, and then based on the 13 signature verification judgment statements of the signature verification code, it is determined that the content that needs to be verified is: the signature verification path, the signature verification website parameter, the non-verification key, the signature verification request body, the signature verification timestamp, the signature verification random number, the non-verification grayscale flag, the signature verification request body form parameter, the non-verification user identifier, the non-verification device identifier, the non-verification user agent, the non-verification network identifier fingerprint and the signature verification request body; the byte length of the signature verification request body is 1024. Based on the above verification content, the business service request for accessing the message is verified.

[0085] In this embodiment, different signature verification codes can be set for different services to verify different information; for clients accessing the same service, the signature verification codes are the same. In this case, different service identifiers can be set for different clients. In this way, different signature verification rules can be flexibly set according to the needs of different services and the security permissions of different clients.

[0086] In an exemplary embodiment, the method further comprises:

[0087] Receive a permission update request from an operation and maintenance client; based on the update request, update the service identification, signature verification code and token of the corresponding client.

[0088] Among them, the operation and maintenance client is used to specifically manage the permissions of the operation and maintenance client and ordinary clients.

[0089] Optionally, the permission update request includes adding permissions, deleting permissions, etc.

[0090] Exemplarily, as shown in FIG4 , the permission update request of the operation and maintenance personnel is obtained through the operation and maintenance operation interface API, and the permissions and authentication levels of other users are updated according to the permission update request, and the token (JSON Web Token, JWT) is adaptively updated, including: deleting expired tokens and generating new tokens. Initialization, updating the user permission list, and starting to process the permission request of the operation and maintenance user. Query the permission list of the operation and maintenance user according to the permission request and the identification UID of the operation and maintenance user, and return the user permission list corresponding to the UID.

[0091] In this embodiment, the permissions of various users are managed by a dedicated operation and maintenance user, and the permissions of different users can be updated and modified in a timely manner to ensure the security of the system.

[0092] In an exemplary embodiment, before receiving the service request from the client, the method further includes:

[0093] Receive a permission request from a client; the permission request includes a token; based on the token, determine the business identifier and signature verification statement of the business service that the client can access; based on the business identifier, set the value of the flag bit of the binary digital sequence of a second preset number of digits corresponding to the signature verification statement to a first preset value, and set the remaining flag bits of the binary digital sequence of the second preset number of digits to a second preset value; obtain a binary digital sequence of a second preset number of digits for signature verification; convert the binary digital sequence of the second preset number of digits for signature verification into a decimal digital sequence to obtain a signature verification code; send the business identifier and the signature verification code to the client.

[0094] After the signature verification code is sent to the client, the client determines the content that needs to be verified according to the signature verification code, provides data according to the signature verification content, and arranges the data in the order of the signature verification code.

[0095] Exemplarily, receiving a permission request from a client; the permission request includes a token; based on the token, determining the business service that the client can access, and based on the business service, determining the business identifier and the signature verification statement; based on the business identifier, setting the value of the flag bit of the 16-bit binary digital sequence corresponding to the signature verification statement to 1, and setting the remaining flag bits of the 16-bit binary digital sequence to 0; obtaining a 16-bit binary digital sequence for signature verification; converting the 16-bit binary digital sequence for signature verification into a decimal digital sequence to obtain a signature verification code; sending the business identifier and the signature verification code to the client.

[0096] In this embodiment, the signature verification code is sent to the client to inform the client of the content that needs to be verified, so as to instruct the client to arrange the corresponding data according to the signature verification content.

[0097] In an exemplary embodiment, before receiving the permission request from the client, the method further includes:

[0098] Receive a login request from a client; the login request includes an account number and a password; verify the account number and password; if the verification is successful, send a token and a key corresponding to the account number to the client.

[0099] For example, a login request from a client is received; the login request includes an account and a password; the account and password are verified; if the verification is successful, a token and a key corresponding to the account are sent to the client; if the verification is unsuccessful, a prompt indicating that the password is incorrect is returned. When the password is incorrect for more than three times, the current account and password will be locked.

[0100] Among them, when the account and password are locked, you need to contact the operation and maintenance personnel to unlock it.

[0101] In this embodiment, by verifying the account password and locking it according to the number of incorrect attempts, the security of the account can be effectively guaranteed to prevent the password from being cracked by others.

[0102] In an exemplary embodiment, the method further comprises:

[0103] If the verification fails, an error message is returned.

[0104] Exemplarily, if the verification fails, a prompt indicating insufficient permissions is returned.

[0105] In this embodiment, when the verification fails, the business service request will be rejected, which can effectively prevent people without corresponding authority from tampering with the information.

[0106] In an exemplary embodiment, as shown in FIG5 , a service signature verification method includes: a client sends a login request to an Envoy gateway, and the login request includes an account and a password. The Envoy gateway forwards the login request to the login service. The login service verifies the account and password; if the verification passes, the token and key corresponding to the account are sent to the Envoy gateway; the Envoy gateway sends the token and key to the client. If the verification fails, a prompt indicating that the password is incorrect is returned to the Envoy gateway; the Envoy gateway sends a prompt indicating that the password is incorrect to the client. When the password is incorrect for more than three times, the Envoy gateway will lock the current account and password. The client sends a permission request for user permission information to the Envoy gateway, and the permission request includes a token. The Envoy gateway forwards the permission request to the permission management service. The permission management service determines the business services that the client can access based on the token, and determines the business identifier and signature verification statement based on the business service. Based on the business identifier, the value of the flag bit of the 16-bit binary digital sequence corresponding to the signature verification statement is set to 1, and the remaining flag bits of the 16-bit binary digital sequence are set to 0; the 16-bit binary digital sequence for signature verification is obtained; the 16-bit binary digital sequence for signature verification is converted into a decimal digital sequence to obtain the signature verification code; the business identifier and signature verification code are sent to the client through the Envoy gateway. The client initiates a business service request to the Envoy gateway. The Envoy gateway obtains the key from the login service according to the token in the business service request and obtains the signature verification code from the permission management service. The signature of the business service request is verified based on the signature verification code. If the signature verification fails, a prompt of insufficient permissions is returned; if the signature verification succeeds, it is forwarded to the background service for processing. After the background service is processed, it is forwarded to the client through the Envoy gateway.

[0107] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0108] In an exemplary embodiment, as shown in FIG6 , a service signature verification system is provided, including: a gateway, a login service, a rights management service, and a background service;

[0109] The gateway receives a business service request from a client; the business service request includes a token and a target business identifier, the token is allocated by the login service during the client login process; the target business identifier is allocated by the authority management service during the client login process;

[0110] Based on the token and the target business identifier, the gateway obtains the signature verification code and a first preset number of signature verification judgment statements corresponding to the target business identifier from the authority management service; determines the signature verification rules based on the signature verification code and the signature verification judgment statements; verifies the business service request based on the signature verification rules; if the verification passes, processes the business service request and sends the processing result to the client.

[0111] The backend service processes the service request and sends the processing result to the client through the gateway.

[0112] In one embodiment, the Envoy gateway is also used to:

[0113] The signature verification code is converted into a binary digital sequence of a second preset number of bits; based on the binary digital sequence, the signature verification judgment statement corresponding to the current binary flag bit is searched in order from high bit to low bit; if the value of the current binary flag bit is the first preset value, it is necessary to verify the signature object of the signature verification judgment statement corresponding to the current binary flag bit; if the value of the current binary flag bit is the second preset value, it is not necessary to verify the signature object of the signature verification judgment statement corresponding to the binary flag bit, and obtain the signature verification judgment result corresponding to the current bit; the signature verification judgment results corresponding to each bit in the binary digital sequence are combined to obtain the signature verification rule.

[0114] In one embodiment, the rights management service is further used to:

[0115] Receive a permission update request from an operation and maintenance client; based on the update request, update the service identification, signature verification code and token of the corresponding client.

[0116] In one embodiment, the rights management service is further used to:

[0117] Receive a permission request from a client; the permission request includes a token; based on the token, determine the business identifier and signature verification statement of the business service that the client can access; based on the business identifier, set the value of the flag bit of the binary digital sequence of a second preset number of digits corresponding to the signature verification statement to a first preset value, and set the remaining flag bits of the binary digital sequence of the second preset number of digits to a second preset value; obtain a binary digital sequence of a second preset number of digits for signature verification; convert the binary digital sequence of the second preset number of digits for signature verification into a decimal digital sequence to obtain a signature verification code; send the business identifier and the signature verification code to the client.

[0118] In one embodiment, the login service is further used to:

[0119] Receive a login request from a client; the login request includes an account number and a password; verify the account number and password; if the verification is successful, send a token and a key corresponding to the account number to the client.

[0120] In one embodiment, the Envoy gateway is also used to:

[0121] If the verification fails, an error message is returned.

[0122] Each module in the above service signature verification device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0123] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG7. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store business service data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a service verification method is implemented.

[0124] Those skilled in the art will understand that the structure shown in FIG. 7 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0125] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0126] Receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by the service signature verification system during the client login process;

[0127] Based on the token and the target service identifier, obtaining a first preset number of signature verification judgment statements corresponding to the signature verification code and the target service identifier;

[0128] Determining a signature verification rule based on the signature verification code and the signature verification judgment statement;

[0129] Verifying the business service request based on the signature verification rule;

[0130] If the verification is successful, the business service request is processed and the processing result is sent to the client.

[0131] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0132] The signature verification code is converted into a binary digital sequence of a second preset number of bits; based on the binary digital sequence, the signature verification judgment statement corresponding to the current binary flag bit is searched in order from high bit to low bit; if the value of the current binary flag bit is the first preset value, it is necessary to verify the signature object of the signature verification judgment statement corresponding to the current binary flag bit; if the value of the current binary flag bit is the second preset value, it is not necessary to verify the signature object of the signature verification judgment statement corresponding to the binary flag bit, and obtain the signature verification judgment result corresponding to the current bit; the signature verification judgment results corresponding to each bit in the binary digital sequence are combined to obtain the signature verification rule.

[0133] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0134] Receive a permission update request from an operation and maintenance client; based on the update request, update the service identification, signature verification code and token of the corresponding client.

[0135] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0136] Receive a permission request from a client; the permission request includes a token; based on the token, determine the business identifier and signature verification statement of the business service that the client can access; based on the business identifier, set the value of the flag bit of the binary digital sequence of a second preset number of digits corresponding to the signature verification statement to a first preset value, and set the remaining flag bits of the binary digital sequence of the second preset number of digits to a second preset value; obtain a binary digital sequence of a second preset number of digits for signature verification; convert the binary digital sequence of the second preset number of digits for signature verification into a decimal digital sequence to obtain a signature verification code; send the business identifier and the signature verification code to the client.

[0137] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0138] Receive a login request from a client; the login request includes an account number and a password; verify the account number and password; if the verification is successful, send a token and a key corresponding to the account number to the client.

[0139] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0140] If the verification fails, an error message is returned.

[0141] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0142] Receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by the service signature verification system during the client login process;

[0143] Based on the token and the target service identifier, obtaining a first preset number of signature verification judgment statements corresponding to the signature verification code and the target service identifier;

[0144] Determining a signature verification rule based on the signature verification code and the signature verification judgment statement;

[0145] Verifying the business service request based on the signature verification rule;

[0146] If the verification is successful, the business service request is processed and the processing result is sent to the client.

[0147] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0148] The signature verification code is converted into a binary digital sequence of a second preset number of bits; based on the binary digital sequence, the signature verification judgment statement corresponding to the current binary flag bit is searched in order from high bit to low bit; if the value of the current binary flag bit is the first preset value, it is necessary to verify the signature object of the signature verification judgment statement corresponding to the current binary flag bit; if the value of the current binary flag bit is the second preset value, it is not necessary to verify the signature object of the signature verification judgment statement corresponding to the binary flag bit, and obtain the signature verification judgment result corresponding to the current bit; the signature verification judgment results corresponding to each bit in the binary digital sequence are combined to obtain the signature verification rule.

[0149] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0150] Receive a permission update request from an operation and maintenance client; based on the update request, update the service identification, signature verification code and token of the corresponding client.

[0151] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0152] Receive a permission request from a client; the permission request includes a token; based on the token, determine the business identifier and signature verification statement of the business service that the client can access; based on the business identifier, set the value of the flag bit of the binary digital sequence of a second preset number of digits corresponding to the signature verification statement to a first preset value, and set the remaining flag bits of the binary digital sequence of the second preset number of digits to a second preset value; obtain a binary digital sequence of a second preset number of digits for signature verification; convert the binary digital sequence of the second preset number of digits for signature verification into a decimal digital sequence to obtain a signature verification code; send the business identifier and the signature verification code to the client.

[0153] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0154] Receive a login request from a client; the login request includes an account number and a password; verify the account number and password; if the verification is successful, send a token and a key corresponding to the account number to the client.

[0155] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0156] If the verification fails, an error message is returned.

[0157] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0158] Receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by the service signature verification system during the client login process;

[0159] Based on the token and the target service identifier, obtaining a first preset number of signature verification judgment statements corresponding to the signature verification code and the target service identifier;

[0160] Determining a signature verification rule based on the signature verification code and the signature verification judgment statement;

[0161] Verifying the business service request based on the signature verification rule;

[0162] If the verification is successful, the business service request is processed and the processing result is sent to the client.

[0163] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0164] The signature verification code is converted into a binary digital sequence of a second preset number of bits; based on the binary digital sequence, the signature verification judgment statement corresponding to the current binary flag bit is searched in order from high bit to low bit; if the value of the current binary flag bit is the first preset value, it is necessary to verify the signature object of the signature verification judgment statement corresponding to the current binary flag bit; if the value of the current binary flag bit is the second preset value, it is not necessary to verify the signature object of the signature verification judgment statement corresponding to the binary flag bit, and obtain the signature verification judgment result corresponding to the current bit; the signature verification judgment results corresponding to each bit in the binary digital sequence are combined to obtain the signature verification rule.

[0165] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0166] Receive a permission update request from an operation and maintenance client; based on the update request, update the service identification, signature verification code and token of the corresponding client.

[0167] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0168] Receive a permission request from a client; the permission request includes a token; based on the token, determine the business identifier and signature verification statement of the business service that the client can access; based on the business identifier, set the value of the flag bit of the binary digital sequence of a second preset number of digits corresponding to the signature verification statement to a first preset value, and set the remaining flag bits of the binary digital sequence of the second preset number of digits to a second preset value; obtain a binary digital sequence of a second preset number of digits for signature verification; convert the binary digital sequence of the second preset number of digits for signature verification into a decimal digital sequence to obtain a signature verification code; send the business identifier and the signature verification code to the client.

[0169] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0170] Receive a login request from a client; the login request includes an account number and a password; verify the account number and password; if the verification is successful, send a token and a key corresponding to the account number to the client.

[0171] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0172] If the verification fails, an error message is returned.

[0173] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0174] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0175] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A service signature verification method, characterized in that: The method comprises: Receive a business service request from a client; the business service request includes a token and a target business identifier, and the token and the target business identifier are allocated by the service signature verification system during the client login process; Based on the token and the target service identifier, obtaining a first preset number of signature verification judgment statements corresponding to the signature verification code and the target service identifier; Determining a signature verification rule based on the signature verification code and the signature verification judgment statement; Verifying the business service request based on the signature verification rule; If the verification is successful, the business service request is processed and the processing result is sent to the client.

2. The method according to claim 1, characterized in that The determining of the signature verification rule based on the signature verification code and the signature verification judgment statement includes: Converting the signature verification code into a binary digital sequence of a second preset number of digits; Based on the binary digital sequence, the signature verification judgment statement corresponding to the current binary flag is searched in order from high to low. If the value of the current binary flag is a first preset value, it is necessary to verify the signature of the verification object of the signature verification judgment statement corresponding to the current binary flag. If the value of the current binary flag is a second preset value, it is not necessary to verify the signature of the verification object of the signature verification judgment statement corresponding to the binary flag, and obtain the signature verification judgment result corresponding to the current bit; The signature verification judgment results corresponding to each bit in the binary digital sequence are combined to obtain the signature verification rule.

3. The method according to claim 1, characterized in that The method further comprises: Receive permission update requests from the operation and maintenance client; Based on the update request, the service identification, signature verification code and token of the corresponding client are updated.

4. The method according to claim 1, characterized in that: Before receiving the service request from the client, the method further includes: Receiving a permission request from a client; the permission request includes a token; Based on the token, determine the service identifier and signature verification statement of the service service that the client can access; Based on the service identifier, the value of the flag bit of the binary digital sequence of the second preset number of digits corresponding to the signature verification statement is set to the first preset value, and the remaining flag bits of the binary digital sequence of the second preset number of digits are set to the second preset values; and the binary digital sequence of the second preset number of digits for signature verification is obtained; Convert the binary digital sequence of the second preset number of digits used for signature verification into a decimal digital sequence to obtain a signature verification code; The service identifier and the signature verification code are sent to the client.

5. The method according to claim 4, characterized in that Before receiving the permission request from the client, the method further includes: Receive a login request from a client; the login request includes an account number and a password; Verify the account number and password; If the verification is successful, the token and key corresponding to the account are sent to the client.

6. The method according to claim 1, characterized in that The method further comprises: If the verification fails, an error message is returned.

7. A service signature verification system, characterized in that: include: Gateway, login service, permission management service, background service; The gateway receives a business service request from a client; The business service request includes a token and a target business identifier, wherein the token is allocated by the login service during the client login process; the target business identifier is allocated by the authority management service during the client login process; The gateway obtains, from the authority management service, a signature verification code and a first preset number of signature verification judgment statements corresponding to the target business identifier based on the token and the target business identifier; determines a signature verification rule based on the signature verification code and the signature verification judgment statement; and verifies the business service request based on the signature verification rule; If the verification is successful, the business service request is processed and the processing result is sent to the client; The backend service processes the service request and sends the processing result to the client through the gateway.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images