Security authentication method and device for continuous service and computer readable storage medium

Abstract

The invention provides a security authentication method and device for a continuous service and a computer readable storage medium. The method comprises the following steps: receiving ith request information sent by a service processing module; under the condition that the i-th service is not the first service of the continuous service, obtaining the i-th instance and the i-th identifier; whether service completion information is received or not is determined, a determination result is obtained, and the service completion information represents that the (i-1) th service is executed; according to a determination result, the ith instance, the ith identifier and a pre-stored association relationship, determining whether the ith service meets a security authentication requirement, the association relationship being obtained by associating identification information with the first instance, and the identification information being generated under the condition that the first request information is received and being sent to a service processing module; and under the condition that all services in the continuity service meet the security authentication requirement, determining that the continuity service passes the security authentication.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a security authentication method and apparatus for continuity services, a computer-readable storage medium, and a security authentication device for continuity services. Background Art

[0002] The specific features of the hash-based continuity service are as follows:

[0003] Feature 1: The service is independent and stateless, that is, service independence.

[0004] Feature 2: All services corresponding to the hashing behavior must be completed, that is, service functionality.

[0005] Feature 3: There is a temporal relationship between services in the hash behavior continuity service, that is, service security.

[0006] The existing security authentication scheme for continuity services cannot simultaneously meet the above three characteristics of continuity services, resulting in security authentication risks for continuity services. Summary of the invention

[0007] The main purpose of the present application is to provide a security authentication method, apparatus, computer-readable storage medium and security authentication device for a continuity service, so as to at least solve the problem that the security authentication scheme for continuity services in the prior art cannot simultaneously meet the three characteristics of the continuity service, resulting in security authentication risks for the continuity service.

[0008] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for secure authentication of a continuous service is provided, comprising: receiving an i-th request information sent by a service processing module, the i-th request information representing a request for security authentication of an i-th service, the continuous service comprising a plurality of services having a timing dependency, the i-th service being the i-th service executed in the continuous service, i≥1 and i being an integer; in the case where the i-th service is not the first service of the continuous service, obtaining an i-th instance and an i-th identifier, the i-th instance being instance information carried by the i-th service, the i-th identifier being identifier information carried by the i-th service, and receiving the i-th instance from the service processing module; In the case of the identification information, the identification information is configured for multiple services in the continuous service; it is determined whether service completion information is received to obtain a determination result, and the service completion information indicates that the i-1th service has been executed; according to the determination result, the i-th instance, the i-th identification and a pre-stored association relationship, it is determined whether the i-th service meets the security authentication requirements, the association relationship is obtained by associating the identification information with the first instance, and the identification information is generated and sent to the service processing module when the first request information is received; when all the services in the continuous service meet the security authentication requirements, it is determined that the continuous service has passed the security authentication.

[0009] Optionally, determining whether the i-th service meets the security authentication requirements based on the determination result, the i-th instance, the i-th identifier and the pre-stored association relationship includes: determining whether the instance information associated with the i-th identifier exists in the association relationship based on the i-th identifier and the association relationship; determining that the instance information associated with the i-th identifier exists in the association relationship, and determining that the first instance is the instance information associated with the i-th identifier, at least when the i-th identifier is the same as the identifier information in the association relationship; determining that the i-th service meets the security authentication requirements when the i-th instance is the same as the first instance and the determination result indicates that the service completion information has been received.

[0010] Optionally, the association relationship is set with a validity period, and the i-th identifier has timestamp information. At least when the i-th identifier is the same as the identifier information in the association relationship, determining that the instance information associated with the i-th identifier exists in the association relationship includes: when the i-th identifier is the same as the identifier information in the association relationship and the timestamp information is within the validity period, determining that the instance information associated with the i-th identifier exists in the association relationship. The method also includes: when the i-th identifier is different from the identifier information in the association relationship, or when the timestamp information is not within the validity period, determining that the instance information associated with the i-th identifier does not exist in the association relationship.

[0011] Optionally, after receiving the i-th request information sent by the service processing module, when the i-th service is not the first service of the continuity service, and before obtaining the i-th instance and the i-th identifier, the method further includes: determining whether the i-th service is the first service based on the i-th request information; when the i-th service is the first service, randomly generating key information of the continuity service, obtaining the identifier information, and sending the identifier information to the service processing module, so that the service processing module configures the identifier information for each of the services in the continuity service; obtaining the first instance of the first service, obtaining value information, determining that the key-value pair including the key information and the value information is the association relationship, and setting a validity period for the association relationship; storing the association relationship set with the validity period in the storage module, and determining that the first service meets the security authentication requirements.

[0012] Optionally, the method also includes: determining that the i-th service does not meet the security authentication requirements when one of the following is met: the instance information associated with the i-th identifier does not exist in the association relationship; the i-th instance is different from the first instance; the determination result indicates that the service completion information has not been received.

[0013] Optionally, after determining whether the i-th service meets the security authentication requirements based on the i-th instance, the i-th identifier and the association relationship, the method further includes: determining whether the i-th service is the last service of the continuity service based on the i-th request information; and if it is determined that the i-th service is the last service, deleting the pre-stored association relationship.

[0014] Optionally, the instance information includes at least part of the following: user identity, device information of the user requesting the service, and location information of the user requesting the service.

[0015] According to another aspect of the present application, a security authentication device for a continuous service is provided, comprising: a receiving unit, configured to receive an i-th request message sent by a service processing module, wherein the i-th request message represents a request for security authentication of the i-th service, wherein the continuous service comprises a plurality of services having a timing dependency relationship, wherein the i-th service is the i-th executed service in the continuous service, i≥1 and i is an integer; a first acquisition unit, configured to acquire an i-th instance and an i-th identifier when the i-th service is not the first service of the continuous service, wherein the i-th instance is instance information carried by the i-th service, and the i-th identifier is identifier information carried by the i-th service, and when the service processing module receives the identifier information, The identification information is configured for multiple services in the continuous service; a first determination unit is used to determine whether service completion information is received and obtain a determination result, wherein the service completion information indicates that the i-1th service has been executed; a second determination unit is used to determine whether the i-th service meets the security authentication requirements based on the determination result, the i-th instance, the i-th identification and a pre-stored association relationship, wherein the association relationship is obtained by associating the identification information with the first instance, and the identification information is generated and sent to the service processing module when the first request information is received; a third determination unit is used to determine that the continuous service passes the security authentication when all the services in the continuous service meet the security authentication requirements.

[0016] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the methods described.

[0017] According to another aspect of the present application, a security authentication device for a continuous service is provided, comprising: a security authentication module, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include methods for executing any one of the methods described; a service processing module, communicating with the security authentication module, for receiving request information, sending the request information to the security authentication module, and receiving a security authentication result fed back by the security authentication module; a storage module, communicating with the security authentication module, for storing an association relationship.

[0018] Applying the technical solution of the present application, for the security authentication of the continuity service, the present application fully considers the temporal dependency of multiple services in the continuity service. When it is determined that the previous service of the ith service has been executed, the ith service is securely authenticated according to the instance information and identification information carried by the ith service, thereby ensuring the service security of the continuity service during the security authentication process; and, when the present application completes the execution of one service, it then performs the security authentication of the next service in sequence. During the security authentication process, all services of the continuity service can be executed, thereby ensuring the functional integrity of the entire service chain and satisfying the service functionality; in addition, the security authentication process of the present application is separated from the service execution process, and the security authentication process will not affect the normal execution of each service, thereby ensuring the service independence of each service. Therefore, the security authentication process of the present application can simultaneously meet the three characteristics of the continuity service, avoiding the problem of potential security authentication risks of the continuity service when any characteristic is not met, thereby ensuring the high reliability of the security authentication of the continuity service. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings constituting part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 A hardware structure block diagram of a mobile terminal for executing a security authentication method for a continuity service provided in an embodiment of the present application is shown;

[0021] Figure 2 A schematic diagram of a flow chart of a security authentication method for a continuity service provided according to an embodiment of the present application is shown;

[0022] Figure 3 A structural block diagram of a security authentication device for a continuity service provided according to an embodiment of the present application is shown;

[0023] Figure 4 A schematic diagram of the structure of a security authentication device for a continuity service provided according to an embodiment of the present application is shown;

[0024] Figure 5 A schematic diagram of a security authentication process of a security authentication device for a continuity service provided according to an embodiment of the present application is shown.

[0025] The above drawings include the following reference numerals:

[0026] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0027] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the accompanying drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] As introduced in the background technology, the security authentication scheme of the continuity service in the prior art cannot simultaneously meet the three characteristics of the continuity service, resulting in security authentication risks of the continuity service. In order to solve the above technical problems, the embodiments of the present application provide a security authentication method, apparatus, computer-readable storage medium and security authentication device for a continuity service.

[0031] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0032] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a security authentication method for a continuous service according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is for illustration only and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0033] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the security authentication method for continuous service in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the method described is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof. The transmission device 106 is used to receive or send data via a network. The specific example of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0034] In this embodiment, a security authentication method for a continuous service running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] Figure 2 is a flow chart of a security authentication method for a continuity service according to an embodiment of the present application. The method can be applied to a security authentication module, such as Figure 2As shown, the method comprises the following steps:

[0036] Step S201, receiving the i-th request information sent by the service processing module, wherein the i-th request information represents a request for security authentication of the i-th service, the continuous service includes a plurality of services having a timing dependency relationship, the i-th service is the i-th executed service in the continuous service, i≥1 and i is an integer;

[0037] Specifically, the timing dependency refers to a certain timing relationship between services in the continuous service, and multiple services need to be executed in a correct order. The service processing module is used to receive the request information and receive a security authentication result corresponding to the request information.

[0038] Step S202, when the i-th service is not the first service of the continuity service, obtain the i-th instance and the i-th identifier, the i-th instance is the instance information carried by the i-th service, the i-th identifier is the identifier information carried by the i-th service, and when the service processing module receives the identifier information, configure the identifier information for multiple services in the continuity service;

[0039] Specifically, the case where the i-th service is not the first service of the continuous service is the case where i>1, and the first service is the first service executed in the continuous service, also called the first service of the continuous service. The instance information includes user information requesting to execute the corresponding service, including but not limited to user ID and user IP information. The identification information is a unique identifier of the continuous service. When the service processing module receives the identification information, it sets each service to carry the identification information. That is to say, the identification information of each service in the continuous service is consistent. The i-th instance and the i-th identification are obtained by parsing the i-th service.

[0040] Step S203, determining whether service completion information is received, and obtaining a determination result, wherein the service completion information indicates that the i-1th service has been executed and completed;

[0041] Specifically, the i-1th service is the i-1th executed service, and is a service that needs to be executed before the i-th service is executed. The service completion information may be sent by the service processing module to the security authentication module.

[0042] Step S204, determining whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier and a pre-stored association relationship, wherein the association relationship is obtained by associating the identifier information with the first instance, and the identifier information is generated and sent to the service processing module when the first request information is received;

[0043] Specifically, the first instance is instance information of the first service, and the first request information represents a request for security authentication of the first service. Upon receiving the first request information, the security authentication module generates the identification information and sends the identification information to the service processing module, so that the service processing module configures the identification information for each service in the continuity service.

[0044] Step S205: When all the services in the continuity service meet the security authentication requirement, determine that the continuity service passes the security authentication.

[0045] Through the described embodiment, first, the i-th request information sent by the service processing module is received; then, when the i-th service is not the first service in the continuity service, the instance information of the i-th service and the identification information of the i-th service are obtained; then, it is determined whether the service completion information is received to obtain a determination result; then, based on the determination result, the instance information of the i-th service, the identification information of the i-th service and the pre-stored association relationship, it is determined whether the i-th service in the continuity service meets the security authentication requirements; finally, when all services in the continuity service meet the security authentication requirements, it is determined that the continuity service has passed the security authentication. Regarding the security authentication of continuous services, this application fully considers the temporal dependencies of multiple services in the continuous service. When it is determined that the previous service of the ith service has been executed, the ith service is securely authenticated according to the instance information and identification information carried by the ith service, thereby ensuring the service security of the continuous service during the security authentication process. Moreover, after completing the execution of one service, this application will sequentially perform the security authentication of the next service. During the security authentication process, all services of the continuous service can be executed, thereby ensuring the functional integrity of the entire service chain and satisfying the service functionality. In addition, the security authentication process of this application is separated from the service execution process, and the security authentication process will not affect the normal execution of each service, thereby ensuring the service independence of each service. Therefore, the security authentication process of this application can simultaneously meet the three characteristics of the continuous service, avoiding the problem of potential security authentication risks of the continuous service when any characteristic is not met, thereby ensuring the high reliability of the security authentication of the continuous service.

[0046] Specifically, after determining that the continuity service has passed the security authentication, the method also includes: generating a security authentication result characterizing that the continuity service has passed the security authentication, and sending the security authentication result characterizing that the continuity service has passed the security authentication to the service processing module, so that the service processing module can feed back the security authentication result to the service front-end.

[0047] The security authentication module is mainly implemented through an application program, such as a spring boot application, to implement the core logic of the security authentication process. The service processing module is used to receive service request information and respond to the security authentication result of the service, and is mainly implemented through an application server, such as a tomcat application server, to accept and respond to service authentication requests.

[0048] In an optional solution, step S204: determining whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier and the pre-stored association relationship includes:

[0049] Step S2041: determining, according to the i-th identifier and the association relationship, whether the instance information associated with the i-th identifier exists in the association relationship;

[0050] Step S2042: at least when the i-th identifier is the same as the identifier information in the association relationship, determining that the instance information associated with the i-th identifier exists in the association relationship, and determining that the first instance is the instance information associated with the i-th identifier;

[0051] Specifically, at least when the i-th identifier is the same as the identifier information in the association relationship, the first instance in the association relationship is determined to be the instance information associated with the i-th identifier.

[0052] Step S2043: When the i-th instance is the same as the first instance and the determination result indicates that the service completion information is received, determine that the i-th service meets the security authentication requirement.

[0053] In the embodiment, the instance information of the ith service is verified based on the identification information of the ith service to determine whether the instance information of the ith service is the same as the first instance in the association relationship, so as to determine whether the instance information of the continuity service has changed, thereby determining whether the security check of the ith service has passed. When the security check passes and it is determined that the execution of the i-1th service has been completed, it is determined that the ith service meets the security authentication requirements, thereby further ensuring that the security authentication process can meet the service security requirements of the continuity service.

[0054] More specifically, the instance information includes at least part of the following: user identity, device information of the user requesting the service, and location information of the user requesting the service. By comparing whether the user identity, device information of the user requesting the service, and location information of the first service and the ith service are consistent, it is determined whether the service has security risks, thereby avoiding the execution of services with security risks, thereby further avoiding security authentication risks of continuous services.

[0055] In order to further ensure the accuracy and reliability of the service security hot certificate, further, the association relationship is set with an effective period, the i-th identifier has timestamp information, at least when the i-th identifier is the same as the identifier information in the association relationship, determining that the instance information associated with the i-th identifier exists in the association relationship includes: when the i-th identifier is the same as the identifier information in the association relationship and the timestamp information is within the effective period, determining that the instance information associated with the i-th identifier exists in the association relationship, and the method further includes: when the i-th identifier is different from the identifier information in the association relationship, or when the timestamp information is not within the effective period, determining that the instance information associated with the i-th identifier does not exist in the association relationship. In this embodiment, setting an effective period for the association relationship can ensure the timeliness and accuracy of the association relationship, and further ensure the security and reliability of the security authentication; at the same time, the time range of the association relationship storage can be controlled so that the association relationship is valid within a specific time period and is automatically deleted after expiration, thereby saving resources and space.

[0056] In addition, the method also includes: when the i-th identifier is different from the identifier information in the association relationship, or the timestamp information is not within the validity period, determining that the instance information associated with the i-th identifier does not exist in the association relationship.

[0057] Optionally, after receiving the i-th request information sent by the service processing module, when the i-th service is not the first service of the continuity service, before obtaining the i-th instance and the i-th identifier, the method further includes the following steps:

[0058] Step S206: determining whether the i-th service is the first service according to the i-th request information;

[0059] Specifically, the service request information includes information indicating the execution order of the services in the continuous service, and the execution order of the services in the continuous service can be determined according to the information. The first service is the first service in the continuous service.

[0060] Step S207: when the i-th service is the first service, randomly generate key information of the continuity service, obtain the identification information, and send the identification information to the service processing module, so that the service processing module configures the identification information for each service in the continuity service;

[0061] Specifically, after being configured by the service processing module, each service in the continuous service carries the identification information.

[0062] Step S208: acquiring the first instance of the first service, obtaining value information, determining a key-value pair including the key information and the value information as the association relationship, and setting a validity period for the association relationship;

[0063] Specifically, the validity period can be flexibly set according to actual needs, such as 1 hour, 1 day, etc. The instance information of the first service is used as the value information to obtain a key-value pair consisting of the identification information and the first instance. Key-value is a data storage structure consisting of a unique key and a corresponding value. In this structure, the key is used to uniquely identify the data item, and the value stores the data associated with the key.

[0064] Step S209: storing the association relationship with the validity period in a storage module, and determining whether the first service meets the security authentication requirement.

[0065] Specifically, the storage module is used to store and record the security authentication process and persistent data, which is mainly implemented through a cache database service, such as a redis database, to achieve high-speed access to security authentication data.

[0066] In the described embodiment, after receiving the i-th request information, it is first determined whether the service corresponding to the i-th request is the first service. If it is determined to be the first service, key information is randomly generated as the unique identification information of the continuity service, and the first instance is used as the value information corresponding to the key information. By constructing a key-value pair, the value information can be quickly searched and accessed based on the key information later without the need for linear retrieval, thereby improving the efficiency of security authentication.

[0067] It should be noted that, in addition to using a key-value pair data structure to represent the association relationship, those skilled in the art may also use other data to represent the association relationship, such as an array, a linked list, and the like.

[0068] In other embodiments of the present application, the method also includes: determining that the i-th service does not meet the security authentication requirements when one of the following is met: the instance information associated with the i-th identifier does not exist in the association relationship; the i-th instance is different from the first instance; the determination result indicates that the service completion information has not been received.

[0069] According to some further exemplary embodiments of the present application, after determining whether the i-th service meets the security authentication requirements according to the i-th instance, the i-th identifier and the association relationship, the method further includes: determining whether the i-th service is the last service of the continuity service according to the i-th request information; and deleting the pre-stored association relationship when it is determined that the i-th service is the last service. After determining whether the last service of the continuity service meets the security authentication requirements, deleting the association relationship can release the storage space of the storage module and reduce the storage burden.

[0070] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0071] The embodiment of the present application also provides a security authentication device for continuous services. It should be noted that the security authentication device for continuous services of the embodiment of the present application can be used to execute the security authentication method for continuous services provided by the embodiment of the present application. The device is used to implement the embodiments and preferred implementations, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0072] The following is an introduction to the security authentication device for the continuity service provided in the embodiment of the present application.

[0073] Figure 3 Schematic diagram of a security authentication device for a continuous service according to an embodiment of the present application. The device can be applied to a security authentication module, such as Figure 3 As shown, the device comprises:

[0074] The receiving unit 10 is used to receive the i-th request information sent by the service processing module, wherein the i-th request information represents a request for security authentication of the i-th service, the continuous service includes a plurality of services having a timing dependency relationship, the i-th service is the i-th executed service in the continuous service, i≥1 and i is an integer;

[0075] Specifically, the timing dependency refers to a certain timing relationship between services in the continuous service, and multiple services need to be executed in a correct order. The service processing module is used to receive the request information and receive a security authentication result corresponding to the request information.

[0076] The first acquisition unit 20 is used to acquire an i-th instance and an i-th identifier when the i-th service is not the first service of the continuity service, wherein the i-th instance is instance information carried by the i-th service, and the i-th identifier is identifier information carried by the i-th service, and when the service processing module receives the identifier information, configure the identifier information for multiple services in the continuity service;

[0077] Specifically, the case where the i-th service is not the first service of the continuous service is the case where i>1, and the first service is the first service executed in the continuous service, also called the first service of the continuous service. The instance information includes user information requesting to execute the corresponding service, including but not limited to user ID and user IP information. The identification information is a unique identifier of the continuous service. When the service processing module receives the identification information, it sets each service to carry the identification information. That is to say, the identification information of each service in the continuous service is consistent. The i-th instance and the i-th identification are obtained by parsing the i-th service.

[0078] A first determining unit 30 is used to determine whether service completion information is received and obtain a determination result, wherein the service completion information indicates that the i-1th service has been executed and completed;

[0079] Specifically, the i-1th service is the i-1th executed service, and is a service that needs to be executed before the i-th service is executed. The service completion information may be sent by the service processing module to the security authentication module.

[0080] A second determination unit 40, configured to determine whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier and a pre-stored association relationship, wherein the association relationship is obtained by associating the identifier information with the first instance, and the identifier information is generated and sent to the service processing module when the first request information is received;

[0081] Specifically, the first instance is instance information of the first service, and the first request information represents a request for security authentication of the first service. Upon receiving the first request information, the security authentication module generates the identification information and sends the identification information to the service processing module, so that the service processing module configures the identification information for each service in the continuity service.

[0082] The third determining unit 50 is configured to determine that the continuity service passes the security authentication if all the services in the continuity service meet the security authentication requirement.

[0083] Through the described embodiment, the i-th request information sent by the service processing module is received through the receiving unit; the instance information of the i-th service and the identification information of the i-th service are obtained through the first acquisition unit when the i-th service is not the first service in the continuity service; the first determination unit determines whether the service completion information is received to obtain a determination result; the second determination unit determines whether the i-th service in the continuity service meets the security authentication requirements based on the determination result, the instance information of the i-th service, the identification information of the i-th service and the pre-stored association relationship; and the third determination unit determines that the continuity service passes the security authentication when all services in the continuity service meet the security authentication requirements. Regarding the security authentication of continuous services, this application fully considers the temporal dependencies of multiple services in the continuous service. When it is determined that the previous service of the ith service has been executed, the ith service is securely authenticated according to the instance information and identification information carried by the ith service, thereby ensuring the service security of the continuous service during the security authentication process. Moreover, after completing the execution of one service, this application will sequentially perform the security authentication of the next service. During the security authentication process, all services of the continuous service can be executed, thereby ensuring the functional integrity of the entire service chain and satisfying the service functionality. In addition, the security authentication process of this application is separated from the service execution process, and the security authentication process will not affect the normal execution of each service, thereby ensuring the service independence of each service. Therefore, the security authentication process of this application can simultaneously meet the three characteristics of the continuous service, avoiding the problem of potential security authentication risks of the continuous service when any characteristic is not met, thereby ensuring the high reliability of the security authentication of the continuous service.

[0084] Specifically, the device also includes: a first generating unit, which is used to generate a security authentication result representing that the continuity service has passed the security authentication after determining that the continuity service has passed the security authentication, and send the security authentication result representing that the continuity service has passed the security authentication to the service processing module, so that the service processing module can feed back the security authentication result to the service front-end.

[0085] The security authentication module is mainly implemented through an application program, such as a spring boot application, to implement the core logic of the security authentication process. The service processing module is used to receive service request information and respond to the security authentication result of the service, and is mainly implemented through an application server, such as a tomcat application server, to accept and respond to service authentication requests.

[0086] In an optional solution, the second determining unit includes:

[0087] A first determining subunit, configured to determine, based on the i-th identifier and the association relationship, whether the instance information associated with the i-th identifier exists in the association relationship;

[0088] a second determining subunit, configured to determine that the instance information associated with the i-th identifier exists in the association relationship, and to determine that the first instance is the instance information associated with the i-th identifier, at least when the i-th identifier is the same as the identifier information in the association relationship;

[0089] Specifically, at least when the i-th identifier is the same as the identifier information in the association relationship, the first instance in the association relationship is determined to be the instance information associated with the i-th identifier.

[0090] The third determining subunit is configured to determine that the i-th service meets the security authentication requirement when the i-th instance is the same as the first instance and the determination result indicates that the service completion information has been received.

[0091] In the embodiment, the instance information of the ith service is verified based on the identification information of the ith service to determine whether the instance information of the ith service is the same as the first instance in the association relationship, so as to determine whether the instance information of the continuity service has changed, thereby determining whether the security check of the ith service has passed. When the security check passes and it is determined that the execution of the i-1th service has been completed, it is determined that the ith service meets the security authentication requirements, thereby further ensuring that the security authentication process can meet the service security requirements of the continuity service.

[0092] More specifically, the instance information includes at least part of the following: user identity, device information of the user requesting the service, and location information of the user requesting the service. By comparing whether the user identity, device information of the user requesting the service, and location information of the first service and the ith service are consistent, it is determined whether the service has security risks, thereby avoiding the execution of services with security risks, thereby further avoiding security authentication risks of continuous services.

[0093] In order to further ensure the accuracy and reliability of the service security hot certificate, further, the association relationship is set with a validity period, the i-th identifier has timestamp information, and the second determination subunit includes: a determination submodule, which is used to determine that the instance information associated with the i-th identifier exists in the association relationship when the i-th identifier is the same as the identifier information in the association relationship and the timestamp information is within the validity period. The device also includes: a fourth determination unit, which is used to determine that the instance information associated with the i-th identifier does not exist in the association relationship when the i-th identifier is different from the identifier information in the association relationship, or when the timestamp information is not within the validity period. In this embodiment, setting a validity period for the association relationship can ensure the timeliness and accuracy of the association relationship, and further ensure the security and reliability of security authentication; at the same time, the time range of the association relationship storage can be controlled so that the association relationship is valid within a specific time period and is automatically deleted after expiration, thereby saving resources and space.

[0094] In addition, the device also includes: a fifth determination unit, which is used to determine that the instance information associated with the i-th identifier does not exist in the association relationship when the i-th identifier is different from the identifier information in the association relationship, or the timestamp information is not within the validity period.

[0095] Optionally, the device further comprises:

[0096] a second acquisition unit, configured to, after receiving the i-th request information sent by the service processing module, determine whether the i-th service is the first service according to the i-th request information before acquiring the i-th instance and the i-th identifier, if the i-th service is not the first service of the continuity service;

[0097] Specifically, the service request information includes information indicating the execution order of the services in the continuous service, and the execution order of the services in the continuous service can be determined according to the information. The first service is the first service in the continuous service.

[0098] a second generating unit, configured to, when the i-th service is the first service, randomly generate key information of the continuity service, obtain the identification information, and send the identification information to the service processing module, so that the service processing module configures the identification information for each of the services in the continuity service;

[0099] Specifically, after being configured by the service processing module, each service in the continuous service carries the identification information.

[0100] a sixth determining unit, configured to obtain the first instance of the first service, obtain value information, determine a key-value pair including the key information and the value information as the association relationship, and set a validity period for the association relationship;

[0101] Specifically, the validity period can be flexibly set according to actual needs, such as 1 hour, 1 day, etc. The instance information of the first service is used as the value information to obtain a key-value pair consisting of the identification information and the first instance. Key-value is a data storage structure consisting of a unique key and a corresponding value. In this structure, the key is used to uniquely identify the data item, and the value stores the data associated with the key.

[0102] The storage unit is used to store the association relationship with the validity period in a storage module, and determine whether the first service meets the security authentication requirement.

[0103] Specifically, the storage module is used to store and record the security authentication process and persistent data, which is mainly implemented through a cache database service, such as a redis database, to achieve high-speed access to security authentication data.

[0104] In the described embodiment, after receiving the i-th request information, it is first determined whether the service corresponding to the i-th request is the first service. If it is determined to be the first service, key information is randomly generated as the unique identification information of the continuity service, and the first instance is used as the value information corresponding to the key information. By constructing a key-value pair, the value information can be quickly searched and accessed based on the key information later without the need for linear retrieval, thereby improving the efficiency of security authentication.

[0105] It should be noted that, in addition to using a key-value pair data structure to represent the association relationship, those skilled in the art may also use other data to represent the association relationship, such as an array, a linked list, and the like.

[0106] In other embodiments of the present application, the device also includes: a seventh determination unit, used to determine that the i-th service does not meet the security authentication requirements when one of the following is met: the instance information associated with the i-th identifier does not exist in the association relationship; the i-th instance is different from the first instance; the determination result indicates that the service completion information has not been received.

[0107] According to some further exemplary embodiments of the present application, the device further includes: an eighth determination unit, which is used to determine whether the i-th service is the last service of the continuity service according to the i-th request information after determining whether the i-th service meets the security authentication requirements according to the i-th instance, the i-th identifier and the association relationship; and a deletion unit, which is used to delete the pre-stored association relationship when it is determined that the i-th service is the last service. After determining whether the last service of the continuity service meets the security authentication requirements, deleting the association relationship can release the storage space of the storage module and reduce the storage burden.

[0108] The security authentication device for continuous service includes a processor and a memory, the receiving unit, the first acquisition unit, the first determination unit, the second determination unit, and the third determination unit are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions. The modules are all located in the same processor; or the modules are located in different processors in any combination.

[0109] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and by adjusting the kernel parameters, at least the problem that the security authentication scheme of the continuity service in the prior art cannot simultaneously meet the three characteristics of the continuity service, resulting in the security authentication risks of the continuity service, is solved.

[0110] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0111] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, a device where the computer-readable storage medium is located is controlled to execute the security authentication method for the continuity service.

[0112] Specifically, the security authentication method for continuity service includes:

[0113] Step S201, receiving the i-th request information sent by the service processing module, wherein the i-th request information represents a request for security authentication of the i-th service, the continuous service includes a plurality of services having a timing dependency relationship, the i-th service is the i-th executed service in the continuous service, i≥1 and i is an integer;

[0114] Specifically, the timing dependency refers to a certain timing relationship between services in the continuous service, and multiple services need to be executed in a correct order. The service processing module is used to receive the request information and receive a security authentication result corresponding to the request information.

[0115] Step S202, when the i-th service is not the first service of the continuity service, obtain the i-th instance and the i-th identifier, the i-th instance is the instance information carried by the i-th service, the i-th identifier is the identifier information carried by the i-th service, and when the service processing module receives the identifier information, configure the identifier information for multiple services in the continuity service;

[0116] Specifically, the case where the i-th service is not the first service of the continuous service is the case where i>1, and the first service is the first service executed in the continuous service, also called the first service of the continuous service. The instance information includes user information requesting to execute the corresponding service, including but not limited to user ID and user IP information. The identification information is a unique identifier of the continuous service. When the service processing module receives the identification information, it sets each service to carry the identification information. That is to say, the identification information of each service in the continuous service is consistent. The i-th instance and the i-th identification are obtained by parsing the i-th service.

[0117] Step S203, determining whether service completion information is received, and obtaining a determination result, wherein the service completion information indicates that the i-1th service has been executed and completed;

[0118] Specifically, the i-1th service is the i-1th executed service, and is a service that needs to be executed before the i-th service is executed. The service completion information may be sent by the service processing module to the security authentication module.

[0119] Step S204, determining whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier and a pre-stored association relationship, wherein the association relationship is obtained by associating the identifier information with the first instance, and the identifier information is generated and sent to the service processing module when the first request information is received;

[0120] Specifically, the first instance is instance information of the first service, and the first request information represents a request for security authentication of the first service. Upon receiving the first request information, the security authentication module generates the identification information and sends the identification information to the service processing module, so that the service processing module configures the identification information for each service in the continuity service.

[0121] Step S205: When all the services in the continuity service meet the security authentication requirement, determine that the continuity service passes the security authentication.

[0122] Optionally, determining whether the i-th service meets the security authentication requirements based on the determination result, the i-th instance, the i-th identifier and the pre-stored association relationship includes: determining whether the instance information associated with the i-th identifier exists in the association relationship based on the i-th identifier and the association relationship; determining that the instance information associated with the i-th identifier exists in the association relationship, and determining that the first instance is the instance information associated with the i-th identifier, at least when the i-th identifier is the same as the identifier information in the association relationship; determining that the i-th service meets the security authentication requirements when the i-th instance is the same as the first instance and the determination result indicates that the service completion information has been received.

[0123] Optionally, the association relationship is set with a validity period, and the i-th identifier has timestamp information. At least when the i-th identifier is the same as the identifier information in the association relationship, determining that the instance information associated with the i-th identifier exists in the association relationship includes: when the i-th identifier is the same as the identifier information in the association relationship and the timestamp information is within the validity period, determining that the instance information associated with the i-th identifier exists in the association relationship. The method also includes: when the i-th identifier is different from the identifier information in the association relationship, or when the timestamp information is not within the validity period, determining that the instance information associated with the i-th identifier does not exist in the association relationship.

[0124] Optionally, after receiving the i-th request information sent by the service processing module, when the i-th service is not the first service of the continuity service, and before obtaining the i-th instance and the i-th identifier, the method further includes: determining whether the i-th service is the first service based on the i-th request information; when the i-th service is the first service, randomly generating key information of the continuity service, obtaining the identifier information, and sending the identifier information to the service processing module, so that the service processing module configures the identifier information for each of the services in the continuity service; obtaining the first instance of the first service, obtaining value information, determining that the key-value pair including the key information and the value information is the association relationship, and setting a validity period for the association relationship; storing the association relationship set with the validity period in the storage module, and determining that the first service meets the security authentication requirements.

[0125] Optionally, the method also includes: determining that the i-th service does not meet the security authentication requirements when one of the following is met: the instance information associated with the i-th identifier does not exist in the association relationship; the i-th instance is different from the first instance; the determination result indicates that the service completion information has not been received.

[0126] Optionally, after determining whether the i-th service meets the security authentication requirements based on the i-th instance, the i-th identifier and the association relationship, the method further includes: determining whether the i-th service is the last service of the continuity service based on the i-th request information; and if it is determined that the i-th service is the last service, deleting the pre-stored association relationship.

[0127] Optionally, the instance information includes at least part of the following: user identity, device information of the user requesting the service, and location information of the user requesting the service.

[0128] The embodiment of the present invention provides a Figure 4 The security authentication device of the continuity service shown, such as Figure 4 As shown, the security authentication device includes:

[0129] A security authentication module, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for executing any one of the methods described;

[0130] A service processing module, communicating with the security authentication module, is used to receive request information, send the request information to the security authentication module, and receive the security authentication result fed back by the security authentication module;

[0131] A storage module communicates with the security authentication module and is used to store the association relationship.

[0132] The security authentication device for the continuity service of the present application can not only meet the service function characteristics and service security characteristics of the continuity service based on hash behavior, but also ensure the independence and statelessness of the service.

[0133] Specifically, the security authentication method for continuity service includes:

[0134] Step S201, receiving the i-th request information sent by the service processing module, wherein the i-th request information represents a request for security authentication of the i-th service, the continuous service includes a plurality of services having a timing dependency relationship, the i-th service is the i-th executed service in the continuous service, i≥1 and i is an integer;

[0135] Specifically, the timing dependency refers to a certain timing relationship between services in the continuous service, and multiple services need to be executed in a correct order. The service processing module is used to receive the request information and receive a security authentication result corresponding to the request information.

[0136] Step S202, when the i-th service is not the first service of the continuity service, obtain the i-th instance and the i-th identifier, the i-th instance is the instance information carried by the i-th service, the i-th identifier is the identifier information carried by the i-th service, and when the service processing module receives the identifier information, configure the identifier information for multiple services in the continuity service;

[0137] Specifically, the case where the i-th service is not the first service of the continuous service is the case where i>1, and the first service is the first service executed in the continuous service, also called the first service of the continuous service. The instance information includes user information requesting to execute the corresponding service, including but not limited to user ID and user IP information. The identification information is a unique identifier of the continuous service. When the service processing module receives the identification information, it sets each service to carry the identification information. That is to say, the identification information of each service in the continuous service is consistent. The i-th instance and the i-th identification are obtained by parsing the i-th service.

[0138] Step S203, determining whether service completion information is received, and obtaining a determination result, wherein the service completion information indicates that the i-1th service has been executed and completed;

[0139] Specifically, the i-1th service is the i-1th executed service, and is a service that needs to be executed before the i-th service is executed. The service completion information may be sent by the service processing module to the security authentication module.

[0140] Step S204, determining whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier and a pre-stored association relationship, wherein the association relationship is obtained by associating the identifier information with the first instance, and the identifier information is generated and sent to the service processing module when the first request information is received;

[0141] Specifically, the first instance is instance information of the first service, and the first request information represents a request for security authentication of the first service. Upon receiving the first request information, the security authentication module generates the identification information and sends the identification information to the service processing module, so that the service processing module configures the identification information for each service in the continuity service.

[0142] Step S205: When all the services in the continuity service meet the security authentication requirement, determine that the continuity service passes the security authentication.

[0143] Optionally, determining whether the i-th service meets the security authentication requirements based on the determination result, the i-th instance, the i-th identifier and the pre-stored association relationship includes: determining whether the instance information associated with the i-th identifier exists in the association relationship based on the i-th identifier and the association relationship; determining that the instance information associated with the i-th identifier exists in the association relationship, and determining that the first instance is the instance information associated with the i-th identifier, at least when the i-th identifier is the same as the identifier information in the association relationship; determining that the i-th service meets the security authentication requirements when the i-th instance is the same as the first instance and the determination result indicates that the service completion information has been received.

[0144] Optionally, the association relationship is set with a validity period, and the i-th identifier has timestamp information. At least when the i-th identifier is the same as the identifier information in the association relationship, determining that the instance information associated with the i-th identifier exists in the association relationship includes: when the i-th identifier is the same as the identifier information in the association relationship and the timestamp information is within the validity period, determining that the instance information associated with the i-th identifier exists in the association relationship. The method also includes: when the i-th identifier is different from the identifier information in the association relationship, or when the timestamp information is not within the validity period, determining that the instance information associated with the i-th identifier does not exist in the association relationship.

[0145] Optionally, after receiving the i-th request information sent by the service processing module, when the i-th service is not the first service of the continuity service, and before obtaining the i-th instance and the i-th identifier, the method further includes: determining whether the i-th service is the first service based on the i-th request information; when the i-th service is the first service, randomly generating key information of the continuity service, obtaining the identifier information, and sending the identifier information to the service processing module, so that the service processing module configures the identifier information for each of the services in the continuity service; obtaining the first instance of the first service, obtaining value information, determining that the key-value pair including the key information and the value information is the association relationship, and setting a validity period for the association relationship; storing the association relationship set with the validity period in the storage module, and determining that the first service meets the security authentication requirements.

[0146] Optionally, the method also includes: determining that the i-th service does not meet the security authentication requirements when one of the following is met: the instance information associated with the i-th identifier does not exist in the association relationship; the i-th instance is different from the first instance; the determination result indicates that the service completion information has not been received.

[0147] Optionally, after determining whether the i-th service meets the security authentication requirements based on the i-th instance, the i-th identifier and the association relationship, the method further includes: determining whether the i-th service is the last service of the continuity service based on the i-th request information; and if it is determined that the i-th service is the last service, deleting the pre-stored association relationship.

[0148] Optionally, the instance information includes at least part of the following: user identity, device information of the user requesting the service, and location information of the user requesting the service.

[0149] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the security authentication device for the continuity service of the present application will be described in detail below in conjunction with specific embodiments.

[0150] This embodiment relates to a specific security authentication device for continuous service, such as Figure 4 As shown, the security authentication device includes three modules, namely, a security authentication module, a service processing module and a storage module. Figure 5 As shown, the service processing module is used to communicate with the service front end, wherein the service processing module is used to receive the service request (ie Figure 5 The service t security authentication request) and the response service processing result (i.e. Figure 5 The security authentication module is used for the security authentication service processing module, which is used to execute the security authentication method, including receiving the security authentication request and returning the security authentication response; the storage module is used to store and record the security authentication process and persistent data.

[0151] First, make the following definitions:

[0152] Definition i Represents an independent, stateless service corresponding to a hash behavior, where a hash behavior refers to a set of independent behaviors, each of which is independent of each other and has a corresponding service; T = {t1, t2, ..., t n} represents the continuity service, also called the hash behavior corresponding service set, where t i ∈T represents the i-th service, F(t i ) indicates service t i The completion state, F(t i )=1 means the service is completed, F(t i )=0 means the service is not completed; I(t i ) indicates service t i independence and statelessness, I(t i )=1 means service t i It is independent and stateless, I(t i )=0 means the service has no independence and statelessness;

[0153] Definition ij Indicates service i With service j The timing relationship, E = {(e ij =(t i ,t j )|t i ,t j ∈T} represents the temporal relationship set of the service set T, where e ij=1 means t i With t j There is a temporal relationship between services t i It is a service j Pre-service, service t j It is a service i After-sales service, e ij =0 means t i With t j There is no temporal relationship between

[0154] The definition of the hash-based continuity service is represented as G = {T, E}, where T = {t1, t2, ..., t n} represents the service set, E={(e ij =(t i ,t j )|t i ,t j ∈T} represents the set of temporal relations of the service set T.

[0155] The information can be obtained by parsing the service, service request information and service completion information.

[0156] The certification objectives are as follows:

[0157]

[0158]

[0159] E={(e ij =(t i ,t j )|t i ,t j ∈T}, e ij =0 or 1(3)

[0160] Among them, goal (1) means that the service must be independent and stateless, that is, service independence; goal (2) means that all services corresponding to the hash behavior must be completed, that is, service functionality; goal (3) means that there is a temporal relationship between the services in the service based on the hash behavior continuity, that is, service security.

[0161] like Figure 5 As shown, the security authentication method includes three stages, namely, the initial stage, the operation stage and the extinction stage. The security authentication method includes the following steps:

[0162] Step S1: The security authentication module determines the service t i Is the security authentication request of the current continuity service G the first service t1? If t iIf t1 is not the first service of the current continuous service G, then go to step S2; i If it is the first service t1 of the current continuous service G, the identification information of the continuous service G (a non-repeating random number) is randomly generated, the G instance information is initialized, and the key-value pair is saved in the storage module in the form of key-value, where the key is the identification information and the value is the G instance information of the first service t1, including user identity, device information, location information, etc., and the key-value validity period is set. The security authentication of the first service t1 passes and the key is returned to the service processing module;

[0163] Step S2: The security authentication module obtains data from the storage module according to the key. If the value data cannot be obtained, it means that the service t i The key does not exist or exceeds the key-value validity period, then t i The security check fails; if the value data is obtained, go to step S3;

[0164] Step S3: The security authentication module determines the service t i Whether it meets the security certification requirements, that is, judging whether the service i Front-end service ij Whether it is completed; and determine whether the hash behavior information corresponding to service T, including user identity, device information, location information, etc. G instance meets the security authentication requirements, that is, determine whether the user identity, device information, location information, etc. information are sent changes; if service t i If the security authentication logic processing fails, the service t i The security verification of the service fails, and the security authentication service of the continuity service G ends; if the service t i If the security authentication logic processing is passed, then go to step S4;

[0165] Step S4: The security authentication module determines the service t i Is the security authentication request of the current continuity service G the last request? n , if the service t i Not the last service of the current continuous service G n , then return to step S3; if service t i is the last service t of the current continuous service G n , the G instance information stored in the storage module is deleted, including user identity, device information, location information and other information, the continuity service G security authentication service ends, and the security authentication module sends the security authentication result to the service processing module.

[0166] An embodiment of the present invention provides a device, the device including a processor, a memory, and a program stored in the memory and executable on the processor, and when the processor executes the program, at least the following steps are implemented:

[0167] Step S201, receiving the i-th request information sent by the service processing module, wherein the i-th request information represents a request for security authentication of the i-th service, the continuous service includes a plurality of services having a timing dependency relationship, the i-th service is the i-th executed service in the continuous service, i≥1 and i is an integer;

[0168] Step S202, when the i-th service is not the first service of the continuity service, obtain the i-th instance and the i-th identifier, the i-th instance is the instance information carried by the i-th service, the i-th identifier is the identifier information carried by the i-th service, and when the service processing module receives the identifier information, configure the identifier information for multiple services in the continuity service;

[0169] Step S203, determining whether service completion information is received, and obtaining a determination result, wherein the service completion information indicates that the i-1th service has been executed and completed;

[0170] Step S204, determining whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier and a pre-stored association relationship, wherein the association relationship is obtained by associating the identifier information with the first instance, and the identifier information is generated and sent to the service processing module when the first request information is received;

[0171] Step S205: When all the services in the continuity service meet the security authentication requirement, determine that the continuity service passes the security authentication.

[0172] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0173] Optionally, determining whether the i-th service meets the security authentication requirements based on the determination result, the i-th instance, the i-th identifier and the pre-stored association relationship includes: determining whether the instance information associated with the i-th identifier exists in the association relationship based on the i-th identifier and the association relationship; determining that the instance information associated with the i-th identifier exists in the association relationship, and determining that the first instance is the instance information associated with the i-th identifier, at least when the i-th identifier is the same as the identifier information in the association relationship; determining that the i-th service meets the security authentication requirements when the i-th instance is the same as the first instance and the determination result indicates that the service completion information has been received.

[0174] Optionally, the association relationship is set with a validity period, and the i-th identifier has timestamp information. At least when the i-th identifier is the same as the identifier information in the association relationship, determining that the instance information associated with the i-th identifier exists in the association relationship includes: when the i-th identifier is the same as the identifier information in the association relationship and the timestamp information is within the validity period, determining that the instance information associated with the i-th identifier exists in the association relationship. The method also includes: when the i-th identifier is different from the identifier information in the association relationship, or when the timestamp information is not within the validity period, determining that the instance information associated with the i-th identifier does not exist in the association relationship.

[0175] Optionally, after receiving the i-th request information sent by the service processing module, when the i-th service is not the first service of the continuity service, and before obtaining the i-th instance and the i-th identifier, the method further includes: determining whether the i-th service is the first service based on the i-th request information; when the i-th service is the first service, randomly generating key information of the continuity service, obtaining the identifier information, and sending the identifier information to the service processing module, so that the service processing module configures the identifier information for each of the services in the continuity service; obtaining the first instance of the first service, obtaining value information, determining that the key-value pair including the key information and the value information is the association relationship, and setting a validity period for the association relationship; storing the association relationship set with the validity period in the storage module, and determining that the first service meets the security authentication requirements.

[0176] Optionally, the method also includes: determining that the i-th service does not meet the security authentication requirements when one of the following is met: the instance information associated with the i-th identifier does not exist in the association relationship; the i-th instance is different from the first instance; the determination result indicates that the service completion information has not been received.

[0177] Optionally, after determining whether the i-th service meets the security authentication requirements based on the i-th instance, the i-th identifier and the association relationship, the method further includes: determining whether the i-th service is the last service of the continuity service based on the i-th request information; and if it is determined that the i-th service is the last service, deleting the pre-stored association relationship.

[0178] Optionally, the instance information includes at least part of the following: user identity, device information of the user requesting the service, and location information of the user requesting the service.

[0179] The present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement at least the following method steps:

[0180] Step S201, receiving the i-th request information sent by the service processing module, wherein the i-th request information represents a request for security authentication of the i-th service, the continuous service includes a plurality of services having a timing dependency relationship, the i-th service is the i-th executed service in the continuous service, i≥1 and i is an integer;

[0181] Step S202, when the i-th service is not the first service of the continuity service, obtain the i-th instance and the i-th identifier, the i-th instance is the instance information carried by the i-th service, the i-th identifier is the identifier information carried by the i-th service, and when the service processing module receives the identifier information, configure the identifier information for multiple services in the continuity service;

[0182] Step S203, determining whether service completion information is received, and obtaining a determination result, wherein the service completion information indicates that the i-1th service has been executed and completed;

[0183] Step S204, determining whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier and a pre-stored association relationship, wherein the association relationship is obtained by associating the identifier information with the first instance, and the identifier information is generated and sent to the service processing module when the first request information is received;

[0184] Step S205: When all the services in the continuity service meet the security authentication requirement, determine that the continuity service passes the security authentication.

[0185] Optionally, determining whether the i-th service meets the security authentication requirements based on the determination result, the i-th instance, the i-th identifier and the pre-stored association relationship includes: determining whether the instance information associated with the i-th identifier exists in the association relationship based on the i-th identifier and the association relationship; determining that the instance information associated with the i-th identifier exists in the association relationship, and determining that the first instance is the instance information associated with the i-th identifier, at least when the i-th identifier is the same as the identifier information in the association relationship; determining that the i-th service meets the security authentication requirements when the i-th instance is the same as the first instance and the determination result indicates that the service completion information has been received.

[0186] Optionally, the association relationship is set with a validity period, and the i-th identifier has timestamp information. At least when the i-th identifier is the same as the identifier information in the association relationship, determining that the instance information associated with the i-th identifier exists in the association relationship includes: when the i-th identifier is the same as the identifier information in the association relationship and the timestamp information is within the validity period, determining that the instance information associated with the i-th identifier exists in the association relationship. The method also includes: when the i-th identifier is different from the identifier information in the association relationship, or when the timestamp information is not within the validity period, determining that the instance information associated with the i-th identifier does not exist in the association relationship.

[0187] Optionally, after receiving the i-th request information sent by the service processing module, when the i-th service is not the first service of the continuity service, and before obtaining the i-th instance and the i-th identifier, the method further includes: determining whether the i-th service is the first service based on the i-th request information; when the i-th service is the first service, randomly generating key information of the continuity service, obtaining the identifier information, and sending the identifier information to the service processing module, so that the service processing module configures the identifier information for each of the services in the continuity service; obtaining the first instance of the first service, obtaining value information, determining that the key-value pair including the key information and the value information is the association relationship, and setting a validity period for the association relationship; storing the association relationship set with the validity period in the storage module, and determining that the first service meets the security authentication requirements.

[0188] Optionally, the method also includes: determining that the i-th service does not meet the security authentication requirements when one of the following is met: the instance information associated with the i-th identifier does not exist in the association relationship; the i-th instance is different from the first instance; the determination result indicates that the service completion information has not been received.

[0189] Optionally, after determining whether the i-th service meets the security authentication requirements based on the i-th instance, the i-th identifier and the association relationship, the method further includes: determining whether the i-th service is the last service of the continuity service based on the i-th request information; and if it is determined that the i-th service is the last service, deleting the pre-stored association relationship.

[0190] Optionally, the instance information includes at least part of the following: user identity, device information of the user requesting the service, and location information of the user requesting the service.

[0191] Obviously, those skilled in the art should understand that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0192] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0193] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0194] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0195] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0196] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0197] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0198] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0199] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0200] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A security authentication method for continuous service, characterized in that: include: Receive the i-th request information sent by the service processing module, the i-th request information represents a request for security authentication of the i-th service, the continuous service includes a plurality of services having a timing dependency, the i-th service is the i-th executed service in the continuous service, i≥1 and i is an integer; In the case that the i-th service is not the first service of the continuity service, obtaining the i-th instance and the i-th identifier, wherein the i-th instance is instance information carried by the i-th service, and the i-th identifier is identifier information carried by the i-th service, and in the case that the service processing module receives the identifier information, configuring the identifier information for a plurality of the services in the continuity service; Determine whether service completion information is received, and obtain a determination result, wherein the service completion information indicates that the i-1th service has been executed and completed; Determine whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier and a pre-stored association relationship, wherein the association relationship is obtained by associating the identifier information with the first instance, and the identifier information is generated and sent to the service processing module when the first request information is received; In a case where all of the services in the continuity service meet the security authentication requirement, it is determined that the continuity service passes the security authentication.

2. The method according to claim 1, characterized in that Determining whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier, and the pre-stored association relationship includes: According to the i-th identifier and the association relationship, determining whether the instance information associated with the i-th identifier exists in the association relationship; At least when the i-th identifier is the same as the identifier information in the association relationship, determining that the instance information associated with the i-th identifier exists in the association relationship, and determining that the first instance is the instance information associated with the i-th identifier; In a case where the i-th instance is the same as the first instance and the determination result indicates that the service completion information is received, it is determined that the i-th service meets the security authentication requirement.

3. The method according to claim 2, characterized in that The association relationship is set with a validity period, and the i-th identifier has timestamp information. At least when the i-th identifier is the same as the identifier information in the association relationship, determining that the instance information associated with the i-th identifier exists in the association relationship includes: when the i-th identifier is the same as the identifier information in the association relationship and the timestamp information is within the validity period, determining that the instance information associated with the i-th identifier exists in the association relationship, The method further includes: when the i-th identification is different from the identification information in the association relationship, or when the timestamp information is not within the validity period, determining that the instance information associated with the i-th identification does not exist in the association relationship.

4. The method according to claim 2, characterized in that: After receiving the i-th request information sent by the service processing module, if the i-th service is not the first service of the continuity service, before acquiring the i-th instance and the i-th identifier, the method further includes: Determine, according to the i-th request information, whether the i-th service is the first service; In the case where the i-th service is the first service, randomly generating key information of the continuity service, obtaining the identification information, and sending the identification information to the service processing module, so that the service processing module configures the identification information for each of the services in the continuity service; Acquire the first instance of the first service, obtain value information, determine that a key-value pair including the key information and the value information is the association relationship, and set a validity period for the association relationship; The association relationship with the validity period is stored in a storage module, and it is determined that the first service meets the security authentication requirement.

5. The method according to claim 1, characterized in that The method further comprises: In the case where one of the following is met, it is determined that the i-th service does not meet the security authentication requirement: The instance information associated with the i-th identifier does not exist in the association relationship; The i-th instance is different from the first instance; The determination result indicates that the service completion information has not been received.

6. The method according to claim 1, characterized in that After determining whether the i-th service meets the security authentication requirement according to the i-th instance, the i-th identifier and the association relationship, the method further includes: Determining, according to the i-th request information, whether the i-th service is the last service of the continuous service; In the case where it is determined that the i-th service is the last service, the pre-stored association relationship is deleted.

7. The method according to claim 1, characterized in that The instance information includes at least part of the following: user identity, device information of the user requesting the service, and location information of the user requesting the service.

8. A security authentication device for continuous service, characterized in that: include: A receiving unit, configured to receive an i-th request information sent by a service processing module, wherein the i-th request information represents a request for security authentication of an i-th service, wherein the continuous service includes a plurality of services having a timing dependency relationship, and the i-th service is the i-th executed service in the continuous service, where i≥1 and i is an integer; a first acquisition unit, configured to acquire, when the i-th service is not the first service of the continuity service, an i-th instance and an i-th identifier, wherein the i-th instance is instance information carried by the i-th service, and the i-th identifier is identifier information carried by the i-th service, and configure the identifier information for a plurality of the services in the continuity service when the service processing module receives the identifier information; A first determining unit, configured to determine whether service completion information is received and obtain a determination result, wherein the service completion information indicates that the i-1th service has been executed and completed; a second determination unit, configured to determine whether the i-th service meets the security authentication requirement according to the determination result, the i-th instance, the i-th identifier and a pre-stored association relationship, wherein the association relationship is obtained by associating the identifier information with the first instance, and the identifier information is generated and sent to the service processing module when the first request information is received; The third determining unit is configured to determine, if all the services in the continuity service meet the security authentication requirement, that the continuity service passes the security authentication.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. A security authentication device for continuous service, characterized in that: include: A security authentication module, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include a method for executing any one of claims 1 to 7; A service processing module, communicating with the security authentication module, is used to receive request information, send the request information to the security authentication module, and receive the security authentication result fed back by the security authentication module; A storage module communicates with the security authentication module and is used to store the association relationship.

Images