Data signature authentication method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses a data signature authentication method and device, equipment and a storage medium, and the method comprises the steps: obtaining a to-be-verified token; wherein the token to be verified comprises a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are respectively obtained based on different signature algorithms; respectively carrying out security verification on the first-layer signature and the second-layer signature to obtain a first verification result and a second verification result; and determining a target verification result of the token to be verified according to the first verification result and the second verification result. According to the technical scheme provided by the embodiment of the invention, the problem of insufficient information security in the existing JWT token is solved, a dual signature mechanism can be introduced to carry out security verification on the token, and the security of the JWT token is improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of information transmission security technology, and in particular to a data signature authentication method, device, equipment and storage medium. Background Art

[0002] JSON Web Token (JWT) is a concise, URL-safe token standard for securely transmitting information between two parties. It defines a compact, self-contained way to pass signed JSON objects between different entities. JWT consists of three parts: Header, Payload, and Signature. The Header and Payload parts are Base64 encodings of the JSON object, and the Signature part is a signature of the first two parts, which is used to verify the integrity and authenticity of the information.

[0003] In existing JWT applications, user authentication is mainly achieved by storing the JWT token on the client and sending it to the server for verification at each request. However, the existing JWT technology has the following shortcomings:

[0004] Insufficient security: Although JWT itself uses a signature mechanism, in some cases, such as when the private key is leaked or cracked, the security of JWT will be seriously threatened. Summary of the invention

[0005] The embodiments of the present invention provide a data signature authentication method, apparatus, device and storage medium, which can introduce a double signature mechanism to verify the security of tokens and improve the security of JWT tokens.

[0006] In a first aspect, an embodiment of the present invention provides a data signature authentication method, the method comprising:

[0007] Obtain a token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are respectively obtained based on different signature algorithms; perform security verification on the first-layer signature and the second-layer signature respectively to obtain a first verification result and a second verification result; determine a target verification result of the token to be verified based on the first verification result and the second verification result.

[0008] In a second aspect, an embodiment of the present invention provides a data signature authentication device, the device comprising:

[0009] A token acquisition module is used to acquire a token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are respectively obtained based on different signature algorithms; a signature verification module is used to perform security verification on the first-layer signature and the second-layer signature respectively to obtain a first verification result and a second verification result; a token verification module is used to determine a target verification result of the token to be verified based on the first verification result and the second verification result.

[0010] In a third aspect, an embodiment of the present invention provides a computer device, the computer device comprising:

[0011] one or more processors;

[0012] A memory for storing one or more programs;

[0013] When the one or more programs are executed by the one or more processors, the one or more processors implement the data signature authentication method described in any embodiment.

[0014] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data signature authentication method described in any embodiment.

[0015] The technical solution provided by the embodiment of the present invention obtains a token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are respectively obtained based on different signature algorithms; the first-layer signature and the second-layer signature are respectively security verified to obtain a first verification result and a second verification result; based on the first verification result and the second verification result, the target verification result of the token to be verified is determined. The technical solution of the embodiment of the present invention solves the problem of insufficient information security in existing JWT tokens, and can introduce a double signature mechanism to perform security verification on the token, thereby improving the security of the JWT token. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of a data signature authentication method provided by an embodiment of the present invention;

[0017] Figure 2 It is a flow chart of another data signature authentication method provided by an embodiment of the present invention;

[0018] Figure 3 This is a workflow diagram for performing security verification provided by an embodiment of the present invention;

[0019] Figure 4 It is a structural diagram of a data signature authentication device provided by an embodiment of the present invention;

[0020] Figure 5 It is a structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] Figure 1 It is a flow chart of a data signature authentication method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of security verification of JWT tokens. The method can be executed by a data signature authentication device, which can be implemented by software and / or hardware.

[0023] like Figure 1 As shown, the data signature authentication method includes the following steps:

[0024] S110: Obtain a token to be verified.

[0025] The token to be verified may be a token that needs to be security verified. Exemplarily, the token to be verified may be a JWT token that needs to be applied for access. The token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are obtained based on different signature algorithms. Exemplarily, the first-layer signature may be a signature built based on the signature mechanism of JWT itself. The second-layer signature may be a signature built based on other signature mechanisms.

[0026] S120. Perform security verification on the first-layer signature and the second-layer signature respectively to obtain a first verification result and a second verification result.

[0027] The first verification result may be a security verification result corresponding to the first-layer signature, and the second verification result may be a security verification result corresponding to the second-layer signature.

[0028] Specifically, the reference signatures corresponding to the first layer signature and the second layer signature can be determined from the preset database, and then the first layer signature and the second layer signature can be compared with the corresponding reference signatures, and the first verification result and the second verification result can be determined according to the comparison results.

[0029] S130. Determine a target verification result of the token to be verified according to the first verification result and the second verification result.

[0030] Among them, the target verification result can be a security verification result of the token to be verified. Specifically, the target verification result of the token to be verified can be determined from the first verification result and the second verification result. For example, when both the first verification result and the second verification result are verified to be passed, it can be determined that the target verification result of the token to be verified is the security verification passed. On the contrary, if at least one of the first verification result and the second verification result is the verification failed, then the target security verification result is the security verification failed.

[0031] The technical solution provided by the embodiment of the present invention obtains a token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are respectively obtained based on different signature algorithms; the first-layer signature and the second-layer signature are respectively security verified to obtain a first verification result and a second verification result; based on the first verification result and the second verification result, the target verification result of the token to be verified is determined. The technical solution of the embodiment of the present invention solves the problem of insufficient information security in existing JWT tokens, and can introduce a double signature mechanism to perform security verification on the token, thereby improving the security of the JWT token.

[0032] Figure 2 It is another flow chart of a data signature authentication method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of security verification of JWT tokens. Based on the above embodiments, this embodiment further illustrates how to perform security verification on the first-layer signature and the second-layer signature respectively to obtain the first verification result and the second verification result; and how to determine the target verification result of the token to be verified based on the first verification result and the second verification result. The device can be implemented by software and / or hardware and integrated in a computer device with application development function.

[0033] like Figure 2 As shown, the data signature authentication method includes the following steps:

[0034] S210: Obtain a token to be verified.

[0035] The token to be verified may be a token that needs to be security verified. Exemplarily, the token to be verified may be a JWT token that needs to be applied for access. The token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are obtained based on different signature algorithms. Exemplarily, the first-layer signature may be a signature built based on the signature mechanism of JWT itself. The second-layer signature may be a signature built based on other signature mechanisms.

[0036] S220: Determine, from a preset signature verification library, a first reference signature corresponding to the first-layer signature and a second reference signature corresponding to the second-layer signature.

[0037] Among them, the preset signature verification library can be a preset database for storing reference signatures. Among them, the reference signatures stored in the preset signature database can be used to perform security verification on the signature in the token. Further, the first reference signature can be a reference signature corresponding to the first layer signature. The second reference signature can be a reference signature corresponding to the second layer signature. Specifically, based on the identification information of the first layer signature and the second layer signature, the first reference signature corresponding to the first layer signature and the second reference signature corresponding to the second layer signature can be matched from the preset signature verification library.

[0038] S230: Compare the first-layer signature with the first reference signature, and determine the first verification result according to the comparison result.

[0039] The first verification result may be a security verification result corresponding to the first layer signature. Specifically, the first layer signature and the first reference signature may be compared, and if the two are the same, the first verification result may be determined as passed, otherwise, failed.

[0040] S240: Compare the second-layer signature with the second reference signature, and determine the second verification result according to the comparison result.

[0041] The second verification result may be a security verification result corresponding to the second-layer signature. Specifically, the second-layer signature may be compared with the second reference signature. If the two are the same, the second verification result may be determined as passed, otherwise, failed.

[0042] Optionally, before performing security verification on the first-layer signature and the second-layer signature respectively, the method further includes: matching the token to be verified with the token in the invalid token list, and determining that the target verification result is security verification failure when the match is successful; wherein the invalid token list is used to store revoked tokens. That is, the tokens stored in the invalid token list are already invalid. By verifying the validity of the signature before performing the security verification, the invalid tokens that have been revoked can be screened, avoiding unnecessary security verification of the invalid tokens later, reducing the computational complexity of token security verification, and improving verification efficiency.

[0043] Optionally, before respectively performing security verification on the first-layer signature and the second-layer signature, the method further includes: matching the token to be verified with the tokens in the verified token list, and determining the target verification result as security verification passed when the match is successful; wherein the verified token list is used to store tokens that have passed security verification. That is, the tokens stored in the verified token list have passed security verification before the current moment, so when the token to be verified successfully matches the token in the verified token list, there is no need to repeatedly verify the token to be verified, and the target verification result of the token to be verified can be directly determined as security verification passed, thereby reducing the computational complexity of token security verification.

[0044] Optionally, before performing security verification on the first-layer signature and the second-layer signature respectively, it also includes: obtaining a first expiration time corresponding to the first-layer signature, and a second expiration time corresponding to the second-layer signature; when the first expiration time or the second expiration time is earlier than the current time, determining that the target verification result is that the security verification fails.

[0045] Among them, the first expiration time may be the expiration time corresponding to the first-layer signature. The second expiration time may be the expiration time corresponding to the second-layer signature. Among them, the signature may have a corresponding expiration time when it is created, and the expiration time of the signature may be preset manually. Specifically, the first expiration time corresponding to the first-layer signature and the second expiration time corresponding to the second-layer signature may be determined from the associated information of the token to be verified. Furthermore, the first expiration time and the second expiration time may be compared with the current time respectively. When the first expiration time or the second expiration time is earlier than the current time, it indicates that the signature of the token to be verified is expired, and therefore it may be determined that the target verification result is that the security verification has failed.

[0046] Among them, you can set the corresponding signature key regular update strategy, set the key update cycle, and regularly replace the JWT signature key. During the key update period, the server supports the verification of both the new and old keys to ensure a smooth transition.

[0047] S250. Determine a target verification result of the token to be verified according to the first verification result and the second verification result.

[0048] Among them, the target verification result can be a security verification result of the token to be verified. Specifically, the target verification result of the token to be verified can be determined from the first verification result and the second verification result. For example, when both the first verification result and the second verification result are verified to be passed, it can be determined that the target verification result of the token to be verified is the security verification passed. On the contrary, if at least one of the first verification result and the second verification result is the verification failed, then the target security verification result is the security verification failed.

[0049] Optionally, after determining the first verification result and the second verification result, it also includes: when the first verification result and the second verification result are both verified through, determining the token expiration time of the token to be verified; when the token expiration time is earlier than the current time, determining that the target verification result is security verification failure.

[0050] The token expiration time may be the expiration time corresponding to the token to be verified. Specifically, the token expiration time of the token to be verified may be manually set. In the case that both the first verification result and the second verification result fail to pass the verification, it may be verified whether the token to be verified is expired. In the case that the token expiration time is earlier than the current time, it may be determined that the token to be verified has expired, and thus it may be determined that the target verification result is security verification failure.

[0051] Optionally, after determining the first verification result and the second verification result, it also includes: when the first verification result and the second verification result are both verified through, determining the access permission type of the token to be verified; based on the object identification information of the token to be verified, determining the access permission type corresponding to the token to be verified; when there is no access permission type in the access permission type, determining that the target verification result is security verification failure.

[0052] Among them, the access permission type can be the permission type that the token to be verified needs to access. Specifically, the access permission type corresponding to the token to be verified can be determined according to the access instruction in the token to be verified. The object identity information can be the identification information of the target object that issues the token to be verified. For example, the object identifier information can be the identification information of the user who issues the token to be verified. Further, the access permission type can be the permission type that the target object can access. Specifically, the permission type that the target object can access can be matched from the preset permission database, and the matched permission type can be used as the access permission type. Exemplarily, an optional field can be added to the token to support the embedding of dynamic permission information and user roles, so that the JWT can contain the user's specific access permissions when it is generated, simplifying the permission verification process. Finally, it can be determined whether there is an access permission type in the access permission type. If it does not exist, it means that the token to be verified has no permission to access, so it can be determined that the target verification result is a security verification failure.

[0053] For example, in order to better understand the technical solution provided by the present invention, a specific embodiment is introduced below: Figure 3 This is a workflow diagram for performing security verification provided by an embodiment of the present invention. Figure 3As shown, the workflow diagram of token security verification includes the following steps: first, determine whether the token is in the revocation list. If so, directly determine that the verification has failed. If not, determine whether it is in the JWT cache (that is, the verified list). If it is in the JWT cache, directly determine that the verification has succeeded. If it is not in the JWT cache, start verifying the first-layer signature. If the first-layer signature verification fails, directly determine that the verification has failed. If the first-layer signature verification succeeds, start verifying the second-layer signature. If the second-layer signature verification fails, directly determine that the verification has failed. If the second-layer signature verification succeeds, verify whether the token is expired. If the token is expired, directly determine that the verification has failed. If the token is not expired, verify the token permissions. If the token permissions verification passes, determine that the verification has succeeded. If the token permissions verification fails, determine that the verification has failed.

[0054] The technical solution provided by the embodiment of the present invention obtains the token to be verified; determines the first reference signature corresponding to the first layer signature and the second reference signature corresponding to the second layer signature from the preset signature verification library; compares the first layer signature with the first reference signature, and determines the first verification result according to the comparison result; compares the second layer signature with the second reference signature, and determines the second verification result according to the comparison result; determines the target verification result of the token to be verified according to the first verification result and the second verification result. The technical solution of the embodiment of the present invention solves the problem of insufficient information security in the existing JWT token, and can introduce a double signature mechanism to verify the security of the token, thereby improving the security of the JWT token.

[0055] Figure 4 It is a structural diagram of a data signature authentication device provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of security verification of JWT tokens. The device can be implemented by software and / or hardware and integrated into a computer device with application development function.

[0056] like Figure 4 As shown, the digital signature authentication device includes: a token acquisition module 310 , a signature verification module 320 and a token verification module 330 .

[0057] Among them, the token acquisition module 310 is used to obtain the token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are respectively obtained based on different signature algorithms; the signature verification module 320 is used to perform security verification on the first-layer signature and the second-layer signature respectively to obtain a first verification result and a second verification result; the token verification module 330 is used to determine the target verification result of the token to be verified based on the first verification result and the second verification result.

[0058] The technical solution provided by the embodiment of the present invention obtains a token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are respectively obtained based on different signature algorithms; the first-layer signature and the second-layer signature are respectively security verified to obtain a first verification result and a second verification result; based on the first verification result and the second verification result, the target verification result of the token to be verified is determined. The technical solution of the embodiment of the present invention solves the problem of insufficient information security in existing JWT tokens, and can introduce a double signature mechanism to perform security verification on the token, thereby improving the security of the JWT token.

[0059] In an optional embodiment, the token verification module 320 is specifically used to: determine a first reference signature corresponding to the first layer signature and a second reference signature corresponding to the second layer signature from a preset signature verification library; compare the first layer signature with the first reference signature, and determine the first verification result based on the comparison result; compare the second layer signature with the second reference signature, and determine the second verification result based on the comparison result.

[0060] In an optional embodiment, the data signature authentication device also includes: an invalid token verification module, which is used to: match the token to be verified with the tokens in the invalid token list before performing security verification on the first layer signature and the second layer signature respectively, and when the match is successful, determine that the target verification result is a security verification failure; wherein, the invalid token list is used to store revoked tokens.

[0061] In an optional embodiment, the data signature authentication device also includes: a security token verification module, which is used to: match the token to be verified with the tokens in the verified token list before performing security verification on the first layer signature and the second layer signature respectively, and when the match is successful, determine that the target verification result is security verification passed; wherein, the verified token list is used to store tokens that have passed security verification.

[0062] In an optional embodiment, the data signature authentication device also includes: an expired signature verification module, which is used to: obtain a first expiration time corresponding to the first layer signature and a second expiration time corresponding to the second layer signature before performing security verification on the first layer signature and the second layer signature respectively; when the first expiration time and / or the second expiration time are earlier than the current time, determine that the target verification result is a security verification failure.

[0063] In an optional embodiment, the data signature authentication device also includes: an expired token verification module, which is used to: after determining the first verification result and the second verification result, if the first verification result and the second verification result are both verified to be passed, determine the token expiration time of the token to be verified; if the token expiration time is earlier than the current time, determine that the target verification result is a security verification failure.

[0064] In an optional embodiment, the data signature authentication device also includes: a token permission verification module, which is used to: after determining the first verification result and the second verification result, if the first verification result and the second verification result are both verified successfully, determine the access permission type of the token to be verified; based on the object identification information of the token to be verified, determine the access permission type corresponding to the token to be verified; and if the access permission type does not exist in the access permission type, determine that the target verification result is a security verification failure.

[0065] The data signature authentication device provided in the embodiment of the present invention can execute the data signature authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0066] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Figure 5 A block diagram of an exemplary computer device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 5 The computer device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention. The computer device 12 can be any terminal device with computing capability and can be configured in a security verification device.

[0067] like Figure 5 As shown, the computer device 12 is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0068] The bus 18 may be one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0069] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0070] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache 32. The computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0071] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0072] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the computer device 12, and / or any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed through an input / output (I / O) interface 22. Furthermore, the computer device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 20. Figure 5 As shown, the network adapter 20 communicates with other modules of the computer device 12 via the bus 18. It should be understood that although Figure 5Not shown, other hardware and / or software modules may be used in conjunction with computer device 12, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0073] The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, implementing the data signature authentication method provided in the embodiment of the present invention, which includes:

[0074] Obtain a token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are respectively obtained based on different signature algorithms; perform security verification on the first-layer signature and the second-layer signature respectively to obtain a first verification result and a second verification result; determine a target verification result of the token to be verified based on the first verification result and the second verification result.

[0075] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the data signature authentication method provided by any embodiment of the present invention is implemented, including:

[0076] Obtain a token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are respectively obtained based on different signature algorithms; perform security verification on the first-layer signature and the second-layer signature respectively to obtain a first verification result and a second verification result; determine a target verification result of the token to be verified based on the first verification result and the second verification result.

[0077] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0078] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0079] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0080] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or combinations thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0081] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0082] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A data signature authentication method, characterized in that: include: Obtain a token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, and the first-layer signature and the second-layer signature are obtained based on different signature algorithms; Perform security verification on the first layer signature and the second layer signature respectively to obtain a first verification result and a second verification result; A target verification result of the token to be verified is determined according to the first verification result and the second verification result.

2. The method according to claim 1, characterized in that The performing security verification on the first layer signature and the second layer signature respectively to obtain a first verification result and a second verification result includes: Determine a first reference signature corresponding to the first-layer signature and a second reference signature corresponding to the second-layer signature from a preset signature verification library; Comparing the first layer signature with the first reference signature, and determining the first verification result according to the comparison result; The second layer signature is compared with the second reference signature, and the second verification result is determined according to the comparison result.

3. The method according to claim 1, characterized in that Before respectively performing security verification on the first-layer signature and the second-layer signature, the method further includes: Matching the token to be verified with the tokens in the invalid token list, and if the match is successful, determining that the target verification result is a security verification failure; The invalid token list is used to store revoked tokens.

4. The method according to claim 1, characterized in that: Before respectively performing security verification on the first-layer signature and the second-layer signature, the method further includes: Matching the token to be verified with the tokens in the verified token list, and if the match is successful, determining that the target verification result is security verification passed; The verified token list is used to store tokens that have passed security verification.

5. The method according to claim 1, before respectively performing security verification on the first layer signature and the second layer signature, further comprising: Obtaining a first expiration time corresponding to the first-layer signature and a second expiration time corresponding to the second-layer signature; In the case where the first expiration time and / or the second expiration time is earlier than the current time, it is determined that the target verification result is that the security verification fails.

6. The method according to claim 1, characterized in that After determining the first verification result and the second verification result, the method further includes: When both the first verification result and the second verification result are verified to be passed, determining a token expiration time of the token to be verified; In the case that the token expiration time is earlier than the current time, it is determined that the target verification result is a security verification failure.

7. The method according to claim 1, characterized in that After determining the first verification result and the second verification result, the method further includes: In a case where both the first verification result and the second verification result are verified as passed, determining the access permission type of the token to be verified; Determine the access permission type corresponding to the token to be verified based on the object identification information of the token to be verified; In a case where the access permission type does not exist in the access permission types, it is determined that the target verification result is that the security verification fails.

8. A data signature authentication device, characterized in that: The device comprises: A token acquisition module, used to acquire a token to be verified; wherein the token to be verified includes a first-layer signature and a second-layer signature, wherein the first-layer signature and the second-layer signature are obtained based on different signature algorithms respectively; A signature verification module, used to perform security verification on the first-layer signature and the second-layer signature respectively to obtain a first verification result and a second verification result; The token verification module is used to determine a target verification result of the token to be verified according to the first verification result and the second verification result.

9. A computer device, characterized in that: The computer device comprises: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the data signature authentication method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data signature authentication method as described in any one of claims 1 to 7 is implemented.

Images