Identity authentication method and device for accessing application and computer equipment

Abstract

The invention relates to an identity authentication method and device for accessing an application and computer equipment. The method comprises the following steps: determining an application type of a to-be-accessed application; the application type comprises an application with session control and an application without session control; key information is inquired and determined according to the application type, and a random secret order is extracted from the key information according to a preset mode; splicing the random secret order and the timestamp information of the current time to obtain a plaintext, and encrypting the plaintext according to the secret key information to obtain a secret order value; obtaining identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application and the secret order value; and sending the application access request for the to-be-accessed application and the identity authentication information to a server side. By adopting the method, the identity authentication processing efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of network application security, and in particular to an identity authentication method, apparatus, computer equipment, computer-readable storage medium, and computer program product for accessing an application. Background Art

[0002] With the rise of interactive Web applications, application systems need to manage user sessions. In order to distinguish users, users need to be identified by session IDs. However, session IDs are not encrypted and can be forged. Thus, attackers can attack application systems by forging session IDs, which will put pressure on the server or even crash it.

[0003] In the existing technology, in order to prevent the application system from suffering from CSRF (Cross-Site Request Forgery) attacks, the use of Token (identity token) can prevent attackers from forging identification. Token uses an encryption algorithm, and attackers cannot forge Token to attack the server or other adverse behaviors. However, this method usually requires the server to save the state and dynamically generate Token. In high-concurrency scenarios, it is easy to put pressure on server performance, resulting in low efficiency of identity authentication processing in high-concurrency environments. Summary of the invention

[0004] Based on this, it is necessary to provide an identity authentication method, apparatus, computer device, computer-readable storage medium and computer program product for accessing applications that can improve the efficiency of identity authentication processing in order to solve the above technical problems.

[0005] In a first aspect, the present application provides an identity authentication method for accessing an application, comprising:

[0006] Determine an application type of the application to be accessed; the application type includes an application with session control and an application without session control;

[0007] According to the application type, query and determine the key information, and extract the random password from the key information in a preset manner;

[0008] The random password and the timestamp information of the current time are concatenated to obtain a plain text, and the plain text is encrypted according to the key information to obtain a password value;

[0009] Obtaining identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application, and the secret value;

[0010] The application access request for the application to be accessed and the identity authentication information are sent to the server.

[0011] In one embodiment, querying and determining key information according to the application type includes:

[0012] When the application type is the application with session control, obtaining a session identifier between the application to be accessed and the application to be accessed;

[0013] From the session identifier, intercept a first preset number of valid characters in a reading order to obtain the key information;

[0014] In the case that the application type is the application without session control, preset key information is queried according to the application identifier of the application to be accessed.

[0015] In one embodiment, extracting the random password from the key information in a preset manner includes:

[0016] Taking the number of characters in the key information as the upper limit of the value, and randomly determining the second preset number of sequence number values ​​according to the upper limit of the value;

[0017] According to the sequence number value, extracting the target characters of corresponding order from the key information;

[0018] Combining a sequence number value and a corresponding target character into a key-value pair;

[0019] The second preset number of key-value pairs are concatenated to obtain the random password.

[0020] In one embodiment, obtaining the identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application, and the secret value includes:

[0021] Concatenate the application type identifier of the application to be accessed, the application identifier of the application to be accessed and the secret value to obtain a ciphertext;

[0022] The ciphertext is encoded using a preset encoding method to obtain identity authentication information.

[0023] In a second aspect, the present application provides an identity authentication method for accessing an application, comprising:

[0024] Receive an application access request and identity authentication information sent by a client for an application to be accessed;

[0025] Obtaining, from the identity authentication information, an application identifier of the application to be accessed, a type identifier of the application type of the application to be accessed, and a secret value;

[0026] According to the type identifier, query and determine the key information, and according to the key information, decrypt the password value to obtain a random password and timestamp information;

[0027] The application access request is authenticated according to the key information, the random password and the timestamp information.

[0028] In one embodiment, the authenticating the application access request according to the key information, the random password and the timestamp information includes:

[0029] When the timestamp information is valid information and the random password matches the key information, determining that the identity authentication of the application access request is passed;

[0030] When the timestamp information is invalid information, or the random password and the key information do not match, it is determined that the identity authentication of the application access request fails.

[0031] In a third aspect, the present application also provides an identity authentication device for accessing an application, including:

[0032] An application type determination module, used to determine the application type of the application to be accessed; the application type includes an application with session control and an application without session control;

[0033] A random password acquisition module, used to query and determine key information according to the application type, and extract a random password from the key information in a preset manner;

[0034] A plaintext encryption processing module, used to concatenate the random secret code and the timestamp information of the current time to obtain a plaintext, and encrypt the plaintext according to the key information to obtain a secret code value;

[0035] An identity authentication acquisition module, used to obtain identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application and the password value;

[0036] The authentication request sending module is used to send the application access request for the application to be accessed and the identity authentication information to the server.

[0037] In a fourth aspect, the present application further provides an identity authentication device for accessing an application, comprising:

[0038] A request authentication receiving module, used to receive an application access request and identity authentication information sent by a client for an application to be accessed;

[0039] An authentication information parsing module, used to obtain the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and a password value from the identity authentication information;

[0040] A ciphertext decryption processing module, used to query and determine key information according to the type identifier, and decrypt the password value according to the key information to obtain a random password and timestamp information;

[0041] An access request authentication module is used to perform identity authentication on the application access request according to the key information, the random password and the timestamp information.

[0042] In a fifth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0043] Determine an application type of the application to be accessed; the application type includes an application with session control and an application without session control;

[0044] According to the application type, query and determine the key information, and extract the random password from the key information in a preset manner;

[0045] The random password and the timestamp information of the current time are concatenated to obtain a plain text, and the plain text is encrypted according to the key information to obtain a password value;

[0046] Obtaining identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application, and the secret value;

[0047] The application access request for the application to be accessed and the identity authentication information are sent to the server.

[0048] In a sixth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0049] Determine an application type of the application to be accessed; the application type includes an application with session control and an application without session control;

[0050] According to the application type, query and determine the key information, and extract the random password from the key information in a preset manner;

[0051] The random password and the timestamp information of the current time are concatenated to obtain a plain text, and the plain text is encrypted according to the key information to obtain a password value;

[0052] Obtaining identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application, and the secret value;

[0053] The application access request for the application to be accessed and the identity authentication information are sent to the server.

[0054] In a seventh aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0055] Determine an application type of the application to be accessed; the application type includes an application with session control and an application without session control;

[0056] According to the application type, query and determine the key information, and extract the random password from the key information in a preset manner;

[0057] The random password and the timestamp information of the current time are concatenated to obtain a plain text, and the plain text is encrypted according to the key information to obtain a password value;

[0058] Obtaining identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application, and the secret value;

[0059] The application access request for the application to be accessed and the identity authentication information are sent to the server.

[0060] The above-mentioned identity authentication method, device, computer equipment, computer-readable storage medium and computer program product for accessing an application first determine the application type of the application to be accessed, wherein the application type includes an application with session control and an application without session control, and by distinguishing between "applications with session control" and "applications without session control", adapt to different types of needs, improve the versatility of the solution, provide a basis for the subsequent determination of key information, and ensure that it can flexibly adapt to a variety of application scenarios; then, according to the application type, query and determine the key information, and extract a random password from the key information in a preset manner to ensure the security and reliability of the source of the key information, and at the same time increase the dynamics of the authentication process by extracting the random password, improve the randomness and uniqueness of the generated password, and thus enhance the anti-counterfeiting ability; then, concatenate the random password and the timestamp information of the current time to obtain plain text, and encrypt the plain text according to the key information to obtain the password value, and concatenate After the timestamp, each generated password value is made unique, and the plaintext is encrypted with a key to ensure the security of the password value during transmission and prevent the information from being stolen or tampered with; next, the authentication information is obtained according to the type identifier of the application type to be accessed, the application identifier of the application to be accessed, and the password value. The addition of the type identifier and the application identifier binds the authentication information to a specific application to prevent cross-application attacks, improves the integrity of the authentication information, and ensures context consistency during the authentication process; finally, the application access request and authentication information for the application to be accessed are sent to the server, and the authentication information is generated on the client and sent to the server together with the access request, which reduces the server's need to maintain the session state, reduces the computing and storage pressure caused by the dynamic generation and state storage of the authentication information, significantly improves the processing efficiency of the server in high-concurrency scenarios, and ensures the security and integrity of the authentication information transmission process. In the above method, by distinguishing application types (including applications with session control and those without session control), combined with the dynamic generation of random passwords and timestamp splicing encryption, the uniqueness and anti-counterfeiting capabilities of identity authentication information are achieved; by generating authentication information through the client, the server-side state preservation is avoided, the computing and storage pressure in high-concurrency scenarios is reduced, and the scalability and adaptability of distributed deployment are improved, thereby providing an identity authentication method that is both secure, lightweight and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0062] FIG1 is an application environment diagram of an identity authentication method for accessing an application in one embodiment;

[0063] FIG2 is a schematic diagram of a flow chart of an identity authentication method for accessing an application in one embodiment;

[0064] FIG3 is a schematic diagram of a flow chart of an identity authentication method for accessing an application in one embodiment;

[0065] FIG4 is a flow chart of an identity authentication method for accessing an application in another embodiment;

[0066] FIG5 is a schematic diagram of a flow chart of an identity authentication method for accessing an application in another embodiment;

[0067] FIG6 is a structural block diagram of an identity authentication device for accessing an application in one embodiment;

[0068] FIG7 is a structural block diagram of an identity authentication device for accessing an application in another embodiment;

[0069] FIG8 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0071] The authentication method for accessing an application provided in an embodiment of the present application can be applied to an application environment as shown in FIG. 1 . Among them, the client 102 communicates with the server 104 through a network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on a cloud or other network server. The client 102 first determines the application type of the application to be accessed, wherein the application type includes an application with session control and an application without session control; the client 102 queries and determines the key information according to the application type, and extracts a random password from the key information in a preset manner; then, the random password and the timestamp information of the current time are spliced ​​to obtain plain text, and the plain text is encrypted according to the key information to obtain a password value; according to the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed and the password value, the authentication information is obtained; finally, the client 102 sends the application access request and the authentication information for the application to be accessed to the server 104. The client 102 may be a terminal, which may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0072] In an exemplary embodiment, as shown in FIG. 2 , a method for authenticating access to an application is provided, which is described by taking the method applied to the client 102 in FIG. 1 as an example, and includes the following steps:

[0073] Step S201: Determine the application type of the application to be accessed.

[0074] The application type refers to whether the application system needs to manage and maintain the user's session status, including applications with session control and applications without session control. Applications with session control refer to applications that use session IDs to maintain the user's login status and session information; applications without session control refer to applications that do not rely on session IDs but use other methods (such as fixed keys or dynamically generated keys) for identity authentication.

[0075] For example, the client determines the application type by accessing the application configuration information or preset rules: the client queries the configuration center or predefined interface for the type identifier of the application to be accessed; if the query result shows that the application has session control, the subsequent operation is completed by extracting the necessary information from the session ID; if the query result shows that the application has no session control, the identity authentication information is generated through the preset key configuration or dynamically generated key. This ensures that the client can select the appropriate key processing flow according to the application type, providing an accurate basis for the execution of subsequent steps.

[0076] Step S202, query and determine the key information according to the application type, and extract the random password from the key information according to a preset method.

[0077] Among them, key information refers to the core data required to generate identity authentication information. Key information can be the result of processing the dynamically generated session ID, or it can be a fixed key value predefined from the configuration file or configuration center. Random password refers to the unique identifier obtained by processing the key information with a specific algorithm, which is used to ensure the dynamic and security of identity authentication information.

[0078] Exemplarily, the client selects different key acquisition methods and extracts random passwords according to different application types. If the application type is "application with session control", the client extracts the Session ID from the current session and formats it (such as removing special characters and truncating fixed length). The extracted result is used as the key information. If the application type is "application without session control", the client queries the corresponding key information according to the application identifier by accessing the configuration center or reading the local configuration file. After obtaining the key information, the client generates a random password from the key information according to the preset algorithm or rules. Specifically, it can be: randomly selecting several characters or data segments from the key information to form the basis of the password; processing these data in combination with certain random logic, such as generating key-value pairs or encryption operations, so as to generate a unique and secure random password. The dynamic and unpredictable nature of the password is ensured, laying the foundation for subsequent encryption operations.

[0079] Step S203, concatenate the random password and the timestamp information of the current time to obtain plain text, and encrypt the plain text according to the key information to obtain the password value.

[0080] The timestamp information refers to the current client system time in milliseconds, indicating the specific time when the random password is generated.

[0081] Exemplarily, after the client completes the generation of the random password, it obtains the timestamp of the current system, and concatenates the random password and the timestamp in a preset format to form plain text. For example, the random password is 2=C;5=3;8=F, the timestamp is 1690000000000, and the concatenated plain text is 2=C;5=3;8=F1690000000000. Subsequently, the client uses an encryption algorithm (such as the SM4 algorithm) to encrypt the plain text according to the key information obtained. The encryption process includes: using the key information as the input key of the encryption algorithm to ensure the security and consistency of each encryption operation. Perform an encryption operation on the plain text to generate a password value. The encrypted password value is a ciphertext that cannot be directly interpreted, and has uniqueness and tamper-proof characteristics. By adding a timestamp, the timeliness of the plain text data is ensured to prevent replay attacks.

[0082] Step S204, obtaining identity authentication information according to the type identifier of the application type to be accessed, the application identifier of the application to be accessed, and the password value.

[0083] Among them, the type identifier is a mark used to distinguish the type of application to be accessed, indicating whether the application has session control; the application identifier is the mark information used to uniquely identify the application to be accessed, such as the application ID or name; the identity authentication information is a complete authentication credential generated by combining the above elements for the server to verify the user's identity.

[0084] Exemplarily, the client assembles the authentication information in a preset format according to the type identifier, application identifier, and secret value obtained in the previous step. For example, the type identifier is "D" (application with session control). The application identifier is "App123". The secret value is "ENCRYPTED_VALUE". The concatenation format of the authentication information is: D-App123-ENCRYPTED_VALUE. The client combines these elements into complete authentication information with separators (such as "-") to ensure the structural clarity and parsing consistency of each part. By combining the type identifier, application identifier, and secret value, authentication information bound to a specific application is generated to ensure contextual consistency of the authentication process; at the same time, compatibility in multiple application scenarios is provided to prevent cross-application attacks, making the transmission and verification of authentication information more secure and reliable. As a complete credential, the authentication information provides the necessary basis for the verification logic of the server to ensure the legitimacy and validity of the request.

[0085] Step S205: sending the application access request and identity authentication information for the application to be accessed to the server.

[0086] Among them, an application access request is an access operation request initiated by a user to a specific application resource or service, which contains information such as the operation target and parameters; the server side is the service target that receives and verifies the user's request and is responsible for parsing and processing the request content.

[0087] Exemplarily, after generating the authentication information, the client packages it together with the application access request and sends it to the server. The specific implementation process includes: merging the content of the application access request (such as the parameters of the API call, the target of the user operation, etc.) and the authentication information into a complete request data packet. Encrypt the entire data packet using a secure transmission protocol (such as HTTPS) to ensure the security and anti-eavesdropping of data during transmission. Send the data packet to the designated interface on the server side of the application to be accessed. By carrying the authentication information, the legitimacy of the request source is verified, providing a reliable basis for the security processing on the server side, and effectively preventing unauthorized access and malicious requests.

[0088] In the above-mentioned identity authentication method for accessing an application, first, the application type of the application to be accessed is determined, wherein the application type includes an application with session control and an application without session control. By distinguishing between "applications with session control" and "applications without session control", different types of requirements are adapted, the versatility of the solution is improved, and a basis is provided for the subsequent determination of key information, ensuring that it can flexibly adapt to a variety of application scenarios; then, according to the application type, the key information is queried and determined, and a random password is extracted from the key information in a preset manner to ensure the security and reliability of the source of the key information. At the same time, the dynamic nature of the authentication process is increased by extracting the random password, the randomness and uniqueness of the generated password are improved, and the anti-counterfeiting ability is enhanced; then, the random password and the timestamp information of the current time are spliced ​​to obtain plain text, and the plain text is encrypted according to the key information to obtain the password value. After splicing the timestamp, the password generated each time is The value of the password is unique, and the plaintext is encrypted with a key to ensure the security of the password value during transmission and prevent the information from being stolen or tampered with; next, the authentication information is obtained according to the type identifier of the application type to be accessed, the application identifier of the application to be accessed, and the password value. The addition of the type identifier and the application identifier binds the authentication information to a specific application to prevent cross-application attacks, improves the integrity of the authentication information, and ensures context consistency during the authentication process; finally, the application access request and authentication information for the application to be accessed are sent to the server, and the authentication information is generated on the client and sent to the server together with the access request, which reduces the server's need to maintain the session state, reduces the computing and storage pressure caused by the dynamic generation and state storage of the authentication information, significantly improves the processing efficiency of the server in high concurrency scenarios, and ensures the security and integrity of the authentication information transmission process. In the above method, by distinguishing application types (including applications with session control and those without session control), combined with the dynamic generation of random passwords and timestamp splicing encryption, the uniqueness and anti-counterfeiting capabilities of identity authentication information are achieved; by generating authentication information through the client, the server-side state preservation is avoided, the computing and storage pressure in high-concurrency scenarios is reduced, and the scalability and adaptability of distributed deployment are improved, thereby providing an identity authentication method that is both secure, lightweight and efficient.

[0089] In an exemplary embodiment, the above-mentioned step S202 queries and determines the key information according to the application type, and also includes: when the application type is an application with session control, obtaining the session identifier between the application to be accessed; from the session identifier, intercepting a first preset number of valid characters in reading order to obtain the key information; when the application type is an application without session control, querying and obtaining the preset key information according to the application identifier of the application to be accessed.

[0090] Exemplarily, after the client identifies the type of application to be accessed, for applications with session control: the client extracts the Session ID associated with the application, such as obtaining the identifier from a cookie or request header. The extracted Session ID may contain special characters, and the client formats it (such as removing invalid characters such as -), and intercepts the first several characters as key information according to preset rules. For example, the extracted Session ID is 123e4567-e89b-12d3-a456-426614174000. After formatting, special characters are removed and the first 16 characters are intercepted, and the key information generated is 123e4567e89b12d3. For applications without session control: the client obtains the preset key information by querying the configuration center or reading the local configuration file based on the identifier of the application to be accessed (such as App123). For example, the key information obtained through configuration query is AbcD123456EFGH.

[0091] In this embodiment, the key information is obtained dynamically or statically, which realizes the flexible adaptation of the key generation method and the application scenario. In applications with session control, the dynamic extraction of key information is bound to the current session, which enhances the uniqueness and security of the authentication process; in applications without session control, the fixed key query method reduces the implementation complexity and server pressure, while ensuring the stability of the authentication process.

[0092] In an exemplary embodiment, the above-mentioned step S202 extracts a random password from the key information according to a preset method, and also includes: taking the number of characters in the key information as the upper limit of the value, and randomly determining a second preset number of serial number values ​​based on the upper limit of the value; extracting correspondingly sorted target characters from the key information according to the serial number value; combining a serial number value and the corresponding target character into a key-value pair; and splicing the second preset number of key-value pairs to obtain a random password.

[0093] Exemplarily, when the client generates a random password based on the key information, the length of the key information is first determined. For example, the key information is AbcD123456EFGH, and the number of characters is 14, which is used as the upper limit of the random value. Subsequently, the client randomly generates a second preset number of serial number values ​​(such as 4), for example, the generated serial number values ​​are [2, 5, 9, 14]. According to these serial number values, the characters at the corresponding positions are extracted from the key information, and the target character sequence is b, 1, 5, H. Each serial number value and its target character form a key-value pair: 2=b, 5=1, 9=5, 14=H. Then, the client concatenates the key-value pairs according to the separator; to form the final random password: Random password: 2=b;5=1;9=5;14=H.

[0094] In this embodiment, the dynamic and unpredictable nature of the random password is significantly enhanced by the generation of random serial number values ​​and the splicing of key-value pairs. The rationality of the random value range is ensured by using the key information length as the upper limit of the value; the combination of serial number values ​​and target characters not only standardizes the structure of the password, but also makes the random password highly dependent on the key information, thereby improving the security of the authentication information and further reducing the possibility of forgery.

[0095] In an exemplary embodiment, the above-mentioned step S204 obtains identity authentication information based on the type identifier of the application type to be accessed, the application identifier of the application to be accessed, and the secret code value, and also includes: concatenating the application type identifier of the application to be accessed, the application identifier of the application to be accessed, and the secret code value to obtain ciphertext; and encoding the ciphertext using a preset encoding method to obtain identity authentication information.

[0096] Exemplarily, the client concatenates the application type identifier of the application to be accessed, the application identifier of the application to be accessed, and the secret value according to a preset format to form a ciphertext; then the ciphertext is encoded using a preset encoding method (such as Base64 encoding) to obtain the final identity authentication information. Assume that the application type identifier of the application to be accessed is D, the application identifier is App123, and the secret value is ENCRYPTED_VALUE. The client first concatenates the three into a ciphertext according to a preset format: D-App123-ENCRYPTED_VALUE. Then, the ciphertext is encoded using Base64 encoding to generate identity authentication information: RC1BcHAxMjMtRU5DUllQVEVEX1ZBTFVFEw==.

[0097] In this embodiment, identity authentication information is generated by splicing and encoding, ensuring the integrity and relevance of the authentication data. The splicing operation binds the type identifier, application identifier, and password value, enhancing the contextual association between the authentication information and the specific application, and preventing cross-application authentication forgery. The encoding process effectively masks the authentication data while improving data compatibility, reducing the risk of directly exposing the ciphertext content, which not only improves the security and transportability of the identity authentication information, but also optimizes the applicability of the authentication process in various scenarios.

[0098] In an exemplary embodiment, as shown in FIG. 3 , a method for identity authentication for accessing an application is provided, which is described by taking the method applied to the server 104 in FIG. 1 as an example, and includes the following steps:

[0099] Step S301, receiving an application access request and identity authentication information for an application to be accessed sent by a client;

[0100] Step S302, obtaining the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and the password value from the identity authentication information;

[0101] Step S303, query and determine the key information according to the type identifier, and decrypt the password value according to the key information to obtain the random password and timestamp information;

[0102] Step S304: Authenticate the application access request based on the key information, random password and timestamp information.

[0103] Exemplarily, the server receives a message packet containing an application access request sent by the client, and extracts identity authentication information from the message packet. The identity authentication information may include encoded ciphertext, which needs to be decoded to obtain specific authentication content. The server parses the received identity authentication information and separates the type identifier, application identifier, and secret value of the application to be accessed according to a preset format (e.g., "type identifier-application identifier-secret value"). For example, the parsed content may be: type identifier: D; application identifier: App123; secret value: ENCRYPTED_VALUE. The server distinguishes the application type according to the type identifier: if the type identifier is D (an application with session control), the key information is dynamically generated through the associated session identifier. If the type identifier is F (an application without session control), the key information corresponding to the application identifier is queried through the configuration file or configuration center. Then, the server uses the determined key information as the key, decrypts the secret value through a decryption algorithm (e.g., SM4 algorithm), and obtains plaintext data, including random secret codes and timestamp information. The server first verifies whether the timestamp information is within the allowed time window (such as the current time ±5 minutes) to determine whether the authentication information has expired; then, the random password is verified using the key information to ensure that the random password matches the key information. If the timestamp is valid and the password verification passes, the server authenticates the application access request and releases it, otherwise the request is rejected.

[0104] In this embodiment, the server effectively authenticates the client request by parsing the authentication information, dynamically querying and verifying the key information, and verifying the random password. Replay attacks are prevented by verifying the timestamp; the dynamic nature and key binding of the random password ensure the uniqueness and anti-counterfeiting capability of the authentication information. At the same time, the combination of type identification and application identification enables the authentication process to adapt to different types of applications, providing a secure, flexible and efficient authentication solution.

[0105] In an exemplary embodiment, the above-mentioned step S304 authenticates the application access request based on the key information, the random password and the timestamp information, and also includes: when the timestamp information is valid information and the random password and the key information match, determining that the authentication of the application access request is successful; when the timestamp information is invalid information, or the random password and the key information do not match, determining that the authentication of the application access request is unsuccessful.

[0106] Among them, identity authentication is to determine whether the client request is legitimate by verifying whether the timestamp information and random password meet the preset conditions.

[0107] Exemplarily, after receiving the application access request, the server verifies the timestamp information and the random password as follows: Verify the validity of the timestamp information: The server parses the timestamp information and compares it with the current system time. If the timestamp information is within the allowed time window (such as ±5 minutes of the current time), it is determined to be valid information; otherwise, it is determined to be invalid information. For example: the current time is 1690000005000 (milliseconds). The received timestamp information is 1690000000000. The difference is 5000ms, which is within the range of ±5 minutes (300,000ms), so the timestamp information is valid. Then, the server generates the expected random password based on the key information and compares it item by item with the received random password. If all key-value pairs match, the random password is determined to match the key information; otherwise, it is determined not to match.

[0108] In this embodiment, by verifying the timestamp information, the client is prevented from replaying old authentication information; by matching the random password and key information, the uniqueness and dynamic nature of the authentication information is ensured, effectively preventing forgery attacks. Combining the dual logic of timestamp and password verification, the accuracy and security of identity authentication are significantly improved. At the same time, through clear authentication result determination, the processing efficiency of the system in high-concurrency scenarios is improved.

[0109] In another exemplary embodiment, as shown in FIG4 , the present application provides an identity authentication method for accessing an application, the method comprising:

[0110] Step S401, determine whether the application is connected to the session management system. If so, execute step S402; if not, execute step S403.

[0111] Step S402: Type is D, and the session identifier is used as the seed value.

[0112] Step S403, type is F, using the value specified by the configuration center as the seed value.

[0113] Step S404, randomly select 7 numbers within the length of the seed value text, and form a long string of text in the format of "number: value;".

[0114] Step S405: Add a timestamp at the end of the long string of text to form plain text.

[0115] Step S406, using the SM4 algorithm to encrypt the plaintext with the seed value as the key to form a password value.

[0116] Step S407, concatenate in the format of "type-application ID-password value" to obtain the final ciphertext.

[0117] Step S408, Base64 encode the ciphertext to form identity authentication information.

[0118] For example, type D, Dynamic: applications with session control, that is, applications that log in to the Session, can use the Session ID to filter special characters such as "-", and then take the first 16 bits to generate the seed value SEED; type F, Fixed: for applications that do not have session control, the backend application and the server jointly maintain and record the corresponding "Application ID: SEED" in the properties configuration file or configuration center. The framework layer provides a general query interface for querying the seed value SEED based on the application ID.

[0119] After obtaining the SEED value, randomly select 7 numbers that do not exceed the text length value of SEED, and form a key-value pair with the number and the character content in SEED corresponding to each number. The 7 key-value pairs are separated by ";" and connected in series to form a long string of text. Get the milliseconds of the current client time as the timestamp, and add the timestamp to the end of the long string of text to form plaintext. Use the SM4 algorithm to encrypt the plaintext with SEED as the key to form a password value. Concatenate in the format of "type-application ID-password value" to obtain the final ciphertext. Use Base64 to encode the final ciphertext to form the final identity authentication information Token.

[0120] Furthermore, in an exemplary embodiment, as shown in FIG5 , the present application provides an identity authentication method for accessing an application, the method comprising:

[0121] Step S501, performing Base64 decoding on the identity authentication information.

[0122] Step S502, obtain the ciphertext, split the ciphertext, and obtain the password value.

[0123] Step S503, type is D, obtain the session identifier as the seed value.

[0124] Step S504, type F, obtain the seed value from the configuration center.

[0125] Step S505, decrypt the secret value using the seed value as a key to obtain plain text.

[0126] Step S506, determine whether the timestamp is valid. If so, execute step S507; if not, execute step S509.

[0127] Step S507: Check whether the key-value pair in the plain text corresponds to the seed value content. If yes, go to step S508; if not, go to step S509.

[0128] Step S508: Release the access request.

[0129] Step S509: Do not grant access request and return an exception.

[0130] Exemplarily, the parsing process of the authentication information is the reverse process of the generation process. The authentication information Token obtained in the request is Base64 decoded to obtain the ciphertext, the ciphertext is split according to "-" to obtain the password value, and the type is judged: (1) Type D: Get the Session ID as the SEED value; (2) Type F: Get the SEED value from the properties file of the configuration center.

[0131] After obtaining the SEED value, use the SEED value as the key to decrypt the password value to get the plain text. Determine whether the timestamp in the plain text is a valid Token. If it is valid, continue to determine whether the key-value pair matches the corresponding characters in the SEED value. If they match, release the request. Otherwise, intercept the request and return an exception.

[0132] In this embodiment, a new identity authentication information Token authentication method is proposed. The method is lighter, does not require the server to save the state, integrates the SM4 encryption algorithm, and has higher security and availability. In addition, Token generation supports algorithm generation and does not require requesting the server to obtain it, which relieves the pressure on the server.

[0133] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0134] Based on the same inventive concept, the embodiments of the present application also provide a variety of identity authentication devices for accessing applications for implementing the identity authentication methods for accessing applications involved above. The implementation solutions provided by these devices to solve the problems are similar to the implementation solutions recorded in the above methods, so the specific limitations in the embodiments of one or more identity authentication devices for accessing applications provided below can refer to the limitations on the identity authentication methods for accessing applications above, and will not be repeated here.

[0135] In an exemplary embodiment, as shown in FIG6 , an identity authentication device for accessing an application is provided, comprising: an application type determination module 601, a random password acquisition module 602, a plaintext encryption processing module 603, an identity authentication acquisition module 604, and an authentication request sending module 605, wherein:

[0136] An application type determination module 601 is used to determine the application type of the application to be accessed; the application type includes an application with session control and an application without session control;

[0137] The random password acquisition module 602 is used to query and determine the key information according to the application type, and extract the random password from the key information according to a preset method;

[0138] The plaintext encryption processing module 603 is used to concatenate the random secret code and the timestamp information of the current time to obtain the plaintext, and encrypt the plaintext according to the key information to obtain the secret code value;

[0139] The identity authentication acquisition module 604 is used to obtain identity authentication information according to the type identifier of the application type to be accessed, the application identifier of the application to be accessed and the password value;

[0140] The authentication request sending module 605 is used to send the application access request and identity authentication information for the application to be accessed to the server.

[0141] In one of the embodiments, the random password acquisition module 602 is further used to obtain a session identifier between the application to be accessed and the application to be accessed when the application type is an application with session control; to intercept a first preset number of valid characters in a reading order from the session identifier to obtain key information; and to obtain preset key information based on the application identifier of the application to be accessed when the application type is an application without session control.

[0142] In one embodiment, the random command acquisition module 602 is also used to use the number of characters in the key information as an upper limit of the value, and randomly determine a second preset number of serial number values ​​based on the upper limit of the value; extract the corresponding sorted target characters from the key information based on the serial number value; combine a serial number value and the corresponding target character into a key-value pair; and concatenate the second preset number of key-value pairs to obtain a random command.

[0143] In one of the embodiments, the identity authentication acquisition module 604 is further used to concatenate the application type identifier of the application to be accessed, the application identifier of the application to be accessed and the password value to obtain ciphertext; and encode the ciphertext using a preset encoding method to obtain identity authentication information.

[0144] In an exemplary embodiment, as shown in FIG. 7 , an identity authentication device for accessing an application is provided, comprising: a request authentication receiving module 701, an authentication information parsing module 702, a ciphertext decryption processing module 703, and an access request authentication module 704, wherein:

[0145] The request authentication receiving module 701 is used to receive the application access request and identity authentication information sent by the client for the application to be accessed;

[0146] The authentication information parsing module 702 is used to obtain the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and the password value from the identity authentication information;

[0147] The ciphertext decryption processing module 703 is used to query and determine the key information according to the type identifier, and decrypt the password value according to the key information to obtain the random password and timestamp information;

[0148] The access request authentication module 704 is used to perform identity authentication on the application access request according to the key information, the random password and the timestamp information.

[0149] In one of the embodiments, the access request authentication module 704 is also used to determine that the identity authentication of the application access request is successful when the timestamp information is valid information and the random password and the key information match; and to determine that the identity authentication of the application access request is unsuccessful when the timestamp information is invalid information or the random password and the key information do not match.

[0150] Each module in the above-mentioned identity authentication device for accessing applications can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0151] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG8. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, an identity authentication method for accessing an application is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0152] Those skilled in the art will understand that the structure shown in FIG. 8 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0153] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0154] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0155] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0156] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0157] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0158] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0159] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for identity authentication for accessing an application, characterized in that: The method comprises: Determine an application type of the application to be accessed; the application type includes an application with session control and an application without session control; According to the application type, query and determine the key information, and extract the random password from the key information in a preset manner; The random password and the timestamp information of the current time are concatenated to obtain a plain text, and the plain text is encrypted according to the key information to obtain a password value; Obtaining identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application, and the secret value; The application access request for the application to be accessed and the identity authentication information are sent to the server.

2. The method according to claim 1, characterized in that The querying and determining key information according to the application type includes: When the application type is the application with session control, obtaining a session identifier between the application to be accessed and the application to be accessed; From the session identifier, intercept a first preset number of valid characters in a reading order to obtain the key information; In the case that the application type is the application without session control, preset key information is queried according to the application identifier of the application to be accessed.

3. The method according to claim 1, characterized in that The step of extracting a random secret code from the key information in a preset manner includes: Taking the number of characters in the key information as the upper limit of the value, and randomly determining the second preset number of sequence number values ​​according to the upper limit of the value; According to the sequence number value, extracting the target characters of corresponding order from the key information; Combining a sequence number value and a corresponding target character into a key-value pair; The second preset number of key-value pairs are concatenated to obtain the random password.

4. The method according to claim 1, characterized in that The obtaining of identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application and the secret value includes: Concatenate the application type identifier of the application to be accessed, the application identifier of the application to be accessed and the secret value to obtain a ciphertext; The ciphertext is encoded using a preset encoding method to obtain identity authentication information.

5. A method for identity authentication for accessing an application, characterized in that: The method comprises: Receive an application access request and identity authentication information sent by a client for an application to be accessed; Obtaining, from the identity authentication information, an application identifier of the application to be accessed, a type identifier of the application type of the application to be accessed, and a secret value; According to the type identifier, query and determine the key information, and according to the key information, decrypt the password value to obtain a random password and timestamp information; The application access request is authenticated according to the key information, the random password and the timestamp information.

6. The method according to claim 5, characterized in that The performing identity authentication on the application access request according to the key information, the random password and the timestamp information includes: When the timestamp information is valid information and the random password matches the key information, determining that the identity authentication of the application access request is passed; When the timestamp information is invalid information, or the random password and the key information do not match, it is determined that the identity authentication of the application access request fails.

7. An identity authentication device for accessing an application, characterized in that: The device comprises: An application type determination module, used to determine the application type of the application to be accessed; the application type includes an application with session control and an application without session control; A random password acquisition module, used to query and determine key information according to the application type, and extract a random password from the key information in a preset manner; A plaintext encryption processing module, used to concatenate the random secret code and the timestamp information of the current time to obtain a plaintext, and encrypt the plaintext according to the key information to obtain a secret code value; An identity authentication acquisition module, used to obtain identity authentication information according to the type identifier of the application type of the to-be-accessed application, the application identifier of the to-be-accessed application and the password value; The authentication request sending module is used to send the application access request for the application to be accessed and the identity authentication information to the server.

8. An identity authentication device for accessing an application, characterized in that: The device comprises: A request authentication receiving module, used to receive an application access request and identity authentication information sent by a client for an application to be accessed; An authentication information parsing module, used to obtain the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and a password value from the identity authentication information; A ciphertext decryption processing module, used to query and determine key information according to the type identifier, and decrypt the password value according to the key information to obtain a random password and timestamp information; An access request authentication module is used to perform identity authentication on the application access request according to the key information, the random password and the timestamp information.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images