Identity authentication method and device for accessing application and computer device

Abstract

This application relates to an authentication method, apparatus, and computer device for accessing applications. The method includes: determining the application type of the application to be accessed; the application type includes applications with session control and applications without session control; querying and determining key information according to the application type, and extracting a random password from the key information according to a preset method; concatenating the random password with a timestamp of the current time to obtain plaintext, and encrypting the plaintext according to the key information to obtain a password value; obtaining authentication information based on the application type identifier, the application identifier, and the password value of the application to be accessed; and sending the application access request and authentication information to a server. This method can improve the efficiency of authentication processing.

Description

Technical Field

[0001] This application relates to the field of network application security technology, and in particular to an authentication method, apparatus, computer device, computer-readable storage medium, and computer program product for accessing applications. Background Technology

[0002] With the rise of interactive web applications, application systems need to manage user sessions. To distinguish users, a session ID is required. However, session IDs are not encrypted and can be forged. Attackers can use forged session IDs to attack application systems, putting pressure on the server and even crashing it.

[0003] In existing technologies, to prevent application systems from suffering CSRF (Cross-Site Request Forgery) attacks, tokens (identity tokens) are used to prevent attackers from forging identities. Tokens use cryptographic algorithms, making it impossible for attackers to forge tokens to attack servers or perform other malicious actions. However, this approach typically requires the server to maintain state and dynamically generate tokens. In high-concurrency scenarios, this can easily put pressure on server performance, resulting in low efficiency in identity authentication processing in high-concurrency environments. Summary of the Invention

[0004] Therefore, it is necessary to provide an authentication method, apparatus, computer device, computer-readable storage medium, and computer program product for access applications that can improve the efficiency of authentication processing, in order to address the aforementioned technical problems.

[0005] Firstly, this application provides an authentication method for accessing an application, including:

[0006] Determine the application type of the application to be accessed; the application type includes applications with session control and applications without session control.

[0007] Based on the application type, query and determine the key information, and extract the random password from the key information according to a preset method;

[0008] The random password and the current time timestamp are concatenated to obtain plaintext, and the plaintext is encrypted according to the key information to obtain the password value.

[0009] The identity authentication information is obtained based on the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed, and the password value;

[0010] The application access request for the application to be accessed and the identity authentication information are sent to the server.

[0011] In one embodiment, querying and determining key information based on the application type includes:

[0012] In the case where the application type is the application with session control, obtain the session identifier between the application to be accessed;

[0013] From the session identifier, a first preset number of valid characters are extracted in reading order to obtain the key information;

[0014] In the case where the application type is an application without session control, the preset key information is obtained by querying the application identifier of the application to be accessed.

[0015] In one embodiment, the step of extracting the random password from the key information according to a preset method includes:

[0016] The number of characters in the key information is taken as the upper limit of the value range, and a second preset number of sequence values ​​are randomly determined based on the upper limit of the value range;

[0017] Based on the sequence number value, extract the corresponding sorted target character from the key information;

[0018] Combine a sequence number value and its corresponding target character into a key-value pair;

[0019] By concatenating the second preset number of key-value pairs, the random password is obtained.

[0020] In one embodiment, obtaining the authentication information based on the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed, and the password value includes:

[0021] The application type identifier of the application to be accessed, the application identifier of the application to be accessed, and the password value are concatenated to obtain the ciphertext.

[0022] The encrypted text is encoded using a preset encoding method to obtain identity authentication information.

[0023] Secondly, this application provides an authentication method for accessing an application, including:

[0024] Receive application access requests and authentication information for the application to be accessed from the client;

[0025] From the identity authentication information, we obtain the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and the password value.

[0026] Based on the type identifier, query and determine the key information, and based on the key information, decrypt the password value to obtain a random password and timestamp information;

[0027] The application access request is authenticated based on the key information, the random password, and the timestamp information.

[0028] In one embodiment, the step of authenticating the application access request based on the key information, the random password, and the timestamp information includes:

[0029] If the timestamp information is valid and the random password and the key information match, the authentication of the application access request is deemed successful.

[0030] If the timestamp information is invalid, or if the random password and the key information do not match, the authentication of the application access request is determined to be unsuccessful.

[0031] Thirdly, this application also provides an authentication device for accessing an application, comprising:

[0032] The application type determination module is used to determine the application type of the application to be accessed; the application type includes applications with session control and applications without session control.

[0033] The random password acquisition module is used to query and determine key information according to the application type, and extract a random password from the key information in a preset manner;

[0034] The plaintext encryption processing module is used to concatenate the random password and the timestamp information of the current time to obtain plaintext, and to encrypt the plaintext according to the key information to obtain the password value;

[0035] The identity authentication acquisition module is used to obtain identity authentication information based on the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed, and the password value;

[0036] The request authentication sending module is used to send the application access request for the application to be accessed and the identity authentication information to the server.

[0037] Fourthly, this application also provides an authentication device for accessing an application, comprising:

[0038] The request authentication receiving module is used to receive application access requests and authentication information for the application to be accessed sent by the client.

[0039] The authentication information parsing module is used to obtain the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and the password value from the identity authentication information.

[0040] The ciphertext decryption processing module is used to query and determine key information according to the type identifier, and decrypt the password value according to the key information to obtain a random password and timestamp information;

[0041] The access request authentication module is used to authenticate the application access request based on the key information, the random password, and the timestamp information.

[0042] Fifthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0043] Determine the application type of the application to be accessed; the application type includes applications with session control and applications without session control.

[0044] Based on the application type, query and determine the key information, and extract the random password from the key information according to a preset method;

[0045] The random password and the current time timestamp are concatenated to obtain plaintext, and the plaintext is encrypted according to the key information to obtain the password value.

[0046] The identity authentication information is obtained based on the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed, and the password value;

[0047] The application access request for the application to be accessed and the identity authentication information are sent to the server.

[0048] Sixthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0049] Determine the application type of the application to be accessed; the application type includes applications with session control and applications without session control.

[0050] Based on the application type, query and determine the key information, and extract the random password from the key information according to a preset method;

[0051] The random password and the current time timestamp are concatenated to obtain plaintext, and the plaintext is encrypted according to the key information to obtain the password value.

[0052] The identity authentication information is obtained based on the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed, and the password value;

[0053] The application access request for the application to be accessed and the identity authentication information are sent to the server.

[0054] In a seventh aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0055] Determine the application type of the application to be accessed; the application type includes applications with session control and applications without session control.

[0056] Based on the application type, query and determine the key information, and extract the random password from the key information according to a preset method;

[0057] The random password and the current time timestamp are concatenated to obtain plaintext, and the plaintext is encrypted according to the key information to obtain the password value.

[0058] The identity authentication information is obtained based on the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed, and the password value;

[0059] The application access request for the application to be accessed and the identity authentication information are sent to the server.

[0060] The aforementioned authentication method, apparatus, computer equipment, computer-readable storage medium, and computer program product for accessing applications first determine the application type of the application to be accessed. This application type includes applications with session control and applications without session control. By distinguishing between "applications with session control" and "applications without session control," the system adapts to different types of needs, improving the versatility of the solution and providing a basis for determining subsequent key information, ensuring flexible adaptation to various application scenarios. Next, based on the application type, the system queries and determines the key information, and extracts a random password from the key information according to a preset method. This ensures the security and reliability of the key information source. Simultaneously, the extraction of the random password increases the dynamism of the authentication process, improves the randomness and uniqueness of the generated password, and thus enhances anti-counterfeiting capabilities. Then, the random password and the current time's timestamp are concatenated to obtain plaintext. Based on the key information, the plaintext is encrypted to obtain the password value. After receiving the timestamp, each generated password value is unique. The plaintext is encrypted using a key to ensure the security of the password value during transmission and prevent information theft or tampering. Next, based on the application type identifier, application identifier, and password value of the application to be accessed, identity authentication information is obtained. The addition of the type identifier and application identifier binds the identity authentication information to a specific application, preventing cross-application attacks, improving the integrity of the authentication information, and ensuring contextual consistency during the authentication process. Finally, the application access request for the application to be accessed and the identity authentication information are sent to the server. The client generates the identity authentication information and sends it to the server along with the access request. This reduces the server's need to maintain session state and lowers the computational and storage pressure caused by the dynamic generation and storage of identity authentication information, significantly improving the server's processing efficiency in high-concurrency scenarios while ensuring the security and integrity of the authentication information during transmission. The above method distinguishes application types (including applications with and without session control), and combines the techniques of dynamic generation of random passwords and timestamp concatenation encryption to achieve the uniqueness and anti-counterfeiting capabilities of identity authentication information. By generating authentication information on the client side, the server-side state is avoided, reducing the computational and storage pressure in high-concurrency scenarios, while improving scalability and adaptability to distributed deployment. Thus, it provides an identity authentication method that is secure, lightweight, and efficient. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is an application environment diagram of an authentication method for accessing an application in one embodiment;

[0063] Figure 2 This is a flowchart illustrating an authentication method for accessing an application in one embodiment;

[0064] Figure 3 This is a flowchart illustrating an authentication method for accessing an application in one embodiment;

[0065] Figure 4 This is a flowchart illustrating the authentication method for accessing the application in another embodiment;

[0066] Figure 5 This is a flowchart illustrating the authentication method for accessing the application in another embodiment;

[0067] Figure 6 This is a structural block diagram of an identity authentication device for accessing an application in one embodiment;

[0068] Figure 7 This is a structural block diagram of the authentication device for accessing the application in another embodiment;

[0069] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0070] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0071] The authentication method for accessing applications provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, client 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Client 102 first determines the application type of the application to be accessed, including applications with session control and those without. Based on the application type, client 102 queries and determines the key information, and extracts a random password from the key information according to a preset method. Then, it concatenates the random password with the current timestamp to obtain plaintext, and encrypts the plaintext according to the key information to obtain the password value. Based on the application type identifier, application identifier, and password value of the application to be accessed, it obtains authentication information. Finally, client 102 sends the application access request and authentication information for the application to be accessed to server 104. The client 102 can be a terminal, which can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0072] In one exemplary embodiment, such as Figure 2 As shown, an authentication method for accessing an application is provided, which is then applied to... Figure 1 Taking client 102 as an example, the explanation includes the following steps:

[0073] Step S201: Determine the application type of the application to be accessed.

[0074] Application type refers to whether the application system needs to manage and maintain the user's session state, including applications with session control and applications without session control. Applications with session control are those that maintain the user's login state and session information through a session ID; applications without session control are those that do not rely on a session ID but use other methods (such as fixed keys or dynamically generated keys) for authentication.

[0075] For example, the client determines the application type by accessing the application's configuration information or preset rules: the client queries the configuration center or a predefined interface for the type identifier of the application to be accessed; if the query result indicates that the application has session control, the client extracts the necessary information from the session ID to complete subsequent operations; if the query result indicates that the application does not have session control, the client generates authentication information using a preset key configuration or a dynamically generated key. This ensures that the client can select the appropriate key processing procedure based on the application type, providing an accurate basis for the execution of subsequent steps.

[0076] Step S202: Based on the application type, query and determine the key information, and extract the random password from the key information according to a preset method.

[0077] Key information refers to the core data required to generate identity authentication information. Key information can be the result of processing a dynamically generated session ID, or a fixed key value predefined from a configuration file or configuration center. Random password refers to a unique identifier obtained by processing the key information using a specific algorithm, used to ensure the dynamism and security of the identity authentication information.

[0078] For example, the client selects different key acquisition methods and extracts random passwords based on the application type. If the application type is "an application with session control," the client extracts the Session ID from the current session and formats it (e.g., removes special characters, truncates to a fixed length). The extracted result serves as the key information. If the application type is "an application without session control," the client queries the corresponding key information based on the application identifier by accessing the configuration center or reading the local configuration file. After obtaining the key information, the client generates a random password from the key information according to a preset algorithm or rules. Specifically, this can involve randomly selecting several characters or data segments from the key information to form the basis of the password; then combining this data with certain randomness logic for processing, such as generating key-value pairs or performing encryption operations, thereby generating a unique and secure random password. This ensures the dynamic and unpredictable nature of the password, laying the foundation for subsequent encryption operations.

[0079] Step S203: Concatenate the random password and the current time timestamp to obtain plaintext, and encrypt the plaintext according to the key information to obtain the password value.

[0080] The timestamp information refers to the current client system time, measured in milliseconds, indicating the specific time when the random password was generated.

[0081] For example, after generating the random password, the client obtains the current system's timestamp and concatenates the random password and timestamp according to a preset format to form plaintext. For instance, if the random password is 2=C;5=3;8=F and the timestamp is 16900000000000, the concatenated plaintext is 2=C;5=3;8=F16900000000000. Subsequently, the client uses an encryption algorithm (such as the SM4 algorithm) to encrypt the plaintext based on the obtained key information. The encryption process includes: using the key information as the input key for the encryption algorithm to ensure the security and consistency of each encryption operation; encrypting the plaintext to generate a password value; the encrypted password value is ciphertext that cannot be directly deciphered, possessing uniqueness and tamper-proof characteristics; and the addition of a timestamp to ensure the timeliness of the plaintext data and prevent replay attacks.

[0082] Step S204: Obtain authentication information based on the application type identifier of the application to be accessed, the application identifier of the application to be accessed, and the password value.

[0083] Among them, the type identifier is a flag used to distinguish the type of application to be accessed, indicating whether the application has session control; the application identifier is a flag used to uniquely identify the application to be accessed, such as the application ID or name; and the identity authentication information is a complete authentication credential generated by combining the above elements, which is used by the server to verify the user's identity.

[0084] For example, the client assembles authentication information according to a preset format based on the type identifier, application identifier, and password value obtained in the preceding steps. For instance, the type identifier is "D" (an application with session control). The application identifier is "App123". The password value is "ENCRYPTED_VALUE". The concatenation format of the authentication information is: D-App123-ENCRYPTED_VALUE. The client combines these elements with separators (such as "-") to form complete authentication information, ensuring the structural clarity and parsing consistency of each part. By combining the type identifier, application identifier, and password value, authentication information bound to a specific application is generated, ensuring contextual consistency in the authentication process. Simultaneously, it provides compatibility across various application scenarios, prevents cross-application attacks, and makes the transmission and verification of authentication information more secure and reliable. The authentication information, as a complete credential, provides the necessary basis for the server-side verification logic, ensuring the legality and validity of the request.

[0085] Step S205: Send the application access request and authentication information for the application to be accessed to the server.

[0086] Application access requests are user-initiated requests to access specific application resources or services, including information such as the operation target and parameters; the server side receives and verifies the service target of the user's request, and is responsible for parsing and processing the request content.

[0087] For example, after generating authentication information, the client packages it together with the application access request and sends it to the server. The specific implementation process includes: merging the content of the application access request (e.g., API call parameters, user operation target, etc.) and the authentication information into a complete request data packet; encrypting the entire data packet using a secure transmission protocol (such as HTTPS) to ensure data security and prevent eavesdropping during transmission; and sending the data packet to the specified interface on the server side of the application to be accessed. By carrying authentication information, the legitimacy of the request source is verified, providing a reliable basis for secure processing on the server side and effectively preventing unauthorized access and malicious requests.

[0088] In the aforementioned authentication method for accessing applications, firstly, the application type of the application to be accessed is determined. This includes applications with session control and those without. By distinguishing between applications with and without session control, the method adapts to different types of needs, improving the versatility of the solution and providing a basis for determining subsequent key information, ensuring flexible adaptation to various application scenarios. Next, based on the application type, the key information is queried and determined. Then, according to a preset method, a random password is extracted from the key information to ensure the security and reliability of the key information source. Simultaneously, the extraction of the random password increases the dynamism of the authentication process, improving the randomness and uniqueness of the generated password, thereby enhancing anti-counterfeiting capabilities. Finally, the random password and the current timestamp are concatenated to obtain plaintext. Based on the key information, the plaintext is encrypted to obtain the password value. After concatenating the timestamp, the generated password value is used to ensure that each password is valid. The password value is unique, and plaintext is encrypted using a key to ensure its security during transmission and prevent information theft or tampering. Next, based on the application type identifier, application identifier, and password value of the application to be accessed, authentication information is obtained. The addition of the type identifier and application identifier binds the authentication information to a specific application, preventing cross-application attacks, improving the integrity of the authentication information, and ensuring contextual consistency during the authentication process. Finally, the application access request for the application to be accessed and the authentication information are sent to the server. The client generates authentication information and sends it along with the access request to the server, reducing the server's need to maintain session state and lowering the computational and storage pressure caused by the dynamic generation and storage of authentication information. This significantly improves the server's processing efficiency in high-concurrency scenarios while ensuring the security and integrity of the authentication information during transmission. The above method distinguishes application types (including applications with and without session control), and combines the techniques of dynamic generation of random passwords and timestamp concatenation encryption to achieve the uniqueness and anti-counterfeiting capabilities of identity authentication information. By generating authentication information on the client side, the server-side state is avoided, reducing the computational and storage pressure in high-concurrency scenarios, while improving scalability and adaptability to distributed deployment. Thus, it provides an identity authentication method that is secure, lightweight, and efficient.

[0089] In an exemplary embodiment, step S202, which queries and determines key information according to the application type, further includes: if the application type is an application with session control, obtaining a session identifier between the application to be accessed; extracting a first preset number of valid characters from the session identifier in reading order to obtain key information; if the application type is an application without session control, querying and obtaining preset key information according to the application identifier of the application to be accessed.

[0090] For example, after identifying the type of application to be accessed, for applications with session control: the client extracts the Session ID associated with the application, for example, from a cookie or request header. The extracted Session ID may contain special characters, which the client formats (e.g., removing invalid characters like "-"), and truncates the first few characters according to preset rules as key information. For example, if the extracted Session ID is 123e4567-e89b-12d3-a456-426614174000, after formatting, removing special characters, and truncating the first 16 characters, the key information is generated as 123e4567e89b12d3. For applications without session control: the client obtains preset key information based on the identifier of the application to be accessed (e.g., App123) by querying the configuration center or reading the local configuration file. For example, the key information obtained through configuration query is AbcD123456EFGH.

[0091] In this embodiment, key information is obtained through dynamic or static methods, achieving flexible adaptation between key generation methods and application scenarios. In applications with session control, the dynamic extraction of key information is bound to the current session, enhancing the uniqueness and security of the authentication process. In applications without session control, a fixed key query method reduces implementation complexity and server load while ensuring the stability of the authentication process.

[0092] In an exemplary embodiment, step S202 above, which extracts a random password from the key information according to a preset method, further includes: taking the number of characters in the key information as the upper limit of the value range, and randomly determining a second preset number of sequence values ​​based on the upper limit of the value range; extracting the target characters of the corresponding order from the key information based on the sequence values; forming a key-value pair by combining a sequence value and the corresponding target character; and concatenating the second preset number of key-value pairs to obtain the random password.

[0093] For example, when the client generates a random password based on the key information, it first determines the length of the key information. For instance, the key information is AbcD123456EFGH, with 14 characters, which serves as the upper limit for random values. Then, the client randomly generates a second preset number of sequence values ​​(e.g., 4), for example, [2, 5, 9, 14]. Based on these sequence values, the corresponding characters are extracted from the key information to obtain the target character sequence b, 1, 5, H. Each sequence value is paired with its target character to form a key-value pair: 2=b, 5=1, 9=5, 14=H. Then, the client concatenates the key-value pairs using the separator ; to form the final random password: Random password: 2=b; 5=1; 9=5; 14=H.

[0094] In this embodiment, the dynamics and unpredictability of the random password are significantly enhanced by generating random serial numbers and concatenating key-value pairs. Using the key information length as an upper limit ensures the rationality of the random value range. The combination of serial numbers and target characters not only standardizes the password structure but also makes the random password highly dependent on the key information, improving the security of authentication information and further reducing the possibility of forgery.

[0095] In an exemplary embodiment, step S204 above, which obtains authentication information based on the application type identifier of the application to be accessed, the application identifier of the application to be accessed, and the password value, further includes: concatenating the application type identifier of the application to be accessed, the application identifier of the application to be accessed, and the password value to obtain ciphertext; and encoding the ciphertext using a preset encoding method to obtain authentication information.

[0096] For example, the client concatenates the application type identifier, the application identifier, and the password value of the application to be accessed according to a preset format to form ciphertext. Then, it encodes the ciphertext using a preset encoding method (such as Base64 encoding) to obtain the final authentication information. Assume the application type identifier of the application to be accessed is D, the application identifier is App123, and the password value is ENCRYPTED_VALUE. The client first concatenates the three elements into ciphertext according to the preset format: D-App123-ENCRYPTED_VALUE. Then, it encodes the ciphertext using Base64 encoding to generate the authentication information: RC1BcHAxMjMtRU5DUllQVEVEX1ZBTFVFEw==.

[0097] In this embodiment, identity authentication information is generated through concatenation and encoding, ensuring the integrity and relevance of the authentication data. The concatenation operation binds the type identifier, application identifier, and password value, enhancing the contextual association between the authentication information and the specific application and preventing cross-application authentication forgery. The encoding process improves data compatibility while effectively masking the authentication data, reducing the risk of directly exposing ciphertext content. This not only improves the security and transmissibility of identity authentication information but also optimizes the applicability of the authentication process in various scenarios.

[0098] In one exemplary embodiment, such as Figure 3 As shown, an authentication method for accessing an application is provided, which is then applied to... Figure 1 Taking a 104 error on the server side as an example, the following steps are included:

[0099] Step S301: Receive the application access request and authentication information for the application to be accessed sent by the client;

[0100] Step S302: Obtain the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and the password value from the identity authentication information;

[0101] Step S303: Based on the type identifier, query and determine the key information, and based on the key information, decrypt the password value to obtain a random password and timestamp information;

[0102] Step S304: Authenticate the application access request based on the key information, random password, and timestamp information.

[0103] For example, the server receives a message packet containing an application access request from the client and extracts authentication information from the message packet. The authentication information may include encoded ciphertext, which needs to be decoded to obtain the specific authentication content. The server parses the received authentication information and separates the application's type identifier, application identifier, and password value according to a preset format (e.g., "type identifier-application identifier-password value"). For example, the parsed content might be: Type identifier: D; Application identifier: App123; Password value: ENCRYPTED_VALUE. The server distinguishes the application type based on the type identifier: if the type identifier is D (an application with session control), it dynamically generates key information using the associated session identifier. If the type identifier is F (an application without session control), it queries the key information corresponding to the application identifier through a configuration file or configuration center. Then, the server uses the determined key information as the key and decrypts the password value using a decryption algorithm (such as the SM4 algorithm) to obtain plaintext data, including a random password and timestamp information. The server first verifies whether the timestamp is within the allowed time window (e.g., current time ± 5 minutes) to determine if the authentication information has expired. Then, it uses the key information to verify the random password, ensuring a match between the random password and the key information. If the timestamp is valid and the password verification passes, the server authenticates the application access request and allows it; otherwise, it rejects the request.

[0104] In this embodiment, by parsing identity authentication information, dynamically querying and verifying key information, and verifying random passwords, the server effectively authenticates client requests. Timestamp verification prevents replay attacks; the dynamism of the random password and the key binding ensure the uniqueness and anti-counterfeiting capabilities of the authentication information. Furthermore, the combination of type identifiers and application identifiers allows the authentication process to adapt to different types of applications, providing a secure, flexible, and efficient identity authentication solution.

[0105] In an exemplary embodiment, step S304, which authenticates the application access request based on the key information, random password, and timestamp information, further includes: determining that the application access request has passed authentication if the timestamp information is valid and the random password and key information match; and determining that the application access request has failed authentication if the timestamp information is invalid or the random password and key information do not match.

[0106] Among them, identity authentication is to determine whether the client request is legitimate by verifying whether the timestamp information and random password meet the preset conditions.

[0107] For example, after receiving an application access request, the server performs the following checks on the timestamp information and the random password: Verifying the validity of the timestamp information: The server parses the timestamp information and compares it with the current system time. If the timestamp information is within the allowed time window (e.g., current time ± 5 minutes), it is considered valid; otherwise, it is considered invalid. For example: The current time is 1690000005000 (milliseconds). The received timestamp information is 1690000000000. The difference is 5000ms, which is within ± 5 minutes (300,000ms), therefore the timestamp information is valid. Then, the server generates the expected random password based on the key information and compares it item by item with the received random password. If all key-value pairs match, the random password is considered to match the key information; otherwise, it is considered not to match.

[0108] In this embodiment, verifying the timestamp information prevents the client from replaying old authentication information; matching and verifying the random password and key information ensures the uniqueness and dynamism of the authentication information, effectively preventing forgery attacks. Combining the dual logic of timestamp and password verification significantly improves the accuracy and security of identity authentication, while clear authentication result determination enhances the system's processing efficiency in high-concurrency scenarios.

[0109] In another exemplary embodiment, such as Figure 4 As shown, this application provides an authentication method for accessing an application, the method comprising:

[0110] Step S401: Determine whether the application is connected to the session management system. If yes, proceed to step S402; otherwise, proceed to step S403.

[0111] Step S402, type D, use the session identifier as the seed value.

[0112] Step S403, type F, use the value specified in the configuration center as the seed value.

[0113] Step S404: Randomly select 7 numbers within the length of the seed value text and form a long text string in the format of "number:value;".

[0114] Step S405: Add a timestamp to the end of the long text string to form plaintext.

[0115] Step S406: Use the SM4 algorithm with the seed value as the key to encrypt the plaintext and form the secret code value.

[0116] Step S407: Concatenate the data according to the format "Type-Application ID-Password Value" to obtain the final ciphertext.

[0117] Step S408: Base64 encode the ciphertext to form authentication information.

[0118] For example, type D, Dynamic: Applications with session control, i.e., login sessions, can use the session ID to filter special characters such as "-", and then take the first 16 characters to generate the seed value SEED; type F, Fixed: For applications without session control, the backend application maintains and records the corresponding "Application ID: SEED" in the properties configuration file or configuration center together with the server. The framework layer provides a general query interface to query the seed value SEED based on the application ID.

[0119] After obtaining the SEED value, seven random numbers (not exceeding the text length) are selected from the SEED. Each number is paired with a corresponding numbered character from the SEED to form a key-value pair. These seven key-value pairs are separated by semicolons (;) and concatenated to form a long text string. The current client time (in milliseconds) is used as a timestamp, which is appended to the end of the long text string to form plaintext. The plaintext is encrypted using the SM4 algorithm with the SEED as the key to form a password value. This password value is then concatenated according to the format "Type-Application ID-Password Value" to obtain the final ciphertext. Finally, the final ciphertext is encoded using Base64 to form the final authentication token.

[0120] Furthermore, in an exemplary embodiment, such as Figure 5 As shown, this application provides an authentication method for accessing an application, the method comprising:

[0121] Step S501: Perform Base64 decoding on the identity authentication information.

[0122] Step S502: Obtain the ciphertext, split the ciphertext, and obtain the password value.

[0123] Step S503, type D, obtain the session identifier as the seed value.

[0124] Step S504, type F, obtain seed value from configuration center.

[0125] Step S505: Decrypt the password value using the seed value as the key to obtain the plaintext.

[0126] Step S506: Determine if the timestamp is valid. If yes, proceed to step S507; otherwise, proceed to step S509.

[0127] Step S507: Check if the key-value pairs in the plaintext correspond to the seed value. If yes, proceed to step S508; if no, proceed to step S509.

[0128] Step S508: Allow the access request.

[0129] Step S509: Deny access requests and return an exception.

[0130] For example, the parsing process of identity authentication information is the reverse process of the generation process. The identity authentication information Token obtained in the request is Base64 decoded to obtain ciphertext. The ciphertext is split according to "-" to obtain the secret code value, and the type is judged: (1) Type D: the Session ID is obtained as the SEED value; (2) Type F: the SEED value is obtained from the properties file in the configuration center.

[0131] After obtaining the SEED value, the key is used to decrypt the password value to obtain the plaintext. The timestamp in the plaintext is checked to see if it is a valid token. If it is valid, the key-value pair is checked to see if it matches the corresponding character in the SEED value. If they match, the request is allowed; otherwise, the request is blocked and an exception is returned.

[0132] This embodiment proposes a novel token authentication method for identity authentication information. This method is more lightweight, does not require server-side state storage, and incorporates the SM4 encryption algorithm, resulting in higher security and availability. Furthermore, token generation supports algorithmic generation, eliminating the need to request tokens from the server and reducing server load.

[0133] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0134] Based on the same inventive concept, embodiments of this application also provide various identity authentication devices for accessing applications to implement the aforementioned identity authentication methods. The solutions provided by these devices are similar to those described in the methods above. Therefore, the specific limitations of one or more identity authentication device embodiments for accessing applications provided below can be found in the limitations of the identity authentication methods for accessing applications described above, and will not be repeated here.

[0135] In one exemplary embodiment, such as Figure 6 As shown, an authentication device for accessing an application is provided, comprising: an application type determination module 601, a random password acquisition module 602, a plaintext encryption processing module 603, an identity authentication acquisition module 604, and an authentication request sending module 605, wherein:

[0136] Application type determination module 601 is used to determine the application type of the application to be accessed; the application type includes applications with session control and applications without session control.

[0137] The random password acquisition module 602 is used to query and determine key information according to the application type, and extract random passwords from the key information according to a preset method;

[0138] The plaintext encryption processing module 603 is used to concatenate the random password and the timestamp information of the current time to obtain plaintext, and to encrypt the plaintext according to the key information to obtain the password value;

[0139] The identity authentication acquisition module 604 is used to obtain identity authentication information based on the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed, and the password value.

[0140] The request authentication sending module 605 is used to send the application access request and identity authentication information for the application to be accessed to the server.

[0141] In one embodiment, the random password acquisition module 602 is further configured to, when the application type is an application with session control, acquire a session identifier between itself and the application to be accessed; extract a first preset number of valid characters from the session identifier in reading order to obtain key information; and when the application type is an application without session control, query the preset key information based on the application identifier of the application to be accessed.

[0142] In one embodiment, the random password acquisition module 602 is further configured to use the number of characters in the key information as the upper limit of the value range, and randomly determine a second preset number of sequence values ​​based on the upper limit of the value range; extract the target characters of the corresponding order from the key information based on the sequence values; form a key-value pair by combining a sequence value and the corresponding target character; and concatenate the second preset number of key-value pairs to obtain the random password.

[0143] In one embodiment, the identity authentication acquisition module 604 is further configured to concatenate the application type identifier of the application to be accessed, the application identifier of the application to be accessed, and the password value to obtain ciphertext; and to encode the ciphertext using a preset encoding method to obtain identity authentication information.

[0144] In one exemplary embodiment, such as Figure 7 As shown, an authentication device for accessing an application is provided, comprising: an authentication request receiving module 701, an authentication information parsing module 702, an ciphertext decryption processing module 703, and an access request authentication module 704, wherein:

[0145] The authentication request receiving module 701 is used to receive the application access request and authentication information for the application to be accessed sent by the client.

[0146] The authentication information parsing module 702 is used to obtain the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and the password value from the identity authentication information.

[0147] The ciphertext decryption processing module 703 is used to query and determine the key information according to the type identifier, and decrypt the password value according to the key information to obtain a random password and timestamp information;

[0148] The access request authentication module 704 is used to authenticate the application access request based on key information, random password and timestamp information.

[0149] In one embodiment, the access request authentication module 704 is further configured to determine that the application access request has passed authentication if the timestamp information is valid and the random password and key information match; and to determine that the application access request has failed authentication if the timestamp information is invalid or the random password and key information do not match.

[0150] The modules in the aforementioned authentication device for access applications can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0151] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements an authentication method for accessing applications. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0152] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0153] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0154] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0155] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0156] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0157] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0158] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0159] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for authentication when accessing an application, characterized in that, The method includes: Determine the application type of the application to be accessed; the application type includes applications with session control and applications without session control. Based on the application type, query and determine key information; further including: when the application type is the application with session control, obtain the session identifier between the application to be accessed; extract a first preset number of valid characters from the session identifier in reading order to obtain the key information; when the application type is the application without session control, query and obtain preset key information based on the application identifier of the application to be accessed. According to a preset method, a random password is extracted from the key information; The random password and the current time timestamp are concatenated to obtain plaintext, and the plaintext is encrypted according to the key information to obtain the password value. The identity authentication information is obtained based on the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed, and the password value; The application access request for the application to be accessed and the identity authentication information are sent to the server.

2. The method according to claim 1, characterized in that, The step of extracting a random password from the key information according to a preset method includes: The number of characters in the key information is taken as the upper limit of the value range, and a second preset number of sequence values ​​are randomly determined based on the upper limit of the value range; Based on the sequence number value, extract the corresponding sorted target character from the key information; Combine a sequence number value and its corresponding target character into a key-value pair; By concatenating the second preset number of key-value pairs, the random password is obtained.

3. The method according to claim 1, characterized in that, The step of obtaining authentication information based on the application type identifier of the application to be accessed, the application identifier of the application to be accessed, and the password value includes: The application type identifier of the application to be accessed, the application identifier of the application to be accessed, and the password value are concatenated to obtain the ciphertext. The encrypted text is encoded using a preset encoding method to obtain identity authentication information.

4. A method for authentication when accessing an application, characterized in that, The method includes: Receive application access requests and authentication information for the application to be accessed from the client; From the identity authentication information, the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and the password value are obtained; the application type includes applications with session control and applications without session control; Based on the type identifier, query and determine key information; further including: when the application type corresponding to the type identifier is the application with session control, obtain the session identifier between the application to be accessed; extract a first preset number of valid characters from the session identifier in reading order to obtain the key information; when the application type corresponding to the type identifier is the application without session control, query and obtain preset key information based on the application identifier of the application to be accessed. Based on the key information, the password value is decrypted to obtain a random password and timestamp information; The application access request is authenticated based on the key information, the random password, and the timestamp information.

5. The method according to claim 4, characterized in that, The step of authenticating the application access request based on the key information, the random password, and the timestamp information includes: If the timestamp information is valid and the random password and the key information match, the authentication of the application access request is deemed successful. If the timestamp information is invalid, or if the random password and the key information do not match, the authentication of the application access request is determined to be unsuccessful.

6. An authentication device for accessing an application, characterized in that, The device includes: The application type determination module is used to determine the application type of the application to be accessed; the application type includes applications with session control and applications without session control. The random password acquisition module is used to query and determine key information according to the application type, and extract a random password from the key information according to a preset method; The plaintext encryption processing module is used to concatenate the random password and the timestamp information of the current time to obtain plaintext, and to encrypt the plaintext according to the key information to obtain the password value; The identity authentication acquisition module is used to obtain identity authentication information based on the type identifier of the application type of the application to be accessed, the application identifier of the application to be accessed, and the password value; The request authentication sending module is used to send the application access request for the application to be accessed and the identity authentication information to the server. The random password acquisition module is further configured to, when the application type is the application with session control, acquire a session identifier with the application to be accessed; extract a first preset number of valid characters from the session identifier in reading order to obtain the key information; and when the application type is the application without session control, query the preset key information based on the application identifier of the application to be accessed.

7. The apparatus according to claim 6, characterized in that, The random password acquisition module is further configured to use the number of characters in the key information as the upper limit of the value range, and randomly determine a second preset number of sequence values ​​based on the upper limit of the value range; Based on the sequence number value, extract the target character corresponding to the sorted sequence from the key information; combine a sequence number value and the corresponding target character to form a key-value pair; concatenate the second preset number of key-value pairs to obtain the random password.

8. An authentication device for accessing an application, characterized in that, The device includes: The request authentication receiving module is used to receive application access requests and authentication information for the application to be accessed sent by the client. The authentication information parsing module is used to obtain the application identifier of the application to be accessed, the type identifier of the application type of the application to be accessed, and the password value from the identity authentication information; the application type includes applications with session control and applications without session control; The ciphertext decryption processing module is used to query and determine key information according to the type identifier, and decrypt the password value according to the key information to obtain a random password and timestamp information; The access request authentication module is used to authenticate the application access request based on the key information, the random password, and the timestamp information. The encrypted decryption processing module is further configured to: obtain a session identifier between itself and the application to be accessed when the application type corresponding to the type identifier is the application with session control; extract a first preset number of valid characters from the session identifier in reading order to obtain the key information; and query the preset key information according to the application identifier of the application to be accessed when the application type corresponding to the type identifier is the application without session control.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images