Identity authentication management method and device, equipment and medium

Abstract

The invention belongs to the technical field of identity authentication management, and particularly relates to an identity authentication management method and device, equipment and a medium. The method comprises the following steps: acquiring instruction information and current time sent by a client in real time; determining the current failure time of the current temporary identity token according to the instruction information; and managing the current temporary identity token according to the current time and the current failure time. The problem that the user repeatedly logs in the system without short-term operation can be effectively solved. And compared with a JWT blacklist technology, more system resources are saved.

Description

Technical Field

[0001] The invention belongs to the technical field of identity authentication management, and specifically relates to an identity authentication management method, device, equipment and medium. Background Art

[0002] In modern computer networks, in order to ensure the security and stability of the system, it is necessary to control and manage the identity information of each user in the system. Traditional methods mostly use identity information verification based on Cookie. However, this method has many problems, such as too little stored information, easy to be forged, and insufficient security. Therefore, in recent years, more and more permission control systems have adopted identity verification based on JWT.

[0003] JWT (JSON web token) is a distributed, stateless token suitable for distributed system authentication. It has the advantage that the legitimacy verification of JWT does not require the participation of a central node. Due to the statelessness of JWT, once issued, it cannot be discarded. JWT will always be valid before it expires. In other words, once a JWT is issued, it can only become invalid when the expiration time set by the JWT is reached. For example, if some information is stored in the payload, a new JWT is issued when the information needs to be updated. However, since the old JWT has not expired, the old JWT can still be successfully verified, but the information obtained by the business system in the JWT is outdated.

[0004] The main solution to this problem is to set up a JWT blacklist. To invalidate a JWT before its expiration date, the JWT must be added to the blacklist. This requires storing all unexpired JWTs to determine which issued JWTs are invalid, which consumes a lot of system resources to store all unexpired JWTs. Summary of the invention

[0005] In response to the above technical problems, the present invention proposes a management method, device, equipment and medium for identity authentication. The present application obtains the instruction information and current time sent by the client in real time; determines the current expiration time of the current temporary identity token according to the instruction information; and manages the current temporary identity token according to the current time and the current expiration time. It can effectively solve the problem of users repeatedly logging into the system without any operation for a short period of time. And compared with the JWT blacklist technology, it saves more system resources.

[0006] To solve the above technical problems, the technical solution adopted by the present invention includes four aspects.

[0007] In a first aspect, a method for managing identity authentication is provided, which is applicable to a server, and includes: obtaining instruction information and current time sent by a client in real time; determining a current expiration time of a current temporary identity token according to the instruction information; and managing the current temporary identity token according to the current time and the current expiration time.

[0008] In some embodiments, determining the current expiration time of the current temporary identity token according to the instruction information includes: determining the current token information according to the instruction information; parsing the current token information to obtain the current expiration time of the current temporary identity token.

[0009] In some embodiments, the managing the current temporary identity token according to the current time and the current expiration time includes: determining a current remaining duration according to the current time and the current expiration time; and managing the current temporary identity token according to the current remaining duration.

[0010] In some embodiments, the management of the current temporary identity token based on the current remaining time includes: determining whether the current remaining time is a positive value; when the current remaining time is a positive value, obtaining a preset warning time; and managing the temporary identity token based on the warning time and the current remaining time.

[0011] In some embodiments, managing the current temporary identity token based on the warning duration and the current remaining duration includes: determining whether the current remaining duration is less than or equal to the warning duration; when the current remaining duration is less than or equal to the warning duration, obtaining user information in the current temporary identity token; generating a new temporary identity token based on the user information, and assigning a new expiration time to the new temporary identity token; and sending the new temporary identity token to the client to replace the current temporary identity token of the client.

[0012] In some embodiments, the managing of the current temporary identity token according to the current remaining time also includes: when the current remaining time is a negative value, clearing the current token information and corresponding login information of the current temporary identity token; sending a re-login prompt to the client, and disconnecting the connection with the client.

[0013] In some embodiments, the method further includes: obtaining login information sent by the client; determining user information based on the login information; generating an identity token based on the user information, and sending the identity token to the client.

[0014] In the second aspect, the present application provides an identity authentication management device, including: a first acquisition module, used to acquire the instruction information and current time sent by the client in real time; a first determination module, used to determine the current expiration time of the current temporary identity token according to the instruction information; a first execution module, used to manage the current temporary identity token according to the current time and the current expiration time.

[0015] In a third aspect, the present application proposes an electronic device, comprising: a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the method described in the first aspect is performed.

[0016] In a fourth aspect, the present application proposes a storage medium, which stores a computer program that can be executed by one or more processors, and the computer program can be used to implement the method described in the first aspect.

[0017] Beneficial effects created by the present invention: The present application obtains the instruction information and current time sent by the client in real time; determines the current expiration time of the current temporary identity token according to the instruction information; and manages the current temporary identity token according to the current time and the current expiration time. It can effectively solve the problem of users repeatedly logging into the system without any operation for a short period of time. And compared with the JWT blacklist technology, it saves more system resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The scope of the present disclosure may be better understood by reading the following detailed description of exemplary embodiments in conjunction with the accompanying drawings. The drawings included are:

[0019] Figure 1 An overall flow chart of an identity authentication management method provided in an embodiment of the present application;

[0020] Figure 2 A structural block diagram of an identity authentication management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0022] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0023] If similar descriptions of "first\second\third" appear in the application documents, the following instructions will be added. In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0025] Embodiment 1:

[0026] Due to the statelessness of the existing JWT, once issued, it cannot be discarded and will always be valid before it expires. In other words, once a JWT is issued, it can only become invalid when the expiration time set by the JWT is reached. For example, if some information is stored in the payload and the information needs to be updated, a new JWT is issued. However, since the old JWT has not expired, verification can still be successful with the old JWT, but the information obtained by the business system in the JWT is outdated.

[0027] The main solution to this problem is to set up a JWT blacklist. To invalidate a JWT before its expiration date, the JWT must be added to the blacklist. This requires storing all unexpired JWTs to determine which issued JWTs are invalid, which consumes a lot of system resources to store all unexpired JWTs.

[0028] In view of the problems existing in the prior art, such as Figure 1 As shown, the present application provides an identity authentication management method, which is applied to an electronic device, and the electronic device can be a server, a mobile terminal, a computer, a cloud platform, etc. The function implemented by the device data processing provided in the embodiment of the present application can be implemented by calling a program code by a processor of the electronic device, wherein the program code can be stored in a computer storage medium, and the identity authentication management method includes:

[0029] Step S1: Obtain the instruction information and current time sent by the client in real time.

[0030] In this application, when the user enters the login information on the client, the login information will be uploaded to the server. The server will return a temporary identity token based on the login information. The temporary identity token has a short validity period. At this time, the client will use the temporary identity token as the current temporary identity token for identity authentication. Every time the user operates on the client, the server will feedback the operation instruction, the information of the current temporary identity token and the current timestamp. Therefore, in this application, the operation instruction fed back by the client and the information of the current temporary identity token are referred to as instruction information, and the current timestamp is referred to as the current time.

[0031] Step S2: Determine the current expiration time of the current temporary identity token according to the instruction information.

[0032] After the server receives the instruction information and current time fed back by the client, it will process the instruction information to obtain the token information contained therein, especially the expiration information in the token information. In this application, the expiration information is referred to as the expiration time, that is, the effective expiration time of the current temporary identity token. Since the operation instruction and token information are transmitted together in data transmission, it is necessary to process the instruction information to obtain the expiration time of the current temporary identity token.

[0033] Therefore, in some embodiments, step S2 of "determining the current expiration time of the current temporary identity token according to the instruction information" includes:

[0034] Step S21: Determine the current token information according to the instruction information.

[0035] Step S22: parsing the current token information to obtain the current expiration time of the current temporary identity token.

[0036] Since the instruction information includes the operation instruction and the token information of the current temporary token, we can directly obtain the current token information from the instruction information. After obtaining the current token information, the current token information is parsed and processed to obtain the current expiration message of the current temporary identity token from the current token information. If the parsing of the current token information cannot be completed, it means that the current temporary identity token is at risk of being tampered with. In this case, the token information corresponding to the current temporary identity token stored on the server is cleared, and the corresponding login information is cleared. At the same time, the connection with the client is disconnected, and a prompt message for re-login is sent to ensure security.

[0037] Step S3: managing the current temporary identity token according to the current time and the current expiration time.

[0038] Since temporary identity tokens have a short validity period, we can manage temporary identity tokens based on the current time and the current expiration time of the temporary identity token. Of course, the management here is not just about blocking the permissions of temporary identity tokens. Since temporary identity tokens have a short validity period, when users need to log in and use them for a long time, they need to supplement or refresh the validity period of temporary identity tokens.

[0039] Therefore, in some embodiments, step S3 "managing the current temporary identity token according to the current time and the current expiration time" includes:

[0040] Step S31: Determine the current remaining time according to the current time and the current expiration time.

[0041] Step S32: managing the current temporary identity token according to the current remaining time.

[0042] Since the identity token in this application is a temporary identity token with a short validity period, we need to manage the current temporary identity token according to the remaining duration of the temporary identity token. The management includes updating the expiration time of the temporary identity token or regenerating the temporary identity token.

[0043] Therefore, in some embodiments, step S32 "managing the current temporary identity token according to the current remaining time" includes:

[0044] Step S321: Determine whether the current remaining time is a positive value.

[0045] Step S322: When the current remaining time is a positive value, a preset warning time is obtained.

[0046] Step S323: managing the temporary identity token according to the warning duration and the current remaining duration.

[0047] Since the identity token in this application is a temporary identity token, it is easy for the user to not operate for a long time and the temporary identity token will expire and cannot be used. There will also be problems when the user is using it normally because the temporary identity token expires. Therefore, in this application, different processing strategies will be used for temporary identity tokens according to the remaining time.

[0048] When the remaining time is confirmed to be a positive value, it means that the temporary identity token has not expired. Then the warning time is obtained, where the warning time is used to warn the remaining time of the temporary identity token. Therefore, when it is found that the remaining time is less than or equal to the warning time, it means that the temporary identity token is about to expire, and the temporary identity token will be updated at this time.

[0049] Therefore, in some embodiments, step S323 "managing the temporary identity token according to the warning duration and the current remaining duration" includes:

[0050] Step S3231: Determine whether the current remaining time is less than or equal to the warning time.

[0051] Step S3232: When the current remaining duration is less than or equal to the warning duration, obtain the user information in the current temporary identity token.

[0052] Step S3233: Generate a new temporary identity token according to the user information, and assign a new expiration time to the new temporary identity token.

[0053] Step S3234: Send the new temporary identity token to the client to replace the current temporary identity token of the client.

[0054] It should be noted that this application will not actively obtain information from the client. Only when the client user performs the required operation will the relevant information be sent to the server. At this time, the server determines how to manage the temporary identity token based on the received information. In other words, if the user does not perform any operation within the time when the temporary identity token is about to expire, the server will not actively update the temporary identity token for the client.

[0055] In the present application, when it is determined that the remaining time is less than or equal to the warning information, the temporary identity token needs to be updated. In order not to affect the user's use, during the update in the present application, the user information of the user will be directly obtained from the old temporary identity token, and then a new temporary identity token will be generated based on the user information, and the new temporary identity token will be sent to the client, so that the temporary identity token in the client is replaced by the new temporary identity token, completing the update of the temporary identity token of the client. Among them, the new temporary identity token mainly re-determines a new expiration time, so that the user can use it uninterruptedly. Of course, when the remaining time is greater than the warning time, it means that the expiration time of the temporary identity token is long at this time, and there is no need to update the temporary identity token for the time being.

[0056] In some embodiments, in addition to the case where the remaining time is a positive value, there is also a case where the remaining time is a negative value, that is, the user continues to operate after the temporary identity token expires. Therefore, step S323 "manage the current temporary identity token according to the warning time and the current remaining time" also includes:

[0057] Step S3235: When the current remaining time is a negative value, a re-login prompt is sent to the client, and the connection with the client is disconnected.

[0058] If the remaining time is negative, it means that the temporary identity token has expired. In order to ensure system security, a re-login prompt will be sent to the client and the connection with the client will be disconnected, causing the client to go offline. The client can only be connected again by logging in again.

[0059] Because the management of temporary identity tokens in this application mainly includes updating temporary identity tokens and kicking clients offline, the following will explain the actions of the server at each login.

[0060] In some embodiments, the method further comprises:

[0061] Step S4: Obtain the login information sent by the client.

[0062] Step S5: Determine user information according to the login information.

[0063] Step S6: Generate a temporary identity token according to the user information, and send the temporary identity token to the client.

[0064] When logging in, the client will first enter the login information, which will be transmitted to the server. After receiving the login information, the server will determine the corresponding user information based on the login information. Then, a temporary identity token containing the user information is generated, and the expiration time of the temporary identity token is determined according to the expiration time preset by the system. Then, a temporary identity token is generated and sent to the client. For example, in this application, the expiration time can be set to 1 hour, that is, the expiration time is set from the time of successful login.

[0065] Moreover, in order to facilitate the management of the temporary identity token, a token number can also be added to the token information, and the token number is saved in the server. When a logout instruction sent by the client is detected, the token number saved by the server is cleared, so that the temporary identity token on the client becomes ineffective.

[0066] This application provides a more convenient user experience by assigning a temporary identity token to the client, and because the temporary identity token can be automatically refreshed when it is about to expire, the user does not need to manually re-login or provide other authentication information. In addition, the automatically refreshed temporary identity token can reduce the risk of users remaining logged in for a long time and improve the security of user data. In addition, the use of temporary identity tokens in this application can effectively avoid the problems of using JWT, and there is no need to consume a lot of resources to store all unexpired JWTs, saving resources. In addition, because the identity token has a shorter validity period, the risk of the client being used by others is reduced.

[0067] Embodiment 2:

[0068] Based on the foregoing embodiments, the embodiments of the present application provide an identity authentication management device, and the modules included in the device, as well as the units included in each module, can be implemented by a processor in a computer device; of course, they can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU, Central Processing Unit), a microprocessor (MPU, Microprocessor Unit), a digital signal processor (DSP, Digital Signal Processing) or a field programmable gate array (FPGA, Field Programmable Gate Array), etc.

[0069] like Figure 2 As shown, an identity authentication management device includes: a first acquisition module 1, a first determination module 2 and a first execution module 3.

[0070] The first acquisition module 1 is used to obtain the instruction information and current time sent by the client in real time. The first determination module 2 is used to determine the current expiration time of the current temporary identity token according to the instruction information. The first execution module 3 is used to manage the current temporary identity token according to the current time and the current expiration time.

[0071] In some embodiments, the first determination module 2 includes: a second determination module and a second execution module.

[0072] The second determination module is used to determine the current token information according to the instruction information. The second execution module is used to perform a parsing operation on the current token information to obtain the current expiration time of the current temporary identity token.

[0073] In some embodiments, the first execution module 3 includes: a third determination module and a third execution module.

[0074] The third determination module is used to determine the current remaining time according to the current time and the current expiration time. The third execution module is used to manage the current temporary identity token according to the current remaining time.

[0075] In some embodiments, the third execution module includes: a fourth determination module, a second acquisition module and a fourth execution module.

[0076] The fourth determination module is used to determine whether the current remaining time is a positive value. The second acquisition module is used to acquire a preset warning time when the current remaining time is a positive value. The fourth execution module is used to manage the temporary identity token according to the warning time and the current remaining time.

[0077] In some embodiments, the fourth execution module includes: a fifth execution module, a third acquisition module, a sixth execution module and a seventh execution module.

[0078] The fifth execution module is used to determine whether the current remaining time is less than or equal to the warning time. The third acquisition module is used to acquire the user information in the current temporary identity token when the current remaining time is less than or equal to the warning time. The sixth execution module is used to generate a new temporary identity token according to the user information and assign a new expiration time to the new temporary identity token. The seventh execution module is used to send the new temporary identity token to the client to replace the current temporary identity token of the client.

[0079] In some embodiments, the third execution module further includes: an eighth execution module.

[0080] The eighth execution module is used to send a re-login prompt to the client and disconnect the connection with the client when the current remaining time is a negative value.

[0081] In some embodiments, the device further includes: a fourth acquisition module, a fifth determination module and a ninth execution module.

[0082] The fourth acquisition module is used to acquire the login information sent by the client. The fifth determination module is used to determine the user information according to the login information. The ninth execution module is used to generate a temporary identity token according to the user information and send the temporary identity token to the client.

[0083] Each module in the above-mentioned identity authentication management device can be implemented in whole or in part by software, hardware, and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the device in the form of hardware, or can be stored in the memory in the processing device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules. It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0084] Embodiment 3:

[0085] The third aspect provides an electronic device, including a storage device and a processor, wherein the storage device stores a computer program, and the processor implements the steps of an identity authentication management method when executing the computer program.

[0086] Embodiment 4:

[0087] The fourth aspect provides a storage medium, which stores a computer program that can be executed by one or more processors, and the computer program can be used to implement the steps of any one of the identity authentication management methods in the first aspect.

[0088] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0089] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0090] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0091] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0092] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0093] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0094] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM, Read Only Memory), disks or optical disks, etc. Various media that can store program codes.

[0095] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a controller to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0096] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for managing identity authentication, characterized in that: include: Get the command information and current time sent by the client in real time; Determine the current expiration time of the current temporary identity token according to the instruction information; The current temporary identity token is managed according to the current time and the current expiration time.

2. The method according to claim 1, characterized in that The determining the current expiration time of the current temporary identity token according to the instruction information includes: Determine current token information according to the instruction information; The current token information is parsed to obtain the current expiration time of the current temporary identity token.

3. The method according to claim 1, characterized in that: The managing the current temporary identity token according to the current time and the current expiration time includes: Determine the current remaining time according to the current time and the current expiration time; The current temporary identity token is managed according to the current remaining time.

4. The method according to claim 3, characterized in that The managing the current temporary identity token according to the current remaining time includes: Determine whether the current remaining time is a positive value; When the current remaining time is a positive value, obtaining a preset warning time; The temporary identity token is managed according to the warning duration and the current remaining duration.

5. The method according to claim 4, characterized in that The managing the current temporary identity token according to the warning duration and the current remaining duration includes: Determine whether the current remaining time is less than or equal to the warning time; When the current remaining duration is less than or equal to the warning duration, obtaining user information in the current temporary identity token; Generate a new temporary identity token according to the user information, and assign a new expiration time to the new temporary identity token; The new temporary identity token is sent to the client to replace the current temporary identity token of the client.

6. The method according to claim 4, characterized in that The managing the current temporary identity token according to the current remaining time also includes: When the current remaining time is a negative value, a re-login prompt is sent to the client, and the connection with the client is disconnected.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: Get the login information sent by the client; Determine user information according to the login information; A temporary identity token is generated according to the user information, and the temporary identity token is sent to the client.

8. An identity authentication management device, characterized in that: include: The first acquisition module is used to obtain the instruction information and current time sent by the client in real time; A first determination module, configured to determine a current expiration time of a current temporary identity token according to the instruction information; The first execution module is configured to manage the current temporary identity token according to the current time and the current expiration time.

9. An electronic device, characterized in that: include: A memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the method according to any one of claims 1 to 7 is executed.

10. A storage medium, characterized in that: The computer program stored in the storage medium can be executed by one or more processors, and the computer program can be used to implement the method according to any one of claims 1 to 7.

Images