Access request verification method and device based on credential

Abstract

The invention provides an access request verification method and device based on credentials, and relates to the technical field of data processing, and the method comprises the steps: receiving a credential application request initiated by a client; judging whether the credential application request meets a validity requirement, and if yes, sending the credential application request to a credential system; dynamically generating a user credential according to the credential application request, and forwarding the user credential to the client through the server; the client carries the user credential to initiate a resource access request to the server; forwarding the user credential to a credential system, verifying whether the user credential is valid, and if yes, obtaining an association rule set corresponding to the user credential; verifying the resource access request by using a rule engine, judging whether the resource access request meets the requirement of an association rule set, if so, passing the resource access request of the client under the constraint of a credential request, and recording an operation log; otherwise, refusing the resource access request.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method and device for authenticating an access request based on credentials. Background Art

[0002] With the rapid development of Internet technology, WEB systems have gradually evolved from traditional monolithic application architectures to distributed, microservice architectures. The diversification of user needs and the increase in access frequency have led to the need for more efficient front-end and back-end interaction methods in large Internet systems. In these systems, users can often directly access some functions without logging in, which improves the user experience and lowers the access threshold. At the same time, the front-end and back-end realize real-time interaction of data and business logic through network communication. Especially in the open Internet environment, the front-end requests are directly directed to the public network server interface. While this design improves the openness of the system and user convenience, it also puts forward new requirements and challenges for the secure interaction of the front-end and back-end in non-login scenarios.

[0003] In this non-login access mode, front-end users can call some business functions without identity authentication, which is common in scenarios such as public data query and browsing operations. In this way, the system can provide advantages such as fast access and simplified operation, and meet users' needs for fast access to information. To ensure the interaction stability and service response speed in this mode, the system usually relies on standardized communication protocols and high concurrent processing capabilities, which further improves the flexibility of the service and user experience.

[0004] However, the front-end and back-end interactive interfaces are directly exposed to the Internet, and any user can easily initiate a request to access these interfaces. There is a lack of effective permission control, which leads to data leakage. At the same time, open interfaces are vulnerable to abuse by malicious users, which increases resource consumption and increases the risk of service paralysis. Summary of the invention

[0005] In order to solve the technical problem that the interactive interfaces of the front-end and back-end are directly exposed to the Internet, any user can easily initiate a request to access these interfaces, lack of effective authority control, and thus lead to data leakage. At the same time, the open interfaces are easily abused by malicious users, thereby increasing resource consumption and increasing the risk of service paralysis, the present invention provides a credential-based access request verification method and device.

[0006] The technical solution provided by the embodiment of the present invention is as follows:

[0007] First aspect:

[0008] An embodiment of the present invention provides a credential-based access request verification method, which is applied to a credential verification platform, wherein the credential verification platform includes a client, a server, and a credential system connected in sequence; the method includes:

[0009] S1: receiving a credential application request initiated by a client, wherein the credential application request includes user information and credential type;

[0010] S2: Determine whether the credential application request meets the validity requirement, and if so, send the credential application request to the credential system;

[0011] S3: dynamically generate user credentials according to the credential application request, and forward them to the client through the server;

[0012] S4: The client sends a resource access request to the server with the user credentials;

[0013] S5: forwarding the user credentials to the credential system to verify whether the user credentials are valid, if so, proceeding to the next step, otherwise, rejecting the resource access request;

[0014] S6: Obtaining a set of association rules corresponding to the user credentials;

[0015] S7: Using a rule engine to verify the resource access request to determine whether the resource access request meets the requirements of the association rule set, if so, proceed to the next step, otherwise, reject the resource access request;

[0016] S8: Under the constraints of the credential request, the resource access request of the client is approved and an operation log is recorded.

[0017] Second aspect:

[0018] An embodiment of the present invention provides a credential-based access request verification device, comprising:

[0019] An accepting module, configured to receive a credential application request initiated by a client, wherein the credential application request includes user information and credential type;

[0020] A determination module, used to determine whether the credential application request meets the validity requirement, and if so, send the credential application request to the credential system;

[0021] A generating module, used to dynamically generate user credentials according to the credential application request, and forward the credentials to the client through the server;

[0022] An initiating module, used for the client to initiate a resource access request to the server with the user credentials;

[0023] A verification module, used to forward the user credentials to the credential system, verify whether the user credentials are valid, and if so, obtain the module, otherwise, reject the resource access request;

[0024] An acquisition module, used to acquire a set of association rules corresponding to the user credentials;

[0025] A verification module, used to verify the resource access request using a rule engine to determine whether the resource access request meets the requirements of the association rule set, and if so, enter the recording module, otherwise, reject the resource access request;

[0026] A recording module is used to approve the resource access request of the client under the constraint of the credential request and record an operation log.

[0027] The third aspect:

[0028] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the credential-based access request verification method as described in the first aspect is implemented.

[0029] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0030] (1) In the present invention, the validity of the credential application request is judged to ensure that only legitimate requests can be processed; at the same time, by verifying the validity of the user credentials, it is ensured that only authorized users are allowed to access sensitive data, preventing unauthorized users from directly accessing the interface, thereby reducing the risk of data leakage.

[0031] (2) In the present invention, credentials are dynamically generated through credential application requests to ensure that each request is initiated by a legitimate user; at the same time, requests are verified through a rule engine to ensure that only access that meets specific rules can be passed, thereby reducing the resource occupation of malicious requests, and recording operation logs to help track malicious behavior, further enhancing the system's protection capabilities and reducing the risk of service paralysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 A flowchart of a credential-based access request verification method provided by an embodiment of the present invention;

[0034] Figure 2 A schematic diagram of the structure of a credential verification platform provided by an embodiment of the present invention;

[0035] Figure 3 A schematic diagram of the structure of a credential-based access request verification device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0037] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0038] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0039] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0040] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0041] Reference Manual Attached Figure 1 , showing a flow chart of a credential-based access request verification method provided by an embodiment of the present invention.

[0042] Reference Manual Attached Figure 2 , showing a structural diagram of a credential verification platform provided by an embodiment of the present invention.

[0043] The embodiment of the present invention provides a method for verifying access request based on credentials, which can be implemented by a device for verifying access request based on credentials, which can be a terminal or a server. The processing flow of the method for verifying access request based on credentials can include the following steps:

[0044] S1: Receive a credential application request initiated by a client, wherein the credential application request includes user information and credential type.

[0045] Among them, the credential application request is a request initiated by the client in the present invention, which is intended to obtain user credentials generated by the system for subsequent resource access. The content of the credential application request includes the user's identity information and the type of credentials required, which are used to verify the legitimacy of the request and generate credentials that meet business needs.

[0046] In a possible implementation, the user information specifically includes: a mobile phone number, a WeChat application ID, a WeChat user unique ID, and a WeChat unified user ID.

[0047] Specifically, the client applies to the business system Server and carries relevant information:

[0048] Business code: The enumeration needs to be pre-defined and registered, and can be considered as the type of credential;

[0049] Carry user information as much as possible, such as mobile phone number, WeChat appid+openid, and WeChat unionid.

[0050] In the present invention, by carrying rich user information (such as mobile phone number, WeChat appid, openid, unionid, etc.), the system can more accurately identify the identity of the requesting user, and multiple identity information verification reduces the risk of credentials being forged or abused, ensuring that credentials are only granted to real and legitimate users. At the same time, through precise user identity authentication and credential type restrictions, malicious requests can be effectively prevented from abusing interface resources, thereby reducing unnecessary system burdens and enhancing data security.

[0051] S2: Determine whether the credential application request meets the validity requirements. If so, send the credential application request to the credential system.

[0052] In the present invention, through validity judgment, unauthorized or illegal requests can be intercepted to prevent the interface from being abused by malicious users. This preliminary verification mechanism reduces unnecessary resource occupation, reduces the risk of system attacks or malicious resource consumption, and ensures that the credential generation process is more accurate and reliable.

[0053] S3: Dynamically generates user credentials based on the credential application request and forwards them to the client through the server.

[0054] Among them, user credentials are the key elements used to identify and authorize users in the present invention. Through credentials, the system can ensure that only legitimate users can access specific resources. User credentials are dynamically generated in the credential system according to the user's credential application request, and have specific permissions and usage restrictions, which are used to control the user's access rights in the non-login scenario.

[0055] In a possible implementation, S3 specifically includes:

[0056] S301: Parse the credential application request through the credential system to obtain the business type corresponding to the credential application request.

[0057] S302: Match the corresponding association rule set according to the business type.

[0058] Among them, the association rule set is a rule set used in the present invention to control user credentials and resource access. Through these rule sets, the generation and use of user credentials can be finely managed to ensure that the credentials and resource access requests meet the security and business requirements of the system. The association rule set includes a set of public rules and private rules, which are used to limit the scope of use, number of uses, and applicable scenarios of credentials to ensure the security and stability of system resources.

[0059] In the present invention, by parsing the credential application request and matching the associated rule set, the credential generation process is ensured to be strictly constrained. At the same time, by matching the business type with the associated rule set, the system can flexibly generate user credentials with specific permissions according to different business scenarios to meet complex business needs.

[0060] S303: extracting public rules and private rules from the association rule set respectively.

[0061] S304: When the public rules and private rules are met, user credentials are generated and forwarded to the client through the server.

[0062] In a possible implementation, the public rules specifically include: expiration time and maximum number of uses. The private rules include: order number, tenant number, terminal type and service blacklist.

[0063] In the present invention, the verification steps of public rules and private rules can effectively screen illegal requests and prevent unqualified credentials from being generated, thereby ensuring the legitimacy and security of the credentials.

[0064] In a possible implementation, the user credentials specifically include:

[0065] Credential ID.

[0066] The time when the credential was generated.

[0067] Credential expiration time.

[0068] The maximum number of times a credential can be used.

[0069] The number of times the credential has been used so far.

[0070] and credential business type.

[0071] For example: "CredentialID":"1ab93fd1bda14a94", credential unique identifier, 16-bit uuid;

[0072] "IssuedTime":"20241023110000", the time when the credential was generated;

[0073] "ExpireTime":"20241123000000", credential expiration time;

[0074] "MaxUses": 10, the maximum number of uses allowed;

[0075] "CurrentUses": 0, the current number of times used;

[0076] "BusiType":"BUSI_SHARE_ORDER" is based on the business type, enumerated and defined in advance.

[0077] In summary, this design ensures the security, sophistication, and flexibility of the credential generation process. It not only prevents credential abuse and resource consumption, but also meets the access control requirements in multiple business scenarios, while providing strong data support for tracking and auditing.

[0078] S4: The client sends a resource access request to the server with the user credentials.

[0079] S5: Forward the user credentials to the credential system to verify whether the user credentials are valid. If so, proceed to the next step; otherwise, deny the resource access request.

[0080] Among them, the credential system is responsible for generating, managing and verifying user credentials, thereby achieving refined control over user access rights. The main functions of the credential system include receiving credential application requests, dynamically generating user credentials that meet business needs, matching and applying association rule sets, and verifying the validity of credentials in resource access requests.

[0081] It should be noted that the credential system verifies through credentials (tickets) without the need to log in.

[0082] In the present invention, the credential system can generate credentials of different permissions according to business needs, and each credential has a specific validity period and usage restrictions. In this way, the user's access rights can be strictly limited without the need for login credentials, thereby ensuring security and meeting the diverse needs of the business. At the same time, the credential system verifies whether the credentials of each resource request are valid, and only requests that pass the verification can obtain resources. This method can prevent unauthorized access and reduce the risk of data leakage.

[0083] S6: Obtain a set of association rules corresponding to the user credentials.

[0084] S7: Use the rule engine to verify the resource access request to determine whether the resource access request meets the requirements of the associated rule set. If so, proceed to the next step; otherwise, reject the resource access request.

[0085] In a possible implementation, S7 specifically includes:

[0086] Number each association rule in the association rule set.

[0087] Verify the association rules of each number in turn.

[0088] When all association rules in the association set pass the verification, it is determined that the resource access request passes the verification; otherwise, it is determined that the resource access request fails the verification.

[0089] For example, using Chinese medicine prescription sharing as user credentials, we can obtain association rules, such as Rule 1: Orders with id=1000 can be accessed; Rule 2: Accessible time interval-start time; Rule 3: Accessible time interval-end time; Rule 4: Doctors with id=1 can access; Rule 5: Patients with id=2 can access; Rule 6: IP is not allowed to access abroad; The Chinese medicine prescription sharing operation can be completed only when all these rules are met.

[0090] In the present invention, checking each rule in the associated rule set one by one can ensure that the resource access request meets the preset security requirements, avoid unauthorized requests bypassing the control, and prevent the leakage of sensitive data and the abuse of resources. At the same time, each rule corresponds to an independent access condition, and the rule engine verifies these conditions one by one to ensure that the request meets the requirements of all associated rules. In this way, more refined management can be achieved in resource access control, so that different users or roles can only access resources when they meet the conditions.

[0091] Furthermore, by numbering the rules and verifying them one by one, the rule set can be easily managed and adjusted. When business needs or security policies change, only individual rules need to be added or modified without reconstructing the entire verification process, which facilitates the flexible expansion of the system. At the same time, through the combination of multiple rules, it can be ensured that only users who meet all the conditions can perform operations at a specific time, with a specific identity and within an IP range, and sharing permissions can be precisely controlled.

[0092] S8: Under the constraints of the credential request, the client's resource access request is approved and the operation log is recorded.

[0093] In the present invention, by recording operation logs under credential constraints, not only can the traceability and security monitoring of operations be achieved, but also valuable data support is provided for system optimization, compliance satisfaction and troubleshooting, which significantly enhances the security and maintainability of the system.

[0094] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0095] (1) In the present invention, the validity of the credential application request is judged to ensure that only legitimate requests can be processed; at the same time, by verifying the validity of the user credentials, it is ensured that only authorized users are allowed to access sensitive data, preventing unauthorized users from directly accessing the interface, thereby reducing the risk of data leakage.

[0096] (2) In the present invention, credentials are dynamically generated through credential application requests to ensure that each request is initiated by a legitimate user; at the same time, requests are verified through a rule engine to ensure that only access that meets specific rules can be passed, thereby reducing the resource occupation of malicious requests, and recording operation logs to help track malicious behavior, further enhancing the system's protection capabilities and reducing the risk of service paralysis.

[0097] Reference Manual Attached Figure 3 , showing a schematic diagram of the structure of a credential-based access request verification device provided by the present invention.

[0098] The present invention further provides a credential-based access request verification device 20, which is applied to the above-mentioned credential-based access request verification method, comprising:

[0099] The receiving module is used to receive a credential application request initiated by a client, wherein the credential application request includes user information and credential type;

[0100] A judgment module, used to judge whether the credential application request meets the validity requirement, and if so, send the credential application request to the credential system;

[0101] The generation module is used to dynamically generate user credentials based on the credential application request and forward them to the client through the server;

[0102] The initiation module is used by the client to initiate a resource access request to the server with user credentials;

[0103] The verification module is used to forward the user credentials to the credential system to verify whether the user credentials are valid. If so, it enters the acquisition module; otherwise, it denies the resource access request;

[0104] An acquisition module, used to acquire a set of association rules corresponding to user credentials;

[0105] The verification module is used to verify the resource access request using the rule engine to determine whether the resource access request meets the requirements of the associated rule set. If so, it enters the recording module; otherwise, the resource access request is rejected;

[0106] The recording module is used to pass the client's resource access request under the constraints of the credential request and record the operation log.

[0107] In a possible implementation, the user information specifically includes: a mobile phone number, a WeChat application ID, a WeChat user unique ID, and a WeChat unified user ID.

[0108] In one possible implementation, the generation module is used to

[0109] Parsing the credential application request through the credential system to obtain the business type corresponding to the credential application request;

[0110] Match the corresponding association rule set according to the business type;

[0111] Extracting public rules and private rules from the association rule set respectively;

[0112] When public and private rules are met, user credentials are generated and forwarded to the client through the server.

[0113] In a possible implementation, the public rules specifically include: expiration time and maximum number of uses; the private rules include: order number, tenant number, terminal type and service blacklist.

[0114] In a possible implementation, the user credentials specifically include:

[0115] Credential ID;

[0116] Credential generation time;

[0117] Credential expiration time;

[0118] Maximum number of times a credential can be used;

[0119] The number of times the credential has been used so far;

[0120] and credential business type.

[0121] In a possible implementation, the verification module is used to:

[0122] Numbering each association rule in the association rule set;

[0123] Verify the association rules of each number in turn;

[0124] When all association rules in the association set pass the verification, it is determined that the resource access request passes the verification; otherwise, it is determined that the resource access request fails the verification.

[0125] The credential-based access request verification device 20 provided in the present invention can execute the above-mentioned credential-based access request verification method and achieve the same or similar technical effects. To avoid repetition, the present invention will not go into details.

[0126] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0127] (1) In the present invention, the validity of the credential application request is judged to ensure that only legitimate requests can be processed; at the same time, by verifying the validity of the user credentials, it is ensured that only authorized users are allowed to access sensitive data, preventing unauthorized users from directly accessing the interface, thereby reducing the risk of data leakage.

[0128] (2) In the present invention, credentials are dynamically generated through credential application requests to ensure that each request is initiated by a legitimate user; at the same time, requests are verified through a rule engine to ensure that only access that meets specific rules can be passed, thereby reducing the resource occupation of malicious requests, and recording operation logs to help track malicious behavior, further enhancing the system's protection capabilities and reducing the risk of service paralysis.

[0129] It should be understood that the processor in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0130] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0131] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0132] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0133] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0134] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0135] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0136] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0137] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0138] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0139] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0140] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other media that can store program codes.

[0141] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the credential-based access request verification method described in the method embodiment is implemented.

[0142] A computer-readable storage medium provided by the present invention can implement the steps and effects of the credential-based access request verification method of the above method embodiment. To avoid repetition, the present invention will not go into details.

[0143] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0144] (1) In the present invention, the validity of the credential application request is judged to ensure that only legitimate requests can be processed; at the same time, by verifying the validity of the user credentials, it is ensured that only authorized users are allowed to access sensitive data, preventing unauthorized users from directly accessing the interface, thereby reducing the risk of data leakage.

[0145] (2) In the present invention, credentials are dynamically generated through credential application requests to ensure that each request is initiated by a legitimate user; at the same time, requests are verified through a rule engine to ensure that only access that meets specific rules can be passed, thereby reducing the resource occupation of malicious requests, and recording operation logs to help track malicious behavior, further enhancing the system's protection capabilities and reducing the risk of service paralysis.

[0146] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0147] There are a few points to note:

[0148] (1) The drawings of the embodiments of the present invention only relate to the structures related to the embodiments of the present invention, and other structures may refer to the general design.

[0149] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of the layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0150] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0151] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for authenticating access requests based on credentials, characterized in that: Applied to a credential verification platform, wherein the credential verification platform includes a client, a server, and a credential system connected in sequence; the method includes: S1: receiving a credential application request initiated by a client, wherein the credential application request includes user information and credential type; S2: Determine whether the credential application request meets the validity requirement, and if so, send the credential application request to the credential system; S3: dynamically generate user credentials according to the credential application request, and forward them to the client through the server; S4: The client sends a resource access request to the server with the user credentials; S5: forwarding the user credentials to the credential system to verify whether the user credentials are valid, if so, proceeding to the next step, otherwise, rejecting the resource access request; S6: Obtaining a set of association rules corresponding to the user credentials; S7: Using a rule engine to verify the resource access request to determine whether the resource access request meets the requirements of the association rule set, if so, proceed to the next step, otherwise, reject the resource access request; S8: Under the constraints of the credential request, the resource access request of the client is approved and an operation log is recorded.

2. The credential-based access request verification method according to claim 1, characterized in that: The user information specifically includes: mobile phone number, WeChat application ID, WeChat user unique ID and WeChat unified user ID.

3. The credential-based access request verification method according to claim 1, characterized in that: The S3 specifically includes: S301: parsing the credential application request through the credential system to obtain a business type corresponding to the credential application request; S302: Matching a corresponding association rule set according to the business type; S303: extracting public rules and private rules from the association rule set respectively; S304: When the public rules and the private rules are met, the user credentials are generated and forwarded to the client through the server.

4. The credential-based access request verification method according to claim 3, characterized in that: The public rules specifically include: expiration time and maximum number of uses; the private rules include: order number, tenant number, terminal type and service blacklist.

5. The credential-based access request verification method according to claim 3, characterized in that: The user credentials specifically include: Credential ID; Credential generation time; Credential expiration time; Maximum number of times a credential can be used; The number of times the credential has been used so far; and credential business type.

6. The credential-based access request verification method according to claim 1, characterized in that: The S7 specifically includes: Numbering each association rule in the association rule set; Verify the association rules of each number in turn; If all the association rules in the association set pass the verification, it is determined that the resource access request passes the verification; otherwise, it is determined that the resource access request fails the verification.

7. A credential-based access request verification device, characterized in that: include: An accepting module, configured to receive a credential application request initiated by a client, wherein the credential application request includes user information and credential type; A determination module, used to determine whether the credential application request meets the validity requirement, and if so, send the credential application request to the credential system; A generating module, used to dynamically generate user credentials according to the credential application request, and forward the credentials to the client through the server; An initiating module, used for the client to initiate a resource access request to the server with the user credentials; A verification module, used to forward the user credentials to the credential system to verify whether the user credentials are valid, and if so, enter the acquisition module, otherwise, reject the resource access request; An acquisition module, used to acquire a set of association rules corresponding to the user credentials; A verification module, used to verify the resource access request using a rule engine to determine whether the resource access request meets the requirements of the association rule set, and if so, record the request; otherwise, reject the resource access request; A recording module is used to approve the resource access request of the client under the constraint of the credential request and record an operation log.

8. The credential-based access request verification method according to claim 7, characterized in that: The user information specifically includes: mobile phone number, WeChat application ID, WeChat user unique ID and WeChat unified user ID.

9. The credential-based access request verification method according to claim 7, characterized in that: The generating module is used to Parsing the credential application request through the credential system to obtain the business type corresponding to the credential application request; Matching a corresponding association rule set according to the business type; Extracting public rules and private rules respectively from the association rule set; When the public rules and the private rules are met, the user credentials are generated and forwarded to the client through the server.

10. The credential-based access request verification method according to claim 9, characterized in that: The public rules specifically include: expiration time and maximum number of uses; the private rules include: order number, tenant number, terminal type and service blacklist.

Images