Multi-terminal login security authentication method and device, electronic equipment and storage medium

Abstract

The application discloses a multi-terminal login security authentication method and device, electronic equipment and a storage medium, comprising: in response to a client login operation of a user, generating a client login request according to user information and a client identifier and sending the request to a server; obtaining the user information and the client identifier through the server, and performing token query matching in a user table according to the user information; when the matching is successful, determining a user ID and a latest token version corresponding to the user information, obtaining a second token version by incrementing the latest token version, determining a second request source type and a second token validity period, generating a second token according to the user ID, the second request source type, the second token version and the second token validity period, updating the user table according to the user information, the client identifier and the second token, and returning the second token to the client storage. The application realizes multi-terminal login while improving the security of multi-terminal login, and can be widely applied in the technical field of information security.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a multi-terminal login security authentication and authorization method, device, electronic device and storage medium. Background Technology

[0002] The HTTP protocol itself is a stateless protocol. Traditionally, user login status is verified using cookies and sessions. The server stores user information in the session after logging in and sends the sessionId back to the client. The client stores the sessionId in a cookie, and the server can determine the user's login status by including this sessionId whenever the client accesses the server. This approach has several drawbacks, such as the inability to share session data in distributed systems, the reliance on cookies for session authentication (making it unsuitable for non-browser or mobile devices), the incompatibility with front-end / back-end separated systems, and security vulnerabilities, making it susceptible to cross-site request forgery attacks and increasing security risks. Furthermore, as the number of authenticated users increases, managing user login status through sessions becomes increasingly costly.

[0003] Due to the drawbacks of sessions, the token authentication mechanism makes up for these drawbacks. Tokens are similar to the HTTP protocol and are stateless, so there is no need to retain user authentication information or session information on the server.

[0004] JWT is a cross-domain authentication solution. The JWT structure itself is a token that returns authentication information to the client and stores it on the client. The next time there is another request, the authentication information needs to be sent from the client back to the server. However, JWT's authentication technology cannot prevent the same user from using the same authentication information to access resources on different devices. In addition, JWT tokens are irrevocable (the generated token can be used to access the server until it expires). Once the token is stolen, an attacker can use the token indefinitely, which poses a security risk to the system.

[0005] Terminology Explanation:

[0006] HTTP (Hypertext Transfer Protocol) is an application-layer protocol used for distributed, collaborative, and hypermedia information systems. HTTP is the foundation of data communication on the World Wide Web (WWW). As an application-layer protocol, it consists of two parts: a request and a response. It is a standard client / server model, and its main characteristics are: support for the client / server model, simplicity and speed, flexibility, connectionlessness, and statelessness.

[0007] Cookie: A small piece of data sent by a server to a user's browser and stored on the browser. It is carried and sent to the server when the browser makes a subsequent request to the same server.

[0008] Session: A server-side information storage mechanism used to store data during a specific user session. The server creates a unique session for each user, identifying them with a unique Session ID. The Session ID is typically stored in a cookie and sent to the server with each request, allowing the server to identify the user and retrieve their state information from the session.

[0009] JWT (JSON Web Token): A JSON object that uses digital signatures to securely transmit information between different service endpoints, overcoming the shortcomings of traditional sessions and used for authentication and authorization. A JWT consists of three parts: a header, a payload, and a signature. The header typically contains the token type and the hash algorithm used; the payload contains claims, which can be information about the user or other information required for business logic; the signature ensures that the JWT content has not been tampered with during transmission.

[0010] Redis: An open-source, network-enabled, in-memory or persistent, log-structured, key-value database written in C. Summary of the Invention

[0011] The purpose of this invention is to at least partially solve one of the technical problems existing in the prior art.

[0012] Therefore, one objective of this invention is to provide a multi-terminal login security authentication method that improves the security of multi-terminal login while enabling multi-terminal login.

[0013] Another objective of this invention is to provide a multi-terminal login security authentication and authorization device.

[0014] To achieve the above-mentioned technical objectives, the technical solutions adopted in the embodiments of the present invention include:

[0015] On one hand, embodiments of the present invention provide a multi-terminal login security authentication and authorization method, including the following steps:

[0016] In response to a user's client login operation, a client login request is generated based on the user information and client identifier, and the client login request is sent to the server.

[0017] The server obtains the user information and the client identifier based on the client's login request, and performs a token query and matching in the user table based on the user information;

[0018] If the matching fails, a user ID is generated based on the user information, the first request source type, the first token version, and the first token validity period are determined, a first token is generated based on the user ID, the first request source type, the first token version, and the first token validity period, and then the user information, the client identifier, and the first token are stored in the user table, and the first token is returned to the client storage.

[0019] When a match is successful, the user ID and the latest token version corresponding to the user information are determined. The second token version is obtained by incrementing the latest token version. The second request source type and the second token validity period are determined. The second token is generated based on the user ID, the second request source type, the second token version, and the second token validity period. Then, the user table is updated based on the user information, the client identifier, and the second token. Finally, the second token is returned to the client storage.

[0020] Furthermore, in one embodiment of the present invention, the step of updating the user table based on the user information, the client identifier, and the second token, and returning the second token to the client storage, specifically includes:

[0021] A token query and matching is performed in the user table based on the user information and the client identifier;

[0022] When a third token corresponding to the user information and the client identifier is matched, the second token overwrites the third token.

[0023] If no token corresponding to the user information and the client identifier is found, a first mapping relationship between the user information, the client identifier, and the second token is generated, and the first mapping relationship is stored in the user table.

[0024] The second token is returned to the client, enabling the client to perform a token query and matching based on the user information in its local storage.

[0025] When the third token corresponding to the user information is matched, the second token overwrites the third token.

[0026] If no token corresponding to the user information is matched, a second mapping relationship between the user information and the second token is generated, and the second mapping relationship is stored in local storage.

[0027] Furthermore, in one embodiment of the present invention, the multi-terminal login security authentication method further includes the following steps:

[0028] In response to a user's client logout operation, a token query and matching is performed on the client based on the user information to obtain the corresponding fourth token, and then the fourth token is destroyed;

[0029] A client logout request is generated based on the user information and the client identifier, and the client logout request is sent to the server.

[0030] The server obtains the user information and the client identifier based on the client's logout request, and performs a token query and matching in the user table based on the user information and the client identifier to obtain the corresponding fourth token, and then destroys the fourth token.

[0031] Furthermore, in one embodiment of the present invention, the multi-terminal login security authentication method further includes the following steps:

[0032] In response to a user's authentication data access operation, a token query and matching is performed on the current client based on the current user information;

[0033] When a current token corresponding to the current user information is matched, a business interface access request is generated based on the current user information, the current client identifier, and the current token.

[0034] If no token corresponding to the current user information is found, the user is redirected to the login page and prompted to log in to the client. The token returned by the server is used as the current token. A business interface access request is generated based on the current user information, the current client identifier, and the current token.

[0035] The current client sends the business interface access request to the server, which then performs token authentication on the business interface access request and returns a response to the current client based on the authentication result.

[0036] Furthermore, in one embodiment of the present invention, the step of performing token authentication on the service interface access request and returning a response to the current client based on the authentication result specifically includes:

[0037] The current user information, the current client identifier, and the current token are obtained based on the business interface access request.

[0038] Based on the current user information and the current client identifier, a matching query is performed in the user table to obtain the corresponding target token;

[0039] Verify whether the current token matches the target token, and verify whether the current token is within its validity period;

[0040] If the current token matches the target token and the current token is within its validity period, authentication is successful, and access response data is generated and returned to the current client.

[0041] If the current token does not match the target token, or if the current token is not valid, authentication is determined to have failed. An authentication failure message is returned to the current client, causing the current client to destroy the currently stored current token, redirect to the login page, and prompt the user to log in to the client.

[0042] Furthermore, in one embodiment of the present invention, the step of verifying whether the current token is consistent with the target token and verifying whether the current token is within its validity period specifically includes:

[0043] The current token is parsed to obtain the current user ID, the current request source type, the current token version, and the current token validity period;

[0044] Verify whether the current token is within its validity period based on the current token's validity period;

[0045] If the current token is within its validity period, the target token is parsed to obtain the target user ID, the target request source type, the target token version, and the target token validity period;

[0046] Verify whether the current user ID is consistent with the target user ID, whether the current request source type is consistent with the target request source type, whether the current token version is consistent with the target token version, and whether the current token validity period is consistent with the target token validity period;

[0047] If the verification results are consistent, the current token is determined to be consistent with the target token; if the verification results are inconsistent, the current token is determined to be inconsistent with the target token.

[0048] Furthermore, in one embodiment of the present invention, the step of determining successful authentication and generating access response data to return to the current client specifically includes:

[0049] Generate the corresponding access response data based on the business interface access request;

[0050] The effective time and expiration time of the current token are determined based on the current token's validity period, and the refreshable time of the current token is determined based on the effective time and the expiration time.

[0051] When the current time reaches the refreshable time, the effective time of the current token is reset to the current time, and the expiration time of the current token is postponed accordingly to obtain the third token validity period. Then, the current token is refreshed according to the third token validity period to obtain the refreshed current token.

[0052] The access response data and the refreshed current token are returned to the current client.

[0053] On the other hand, embodiments of the present invention provide a multi-terminal login security authentication and authorization device, including:

[0054] The login request module is used to respond to the user's client login operation, generate a client login request based on the user information and client identifier, and send the client login request to the server.

[0055] The token query module is used to obtain the user information and the client identifier through the server based on the client login request, and to perform token query matching in the user table based on the user information;

[0056] The first token generation module is used to generate a user ID based on the user information when the matching fails, determine the first request source type, the first token version and the first token validity period, generate a first token based on the user ID, the first request source type, the first token version and the first token validity period, and then store the user information, the client identifier and the first token in the user table, and return the first token to the client storage.

[0057] The second token generation module is used to determine the user ID and the latest token version corresponding to the user information when a match is successful, obtain the second token version by incrementing the latest token version, determine the second request source type and the second token validity period, generate the second token according to the user ID, the second request source type, the second token version and the second token validity period, update the user table according to the user information, the client identifier and the second token, and return the second token to the client storage.

[0058] On the other hand, embodiments of the present invention provide an electronic device, which includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for enabling communication between the processor and the memory. When the program is executed by the processor, it implements the multi-terminal login security authentication method as described above.

[0059] On the other hand, embodiments of the present invention also provide a storage medium, which is a computer-readable storage medium for computer-readable storage. The storage medium stores one or more programs, which can be executed by one or more processors to implement the multi-terminal login security authentication and authorization method described above.

[0060] The advantages and beneficial effects of the present invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention:

[0061] This invention initiates a client login request to the server based on user information and client identifier. If the server already has a token corresponding to the user information, it increments the token version to generate a new token and returns it to the client. The new token is then associated with and stored with the user information and client identifier, allowing users to use different tokens for authentication on different clients. This avoids cross-platform token use and improves the security of multi-platform login. The token expiration mechanism further enhances the security of multi-platform login. The token refresh mechanism enables seamless updating of token validity, improving the user experience. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the embodiments of the present invention are described below. It should be understood that the drawings described below are only for the convenience of clearly describing some embodiments of the technical solutions of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 A flowchart illustrating the steps of a multi-terminal login security authentication and authorization method provided in an embodiment of the present invention;

[0064] Figure 2 A flowchart of step S104 provided in an embodiment of the present invention;

[0065] Figure 3 Another flowchart of the multi-terminal login security authentication and authorization method provided in this embodiment of the invention;

[0066] Figure 4 Another flowchart of the multi-terminal login security authentication and authorization method provided in this embodiment of the invention;

[0067] Figure 5 A flowchart of step S304 provided in an embodiment of the present invention;

[0068] Figure 6A flowchart of step S3043 provided in an embodiment of the present invention;

[0069] Figure 7 A flowchart of step S3044 provided in an embodiment of the present invention;

[0070] Figure 8 This is a schematic diagram of the structure of the multi-terminal login security authentication and authorization device provided in an embodiment of the present invention;

[0071] Figure 9 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention;

[0072] Figure 10 This is a schematic diagram of the structure of the storage medium provided in an embodiment of the present invention. Detailed Implementation

[0073] The embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. It should be noted that although functional modules are divided in the system schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system schematic diagram or the order in the flowchart. The step numbers in the following embodiments are only set for ease of explanation and do not limit the order between steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0074] In the description of this invention, "multiple" means two or more. The use of "first" and "second" is for distinguishing technical features only and should not be construed as indicating or implying relative importance, the number of indicated technical features, or the order of the indicated technical features. Furthermore, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0075] The multi-terminal login security authentication method provided in this application can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, set-top box, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the multi-terminal login security authentication method, etc., but is not limited to the above forms.

[0076] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0077] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards of the relevant countries and regions. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data for the proper functioning of the embodiments of this application obtained.

[0078] like Figure 1 The diagram shown is a flowchart of one step of the multi-terminal login security authentication and authorization method provided in an embodiment of the present invention. (Refer to...) Figure 1 This invention provides a multi-terminal login security authentication method, which specifically includes the following steps:

[0079] S101. In response to the user's client login operation, generate a client login request based on the user information and client identifier, and send the client login request to the server.

[0080] S102. The server obtains user information and client identifier based on the client login request, and performs token query matching in the user table based on the user information;

[0081] S103. When the matching fails, generate a user ID based on the user information, determine the first request source type, the first token version and the first token validity period, generate a first token based on the user ID, the first request source type, the first token version and the first token validity period, and then store the user information, the client identifier and the first token in the user table, and return the first token to the client storage.

[0082] S104. When a match is successful, determine the user ID and the latest token version corresponding to the user information. Obtain the second token version by incrementing the latest token version. Determine the second request source type and the validity period of the second token. Generate the second token based on the user ID, the second request source type, the second token version, and the validity period of the second token. Then update the user table based on the user information, the client identifier, and the second token, and return the second token to the client storage.

[0083] Specifically, when a user enters login mode on the client, they set a client identifier in the request header and initiate a login request using their mobile phone number (user information). The server queries the user table based on the user's mobile phone number. If no corresponding token exists, the server registers using the user's mobile phone number, using it as a unique user ID—encrypting the mobile phone number yields the user ID. The server then sets the user ID, request source type (tokenType), token version, and other information into the payload of the JWT to generate the corresponding token (the token version is cached in Redis, incrementing with each login or logout). The server also sets the token's expiration time and returns it to the client. If one or more corresponding tokens exist (multiple tokens may exist for different clients), the server retrieves the latest token version from the existing tokens, increments it to obtain the token version used for this token generation, sets the user ID, request source type (tokenType), token version, and other information into the payload of the JWT to generate the corresponding token, sets the token's expiration time, and returns it to the client.

[0084] After a user successfully logs in, the client sets the token returned by the server in its local cache. When the client needs to access the server, it sets the client identifier, user information, and token in the request header and then requests the business interface.

[0085] like Figure 2 The diagram shown is a flowchart of step S104 provided in an embodiment of the present invention. (Refer to...) Figure 2 As an optional implementation, the user table is updated based on user information, client identifier, and second token, and the second token is returned to the client storage, specifically including:

[0086] S1041. Perform a token query and matching in the user table based on user information and client identifier;

[0087] S1042. When a third token corresponding to the user information and the client identifier is matched, the second token overwrites the third token.

[0088] S1043. When no token corresponding to the user information and client identifier is matched, generate a first mapping relationship between the user information and client identifier and the second token, and store the first mapping relationship in the user table;

[0089] S1044. Return the second token to the client, so that the client can perform a token query and matching in local storage based on the user information;

[0090] S1045. When a third token corresponding to the user information is matched, the second token overwrites the third token.

[0091] S1046. When no token corresponding to the user information is matched, a second mapping relationship between the user information and the second token is generated, and the second mapping relationship is stored in local storage.

[0092] Specifically, if a third token with the same user information and the same client identifier is already stored in the user table, it needs to be overwritten by the currently generated second token so that the user always uses the latest generated token for authentication when performing relevant permission operations on the same client; similarly, if a third token with the same user information is already stored in the client, it also needs to be overwritten by the currently generated second token.

[0093] like Figure 3 The diagram shown illustrates another step of the multi-terminal login security authentication method provided in this embodiment of the invention. (Refer to...) Figure 3 As an optional implementation method, the multi-terminal login security authentication and authorization method further includes the following steps:

[0094] S201. In response to the user's client logout operation, perform a token query and matching on the client based on the user information to obtain the corresponding fourth token, and then destroy the fourth token;

[0095] S202. Generate a client logout request based on user information and client identifier, and send the client logout request to the server;

[0096] S203. The server obtains user information and client identifier based on the client's logout request, and performs a token query and matching in the user table based on the user information and client identifier to obtain the corresponding fourth token, and then destroys the fourth token.

[0097] Specifically, when a user logs out on the client, the user's token stored locally on the client is destroyed, and the user's token stored on the client on the server is also destroyed.

[0098] like Figure 4 The diagram shown illustrates another step of the multi-terminal login security authentication method provided in this embodiment of the invention. (Refer to...) Figure 4 As an optional implementation method, the multi-terminal login security authentication and authorization method further includes the following steps:

[0099] S301. In response to the user's authentication data access operation, perform a token query and matching on the current client based on the current user information;

[0100] S302. When the current token corresponding to the current user information is matched, generate a business interface access request based on the current user information, the current client identifier, and the current token.

[0101] S303. When no token corresponding to the current user information is found, redirect to the login page and prompt the user to log in to the client. Use the token returned by the server as the current token and generate a business interface access request based on the current user information, the current client identifier and the current token.

[0102] S304. The current client sends a business interface access request to the server, so that the server performs token authentication on the business interface access request and returns a response to the current client based on the authentication result.

[0103] Specifically, after a user enters the client (H5, mini-program, APP, etc.), when the user accesses data that requires authentication, the system checks whether the user's token is stored locally on the client. If not found, the user is redirected to the login page and prompted to log in to the client, thus obtaining the token returned by the server. Based on the locally stored token or the token returned by the server, along with the user information and client identifier, a business interface access request is generated and sent to the server. This allows the server to perform token authentication on the business interface access request and return a response to the current client based on the authentication result.

[0104] like Figure 5 The diagram shown is a flowchart of step S304 provided in an embodiment of the present invention. (Refer to...) Figure 5 As an optional implementation, token authentication is performed on business interface access requests, and a response is returned to the current client based on the authentication result. Specifically, this includes:

[0105] S3041. Obtain the current user information, current client identifier, and current token based on the business interface access request;

[0106] S3042. Perform a matching query in the user table based on the current user information and the current client identifier to obtain the corresponding target token;

[0107] S3043. Verify whether the current token matches the target token, and verify whether the current token is within its validity period;

[0108] S3044. When the current token matches the target token and the current token is within its validity period, authentication is confirmed to be successful, and access response data is generated and returned to the current client.

[0109] S3045. When the current token is inconsistent with the target token, or the current token is not valid, authentication is determined to have failed. An authentication failure message is returned to the current client, causing the current client to destroy the currently stored token, redirect to the login page and prompt the user to log in to the client.

[0110] Specifically, upon receiving a request, the server retrieves the current user information, current client identifier, and current token from the request header. Based on the current user information and current client identifier, it matches the corresponding target token in the user table. Then, it verifies whether the current token matches the target token and whether the current token is valid. If the current token does not match the target token, or if the current token is not valid, authentication will fail. In this case, an authentication failure message is returned to the current client. The current client can then determine that the current token is invalid, destroy the locally stored current token, redirect to the login page, and prompt the user to log in again to obtain a new token.

[0111] like Figure 6 The diagram shown is a flowchart of step S3043 provided in an embodiment of the present invention. (Refer to...) Figure 6 As an optional implementation, further verification includes checking whether the current token matches the target token and whether the current token is within its validity period. Specifically, this includes:

[0112] S30431. Parse the current token to obtain the current user ID, the current request source type, the current token version, and the current token validity period;

[0113] S30432. Verify whether the current token is within its validity period based on the current token's validity period;

[0114] S30433. If the current token is within its validity period, parse the target token to obtain the target user ID, target request source type, target token version, and target token validity period.

[0115] S30434. Verify whether the current user ID is consistent with the target user ID, whether the current request source type is consistent with the target request source type, whether the current token version is consistent with the target token version, and whether the current token validity period is consistent with the target token validity period.

[0116] S30435. If all verification results are consistent, determine that the current token is consistent with the target token. If there is a discrepancy in the verification results, determine that the current token is inconsistent with the target token.

[0117] Specifically, the server parses the content of the current token. If parsing fails, it returns an authentication failure message to the current client. From the current token, it parses the current user ID, current request source type, current token version, and current token validity period. First, it checks if the current token is valid. If not, it returns an authentication failure message to the current client. If it is valid, it parses the target token to obtain the target user ID, target request source type, target token version, and target token validity period. Then, it compares the information of the current token with the corresponding information of the target token. If they match completely, authentication is successful, and an access response is generated and returned to the current client. If they do not match completely, it returns an authentication failure message to the current client.

[0118] It is understood that in this embodiment of the invention, the token's expiration, the user's active logout from the client, and the user's re-login to the same client will all cause the token originally stored and used by the client to become invalid. Furthermore, a forced upgrade of the token version by the administrator will also cause the token to become invalid. This ensures that, on the same client, when a user logs in under different browsers, only the last logged-in browser remains logged in. For example, if user A logs in to H5 on browser a and then logs in to H5 on browser b, the token used for logging in under browser a will become invalid. In addition, all tokens previously issued to that client will become invalid after a user actively logs out. However, for different platforms, a user's logout and login do not affect the use of tokens on other platforms. For example, logging in simultaneously on the H5 platform and the mini-program platform is unaffected, and logging out of the H5 platform will not affect the normal use of the mini-program token.

[0119] like Figure 7 The diagram shown is a flowchart of step S3044 provided in an embodiment of the present invention. (Refer to...) Figure 7 As an optional implementation, upon successful authentication, an access response is generated and returned to the current client, specifically including:

[0120] S30441. Generate corresponding access response data based on the business interface access request;

[0121] S30442. Determine the effective time and expiration time of the current token based on the current token's validity period, and determine the refreshable time of the current token based on the effective time and expiration time;

[0122] S30443. When the current time reaches the refreshable time, reset the effective time of the current token to the current time and postpone the expiration time of the current token accordingly to obtain the validity period of the third token. Then refresh the current token according to the validity period of the third token to obtain the refreshed current token.

[0123] S30444: Return the access response data and the refreshed current token to the current client.

[0124] Specifically, this embodiment of the invention also designs a token refresh mechanism. That is, when the token is about to expire, if the user uses the token to initiate an access request to the server, after successful authentication, the server will refresh the validity period of the token and return the refreshed token and response data to the client.

[0125] It should be noted that the token validity period carried in the token includes the token's effective time and expiration time. Based on the effective time and expiration time, the token's refreshable time can be determined (e.g., the midpoint between the effective time and expiration time). When token authentication is successful and the current time reaches the token's refreshable time, the server can reset the token's effective time to the current time and correspondingly postpone the expiration time to maintain the validity period unchanged, obtaining the updated token validity period. Then, the token is refreshed based on the updated token validity period. There are two ways to refresh the token: one is to only modify the token's validity period, and the other is to regenerate a new token based on the updated token validity period. This embodiment of the invention does not limit the specific methods used.

[0126] In some optional embodiments, a refresh count flag can be added to the token for the client to actively initiate a refresh. The initial refresh count flag is 0. When the client actively initiates a token refresh, the refresh count flag of the token will be incremented by 1, and then a request will be sent. The server verifies that the refresh count flag of the token sent by the client is equal to the refresh count flag of the token stored locally on the server plus 1, and the current time has reached the refreshable time. Then, the server refreshes the token sent by the client and returns it to the client, while overwriting the refreshed token stored locally.

[0127] The method steps of the embodiments of the present invention have been described above. It can be understood that, in the embodiments of the present invention, a client login request is initiated to the server based on user information and client identifier. If the server already has a token corresponding to the user information, a new token is generated by incrementing the token version and returned to the client. The new token is then associated with and stored with the user information and client identifier, allowing users to use different tokens for authentication on different clients. This avoids cross-platform use of tokens, achieving multi-platform login while improving the security of multi-platform login. Furthermore, the token expiration mechanism further enhances the security of multi-platform login. Finally, the token refresh mechanism enables seamless updating of the token's validity period, improving the user experience.

[0128] It is recognized that in existing technologies, three different authentication methods exist simultaneously between H5 portals, mini-programs, and apps. This invention integrates these into a single authentication method, which is more secure. H5 portals verify user session + cookie to maintain user login status, but this method is not sufficient for WeChat mini-programs because WeChat mini-programs do not have native cookie storage like browsers. Similarly, it cannot satisfy app login authentication, leading to cross-domain authentication issues. This results in different authentication mechanisms across the three platforms, leading to relatively lower security.

[0129] This invention allows users to log in simultaneously to an H5 page, a WeChat mini-program, and an app without interference. It also prevents the use of the same authentication information on different devices; for example, a token obtained on the H5 page cannot be used on the WeChat mini-program or the app. Furthermore, this invention adds a token expiration mechanism: the token expires, the user actively logs out of the client, or the user logs in again on the same client, all of which invalidate the token originally stored and used on the client, enhancing token security. Finally, this invention adds a token refresh mechanism, which refreshes the token's validity period without the user's awareness, improving the user experience.

[0130] like Figure 8 The diagram shown is a structural schematic of the multi-terminal login security authentication and authorization device provided in an embodiment of the present invention. (Refer to...) Figure 8 This invention provides a multi-terminal login security authentication and authorization device, comprising:

[0131] The login request module is used to respond to the user's client login operation, generate a client login request based on the user information and client identifier, and send the client login request to the server.

[0132] The token query module is used to obtain user information and client identifier from the client login request through the server, and to perform token query matching in the user table based on the user information;

[0133] The first token generation module is used to generate a user ID based on user information when the matching fails, determine the first request source type, the first token version and the first token validity period, generate a first token based on the user ID, the first request source type, the first token version and the first token validity period, and then store the user information, the client identifier and the first token in the user table, and return the first token to the client storage.

[0134] The second token generation module is used to determine the user ID and the latest token version corresponding to the user information when a match is successful. It then increments the latest token version to obtain the second token version, determines the second request source type and the second token validity period, generates the second token based on the user ID, the second request source type, the second token version and the second token validity period, updates the user table based on the user information, the client identifier and the second token, and returns the second token to the client storage.

[0135] The content of the above method embodiments is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0136] This invention also provides an electronic device, comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for communication between the processor and the memory. When the program is executed by the processor, it implements the aforementioned multi-terminal login security authentication method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0137] like Figure 9 The diagram shown is a hardware structure schematic of an electronic device provided in an embodiment of the present invention. (Refer to...) Figure 9 This invention provides an electronic device, comprising:

[0138] The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0139] The memory 902 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 902 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 to execute the multi-terminal login security authentication method of the embodiments of this invention.

[0140] The input / output interface 903 is used to implement information input and output;

[0141] The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0142] Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904);

[0143] The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0144] like Figure 10 The diagram shown is a structural schematic of the storage medium provided in an embodiment of the present invention. (Refer to...) Figure 10 The present invention also provides a storage medium, which is a computer-readable storage medium for computer-readable storage. The storage medium stores one or more programs 1001, which can be executed by one or more processors to implement the above-mentioned multi-terminal login security authentication and authorization method.

[0145] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0146] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform... Figure 1 The method shown.

[0147] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the aforementioned blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0148] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the aforementioned functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0149] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0150] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0151] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the aforementioned program can be printed, because the aforementioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or, if necessary, processing in other suitable ways, and then stored in computer memory.

[0152] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0153] In the foregoing description of this specification, references to terms such as "one embodiment," "another embodiment," or "some embodiments" indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of the present invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0154] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0155] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A multi-terminal login security authentication and authorization method, characterized in that, Includes the following steps: In response to a user's client login operation, a client login request is generated based on the user information and client identifier, and the client login request is sent to the server. The server obtains the user information and the client identifier based on the client's login request, and performs a token query and matching in the user table based on the user information; If the matching fails, a user ID is generated based on the user information, the first request source type, the first token version, and the first token validity period are determined, a first token is generated based on the user ID, the first request source type, the first token version, and the first token validity period, and then the user information, the client identifier, and the first token are stored in the user table, and the first token is returned to the client storage. When a match is successful, the user ID and the latest token version corresponding to the user information are determined. The second token version is obtained by incrementing the latest token version. The second request source type and the second token validity period are determined. The second token is generated based on the user ID, the second request source type, the second token version and the second token validity period. Then, the user table is updated based on the user information, the client identifier and the second token, and the second token is returned to the client storage. The multi-terminal login security authentication and authorization method also includes the following steps: In response to a user's authentication data access operation, a token query and matching is performed on the current client based on the current user information; When a current token corresponding to the current user information is matched, a business interface access request is generated based on the current user information, the current client identifier, and the current token. If no token corresponding to the current user information is found, the user is redirected to the login page and prompted to log in to the client. The token returned by the server is used as the current token. A business interface access request is generated based on the current user information, the current client identifier, and the current token. The current client sends the business interface access request to the server, so that the server performs token authentication on the business interface access request and returns a response to the current client based on the authentication result; The step of performing token authentication on the access request to the business interface and returning a response to the current client based on the authentication result specifically includes: The current user information, the current client identifier, and the current token are obtained based on the business interface access request. Based on the current user information and the current client identifier, a matching query is performed in the user table to obtain the corresponding target token; Verify whether the current token matches the target token, and verify whether the current token is within its validity period; If the current token matches the target token and the current token is within its validity period, authentication is successful, and access response data is generated and returned to the current client. If the current token is inconsistent with the target token, or if the current token is not valid, authentication failure is determined, and an authentication failure message is returned to the current client, causing the current client to destroy the currently stored current token, redirect to the login page and prompt the user to log in to the client. The process of confirming successful authentication and generating access response data to return to the current client specifically includes: Generate the corresponding access response data based on the business interface access request; The effective time and expiration time of the current token are determined based on the current token's validity period, and the refreshable time of the current token is determined based on the effective time and the expiration time. When the current time reaches the refreshable time, the effective time of the current token is reset to the current time, and the expiration time of the current token is postponed accordingly to obtain the third token validity period. Then, the current token is refreshed according to the third token validity period to obtain the refreshed current token. The access response data and the refreshed current token are returned to the current client.

2. The multi-terminal login security authentication and authorization method according to claim 1, characterized in that, The step of updating the user table based on the user information, the client identifier, and the second token, and returning the second token to the client storage, specifically includes: A token query and matching is performed in the user table based on the user information and the client identifier; When a third token corresponding to the user information and the client identifier is matched, the second token overwrites the third token. If no token corresponding to the user information and the client identifier is found, a first mapping relationship between the user information, the client identifier, and the second token is generated, and the first mapping relationship is stored in the user table. The second token is returned to the client, enabling the client to perform a token query and matching based on the user information in its local storage. When the third token corresponding to the user information is matched, the second token overwrites the third token. If no token corresponding to the user information is matched, a second mapping relationship between the user information and the second token is generated, and the second mapping relationship is stored in local storage.

3. The multi-terminal login security authentication and authorization method according to claim 1, characterized in that, The multi-terminal login security authentication and authorization method also includes the following steps: In response to a user's client logout operation, a token query and matching is performed on the client based on the user information to obtain the corresponding fourth token, and then the fourth token is destroyed; A client logout request is generated based on the user information and the client identifier, and the client logout request is sent to the server. The server obtains the user information and the client identifier based on the client's logout request, and performs a token query and matching in the user table based on the user information and the client identifier to obtain the corresponding fourth token, and then destroys the fourth token.

4. The multi-terminal login security authentication and authorization method according to claim 1, characterized in that, The verification of whether the current token matches the target token and whether the current token is within its validity period specifically includes: The current token is parsed to obtain the current user ID, the current request source type, the current token version, and the current token validity period; Verify whether the current token is within its validity period based on the current token's validity period; If the current token is within its validity period, the target token is parsed to obtain the target user ID, the target request source type, the target token version, and the target token validity period; Verify whether the current user ID is consistent with the target user ID, whether the current request source type is consistent with the target request source type, whether the current token version is consistent with the target token version, and whether the current token validity period is consistent with the target token validity period; If the verification results are consistent, the current token is determined to be consistent with the target token; if the verification results are inconsistent, the current token is determined to be inconsistent with the target token.

5. A multi-terminal login security authentication and authorization device, characterized in that, The method for implementing the multi-terminal login security authentication and authorization method as described in any one of claims 1 to 4 includes: The login request module is used to respond to the user's client login operation, generate a client login request based on the user information and client identifier, and send the client login request to the server. The token query module is used to obtain the user information and the client identifier through the server based on the client login request, and to perform token query matching in the user table based on the user information; The first token generation module is used to generate a user ID based on the user information when the matching fails, determine the first request source type, the first token version and the first token validity period, generate a first token based on the user ID, the first request source type, the first token version and the first token validity period, and then store the user information, the client identifier and the first token in the user table, and return the first token to the client storage. The second token generation module is used to determine the user ID and the latest token version corresponding to the user information when a match is successful, obtain the second token version by incrementing the latest token version, determine the second request source type and the second token validity period, generate the second token according to the user ID, the second request source type, the second token version and the second token validity period, update the user table according to the user information, the client identifier and the second token, and return the second token to the client storage.

6. An electronic device, characterized in that, The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for enabling communication between the processor and the memory. When the program is executed by the processor, it implements the steps of the multi-terminal login security authentication method as described in any one of claims 1 to 4.

7. A storage medium, said storage medium being a computer-readable storage medium for computer-readable storage, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of the multi-terminal login security authentication and authorization method as described in any one of claims 1 to 4.

Images