Authentication token generation method, server, program product and storage medium

Abstract

The invention discloses an authentication token generation method, a server, a program product and a storage medium. The authentication token generation method is applied to a server side, and the authentication token generation method comprises the following steps: generating load data of an authentication token based on user information; encrypting the load data based on a preset encryption key to obtain a ciphertext after the load data is encrypted; signing the ciphertext to obtain a digital signature; and generating an authentication token for security verification authentication based on the ciphertext and the digital signature.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an authentication token generation method, a server, a program product and a storage medium. Background Art

[0002] Token (authentication token) is a token used for security authentication. The client sends user information to the server. The server generates a unique token based on the user information and private key and returns it to the client. After that, each request header of the client carries the token for security authentication. Related technologies generally use symmetric encryption algorithms to encrypt tokens, which are not very secure and the content is easily tampered with. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides an authentication token generation method, a server, a program product, and a storage medium.

[0004] The technical solution of the embodiment of the present invention is achieved as follows:

[0005] On the one hand, an embodiment of the present invention provides a method for generating an authentication token, which is applied to a server side, and the method includes:

[0006] Generate payload data of authentication token based on user information;

[0007] Encrypting the payload data based on a preset encryption key to obtain encrypted ciphertext of the payload data;

[0008] Signing the ciphertext to obtain a digital signature;

[0009] Based on the ciphertext and the digital signature, an authentication token for security verification authentication is generated.

[0010] In the above solution, generating an authentication token for security verification authentication based on the ciphertext and the digital signature includes:

[0011] The ciphertext and the digital signature are concatenated to obtain the authentication token.

[0012] In the above solution, encrypting the payload data based on a preset encryption key includes:

[0013] Encrypting the payload data based on a preset encryption key of the national secret SM4 algorithm;

[0014] Correspondingly, signing the ciphertext includes:

[0015] The ciphertext is signed based on the national secret SM3 algorithm.

[0016] In the above solution, the payload data also includes: the expiration time of the authentication token.

[0017] In the above solution, encrypting the payload data based on a preset encryption key includes:

[0018] Dividing the load data into a plurality of groups;

[0019] Perform an XOR operation on each group and the ciphertext of the previous group, and encrypt the XOR operation result based on the preset encryption key.

[0020] In the above scheme, performing an XOR operation on each group and the ciphertext of the previous group includes:

[0021] XOR the first packet with the initialization vector.

[0022] In the above solution, encrypting the payload data based on a preset encryption key includes:

[0023] Encoding the preset encryption key and the character string of the payload data;

[0024] Encrypt the encoded payload data string based on the encoded preset encryption key

[0025] On the other hand, an embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned authentication token generation method.

[0026] On the other hand, an embodiment of the present invention provides a server, including a processor and a memory, which are interconnected, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the steps of the authentication token generation method provided in the embodiment of the present invention.

[0027] On the other hand, an embodiment of the present invention provides a computer-readable storage medium, including: the computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of the authentication token generation method provided in the embodiment of the present invention are implemented.

[0028] In the embodiment of the present application, the payload data of the authentication token is generated based on the user information on the server side, and the payload data is encrypted based on the preset encryption key to obtain the encrypted ciphertext of the payload data. The ciphertext is signed to obtain a digital signature. Based on the ciphertext and the digital signature, an authentication token for security verification authentication is generated. In the embodiment of the present application, the encryption of the payload data can increase the security of the user information. The digital signature based on the ciphertext of the payload data can ensure the source authenticity and integrity of the information in the authentication token, prevent the information in the authentication token from being tampered with during the transmission process, and improve the security of the authentication token transmission process. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a schematic diagram of a session-based authentication process provided by an embodiment of the present invention;

[0030] Figure 2 is a schematic diagram of a Token-based authentication process provided by an embodiment of the present invention.

[0031] Figure 3 It is a schematic diagram of an implementation flow of a method for generating an authentication token provided by an embodiment of the present invention;

[0032] Figure 4 It is a flow chart of a Cipher-block chaining (CBC) mode provided by an embodiment of the present invention;

[0033] Figure 5 It is a flowchart of a Token encryption method based on the national secret SM algorithm provided by an embodiment of the present invention;

[0034] Figure 6 It is a schematic diagram of a server provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] like Figure 1 As shown, Figure 1 This is a diagram of the session-based authentication process, including:

[0037] (1) The client sends a request to the server for the first time.

[0038] (2) The server creates a session object and assigns a sessionId.

[0039] (3) The server returns the sessionId to the client.

[0040] (4) The client saves the sessionId to a cookie.

[0041] (5) The client sends a request again, carrying the sessionId.

[0042] (6) The server verifies whether the session data exists based on the sessionId and completes the user's legal verification.

[0043] Session is a special object created by the server to save the user status. When the client accesses the server for the first time, the server creates a session object (this object has a unique ID, called sessionId), and the server sends the sessionId to the client in the form of a cookie. When the client accesses the server again, it sends the sessionId. The server verifies whether there is session data based on the sessionId, completes the user's legal verification, and avoids the need to carry user name and password information for each request. When the user logs out of the system or the session expires and is destroyed, the client's sessionId becomes invalid at the same time.

[0044] like Figure 2 As shown, Figure 2 This is a schematic diagram of the Token-based authentication process, including:

[0045] (1) The client sends an authentication request to the Application Programming Interface (API) gateway.

[0046] (2) The API gateway sends the authentication request to the custom authorization service.

[0047] The custom authorization service verifies the request and uses the private key to generate a Token.

[0048] (3) After authentication succeeds, the custom authorization service sends the Token to the API gateway.

[0049] (4) After authentication is successful, the API gateway sends the Token to the client.

[0050] (5) The client sends a service request carrying a Token.

[0051] The API Gateway uses the public key to verify the Token.

[0052] (6) After verification, the API gateway sends the business request to the protected API. The business request carries the parameters parsed from the Token.

[0053] (7) The protected API sends the business response to the API gateway.

[0054] (8) The API gateway sends the business response to the client.

[0055] Token is a string of characters generated by the server, which is used as a token for the client to make a request. Token authentication is a stateless authentication method. The client first sends the user information to the server, and the server generates a unique token based on the user information and private key and returns it to the client. The token is only stored on the client, and then each request header of the client carries the token, and the server only verifies the user through calculation (no query). Token has the advantages of supporting cross-domain access, being stateless, decoupled, and more suitable for mobile applications.

[0056] JSON Web Token (JWT) is an open standard that defines a compact, self-contained way to securely transmit information between parties as a JSON object. The information uses digital signature technology and can be verified and trusted. Generally, JWT consists of three parts: Header, Payload, and Signature. The Header is the header information, declaring that the Token is of JWT type; Payload is the payload, which mainly stores user identity information and registration statements. The registration statement mainly includes information such as the expiration time, issuance time, and issuer of the Token. There are two main application scenarios of JWT. On the one hand, it prevents the transmission data from being tampered with, and can achieve one-time verification. Through the fixed parameters of the issuer and expiration time of the payload in JWT, JWT can be well applied to some scenarios with timeliness, such as the registration link when the user registers, which needs to have the ability to identify the user, timeliness, and cannot be tampered with to prevent other possible accounts from being modified through the link. On the one hand, there is stateless authentication of the RESTful API, using JWT for identity authentication of the RESTful API. In this scenario, the client and server share the key, the expiration time is verified by the server, the client refreshes periodically, and the signature information cannot be changed to ensure its security.

[0057] In the traditional Session authentication method, user authentication needs to be recorded on the server side to facilitate the identification of the user's next request, which will increase the server overhead when there are many users. At the same time, session is based on cookies for user identification, which can be easily intercepted, causing the service to be attacked by cross-site forgery requests, and the security is low.

[0058] Generally, tokens use symmetric encryption algorithms and are not digitally signed. Signatures are used to sign the content of token information to prevent content tampering. Generally, tokens are not secure. Existing JWT technology uses JSON as a token in Web applications to securely transmit information between parties as JSON objects. During data transmission, data encryption, signatures and other related processing can also be completed.

[0059] The encryption algorithms commonly used in JWT mainly include confidentiality algorithms (Hash-based Message Authentication Code (HMAC) algorithm) or using RSA (public key encryption algorithm) or Elliptic Curve Digital Signature Algorithm (ECDSA) public key / private key to sign it, but there is a lack of support for the national secret SM algorithm, and the security is insufficient. The national secret algorithm refers to the domestic commercial encryption recognized by the State Cryptography Administration. The use of the national secret algorithm is conducive to getting rid of excessive dependence on foreign technologies and products, building an industry network security environment, and enhancing the "security and controllability" of my country's industry information systems.

[0060] In view of the shortcomings of the above-mentioned related technologies, an embodiment of the present invention provides a method for generating an authentication token, which can improve the security of authentication token information transmission. In order to illustrate the technical solution of the present invention, a specific embodiment is used for description below.

[0061] refer to Figure 3 , Figure 3 1 is a schematic diagram of an implementation flow of an authentication token generation method provided by an embodiment of the present invention. The authentication token generation method is applied to a server side. The authentication token generation method includes:

[0062] S301, generating payload data of an authentication token based on user information.

[0063] The authentication token includes payload data, which may refer to the payload in the JWT. For example, the server encapsulates user information and other information that needs to be encrypted and transmitted into a payload.

[0064] The user information may be obtained by the server from the client. The client sends an authentication request to the server. The authentication request carries the user information. The user information may refer to the logged-in user on the client.

[0065] In one embodiment, user information and other information that needs to be transmitted encrypted can be combined by string concatenation, for example, using the '|' special symbol as a separator, which can reduce the payload length and avoid increasing the Token storage and transmission overhead.

[0066] S302: Encrypt the payload data based on a preset encryption key to obtain encrypted ciphertext of the payload data.

[0067] Here, you can use encryption algorithms such as confidentiality algorithms (Hash-based Message Authentication Code, HMAC algorithm), RSA (public key encryption algorithm), Elliptic Curve Digital Signature Algorithm (Elliptic Curve Digital Signature Algorithm, ECDSA) or national secret algorithms to encrypt the payload data.

[0068] The preset encryption key is passed into the encryption algorithm, and the payload data is encrypted by the encryption algorithm to obtain the encrypted ciphertext of the payload data.

[0069] S303: Sign the ciphertext to obtain a digital signature.

[0070] Digital signature is an authentication technology based on public key cryptography. It allows the sender of information to encrypt data using his or her own private key to generate a specific data string, namely a digital signature. The core of this technology is to ensure the authenticity and integrity of the source of information, while preventing the information from being tampered with during transmission. In the process of digital signature, each party has a pair of keys, namely a public key and a private key. The public key is public and anyone can use it to encrypt information or verify signatures; while the private key is kept confidential and only the owner of the key can use it to decrypt information or create signatures.

[0071] The digital signature process usually includes the following steps: First, the sender uses a hash function to generate a summary of the original data (ciphertext); then, the sender uses its own private key to encrypt the summary to form a digital signature. The receiver needs to use the sender's public key to decrypt the digital signature, obtain the original summary, and compare it with the summary calculated by itself to verify the authenticity of the signature.

[0072] In this embodiment, a variety of encryption algorithms may be used to sign the ciphertext of the payload data, for example, a national encryption algorithm may be used.

[0073] After receiving the request from the client, the server can verify the signature of the Token in the request: after receiving the signed data, first use the other party's public key to decrypt the data, then use the national secret SM3 algorithm to calculate the summary, and finally compare the decrypted summary with the calculated summary to see if they are consistent.

[0074] S304: Generate an authentication token for security verification and authentication based on the ciphertext and the digital signature.

[0075] The ciphertext of the payload data obtained in step S302 is combined with the digital signature obtained in step S303 to obtain the final Token, that is, to generate an authentication token for security verification authentication.

[0076] This embodiment can ensure the authenticity and integrity of the source of Token information by signing the Token information content, while preventing the Token information from being tampered with during transmission, thereby improving the security of Token transmission.

[0077] The token itself contains user information, so there is no need to store session information on the server side, which can reduce the pressure on the server side. The token can be placed in the request header for transmission to achieve information transmission in cross-domain scenarios, solving the problem of information loss across domains when using cookies.

[0078] In the embodiment of the present application, the payload data of the authentication token is generated based on the user information on the server side, and the payload data is encrypted based on the preset encryption key to obtain the encrypted ciphertext of the payload data. The ciphertext is signed to obtain a digital signature. Based on the ciphertext and the digital signature, an authentication token for security verification authentication is generated. In the embodiment of the present application, the encryption of the payload data can increase the security of the user information. The digital signature based on the ciphertext of the payload data can ensure the source authenticity and integrity of the information in the authentication token, prevent the information in the authentication token from being tampered with during the transmission process, and improve the security of the authentication token transmission process.

[0079] In one embodiment, generating an authentication token for security verification authentication based on the ciphertext and the digital signature includes:

[0080] The ciphertext and the digital signature are concatenated to obtain the authentication token.

[0081] In one embodiment, the payload data further includes: an expiration time of the authentication token.

[0082] For example, the user name, token expiration time, and other information that needs to be encrypted and transmitted can be encapsulated into a payload, combined through string concatenation, and separated by the '|' special symbol to reduce the payload length and avoid increasing the token storage and transmission overhead.

[0083] The expiration time in this embodiment can be well applied to some time-sensitive scenarios, such as the registration connection when the user registers, which needs to identify the user, be time-sensitive, and cannot be tampered with to prevent other possible accounts from being modified through the link. On the one hand, it is the stateless authentication of the restful api, using JWT for the identity authentication of the restful api. In this scenario, the client and the server share the secret, the expiration time is verified by the server, the client refreshes regularly, and the signature information cannot be changed to ensure its security.

[0084] In one embodiment, encrypting the payload data based on a preset encryption key includes:

[0085] Encrypting the payload data based on a preset encryption key of the national secret SM4 algorithm;

[0086] Correspondingly, signing the ciphertext includes:

[0087] The ciphertext is signed based on the national secret SM3 algorithm.

[0088] The national secret SM4 algorithm is a block cipher algorithm with a Feistel structure. The block length and key length are both 128 bits. The encryption and decryption algorithms and key expansion algorithms both use a 32-round nonlinear iterative structure. The decryption algorithm has the same structure as the encryption algorithm, but the order of use of the round keys is reversed, that is, the reverse order of the round keys used in the decryption algorithm.

[0089] The national secret SM3 algorithm is a type of digest algorithm (signature algorithm). The digest algorithm is widely used in digital signatures, message verification, data integrity detection and other fields. The SM3 algorithm is an improved algorithm based on SHA-256. The algorithm adopts the Merkle-Damgard structure, the message group length is 512 bits, and the digest length is 256 bits. It has the same compression function structure as SHA-256, but the compression function of the SM3 algorithm is more complex and has higher security.

[0090] This embodiment encrypts the payload using the national secret SM4 algorithm, and then digitally signs the encrypted payload using the national secret SM3 signature algorithm, and finally the encrypted payload and the signature together form the final authorization Token. This implements the encryption of authorization Tokens based on the national secret SM3 and national secret SM4 cryptographic algorithms, improves the security of authorization authentication information transmission, and is conducive to promoting the national secret algorithm and strengthening information security.

[0091] Using the national secret SM3 signature method to digitally sign the payload and using the national secret SM4 to encrypt the payload information is more secure than the encryption algorithms used in traditional tokens and JWT standards. In addition, the national secret SM4 algorithm is combined with the national secret SM3 algorithm to generate the authorization token, which increases the complexity of the token, enhances the security of information transmission, and retains the advantages of the token authentication method such as statelessness and cross-domain support.

[0092] In one embodiment, encrypting the payload data based on a preset encryption key includes:

[0093] Dividing the load data into a plurality of groups;

[0094] Perform an XOR operation on each group and the ciphertext of the previous group, and encrypt the XOR operation result based on the preset encryption key.

[0095] The encryption mode of the National Secret SM is divided into the Electronic Codebook (ECB) mode and the Cipher-block chaining (CBC) mode. Among them, the ECB mode divides the plaintext into blocks of fixed length, and uses the same key to independently encrypt or decrypt each plaintext block, and the result of the encryption is directly used as the ciphertext group. When the content of the last plaintext group is less than the group length, it needs to be filled with some specific data. ECB mode is a working mode of the simplest block encryption algorithm. However, the ECB mode has certain risks. The ECB mode only performs grouping and encryption operations, and the same plaintext group is encrypted to obtain the same ciphertext group, and the ciphertext can be operated through the plaintext without deciphering the password. Therefore, the present embodiment can use the CBC mode to encrypt the plaintext.

[0096] The CBC mode improves security by introducing chain dependency. The flowchart of the CBC mode is as follows: Figure 4As shown in the figure, the CBC mode first divides the payload data into several plaintext groups, then performs an XOR operation (XOR) on each plaintext group and the previous ciphertext group, and then encrypts it with the key to obtain the ciphertext group corresponding to the plaintext group. Each ciphertext group depends on all the plaintexts before it. Since the ciphertext groups are connected to each other like a chain, it is called the ciphertext group chaining mode.

[0097] In one embodiment, performing an XOR operation on each group with the ciphertext of the previous group includes:

[0098] XOR the first packet with the initialization vector.

[0099] Since the plaintext block needs to be XORed with the previous ciphertext block, but there is no ciphertext block before the first plaintext block, an initialization vector (IV) is introduced to act as the first interference item to ensure the uniqueness of each message. The initialization vector can be preset and can be XORed directly with the first plaintext block.

[0100] In one embodiment, encrypting the payload data based on a preset encryption key includes:

[0101] Encoding the preset encryption key and the character string of the payload data;

[0102] The encoded character string of the payload data is encrypted based on the encoded preset encryption key.

[0103] The encoding of the character string of the preset encryption key and the payload data may be UTF-8 (8-bit, Universal Character Set / Unicode Transformation Format) encoding.

[0104] For example, the steps for Token encryption using the national encryption SM4 are as follows:

[0105] (1) Encode the payload string in UTF-8.

[0106] (2) Set the encryption key string, encode the encryption key string in UTF-8 and pass it into the encryption method;

[0107] (3) Encrypt the encoded payload string using CBC mode to generate encrypted ciphertext;

[0108] (4) Perform base64-based URL security encoding on the encrypted ciphertext to obtain the encrypted string of the final payload.

[0109] like Figure 5 As shown, Figure 5 This is a flowchart of the Token encryption method based on the national secret SM algorithm, including:

[0110] First, the payload is encrypted using the national encryption SM4 algorithm, and the obtained ciphertext is URL-securely encoded based on base64 to obtain an encrypted string.

[0111] The encrypted payload is then digitally signed using the national secret SM3 signature algorithm, and the digital signature is URL securely encoded based on base64 to obtain the encoded digital signature.

[0112] Finally, the encrypted payload and digital signature are combined to form the final security Token.

[0113] The embodiment of the present application implements the authorization token encryption method by using the more secure national secret SM3 and SM4 cryptographic algorithms, encrypts the user information through the CBC encryption mode in the national secret SM4 algorithm, and then digitally signs the encrypted ciphertext through the national secret SM3 signature algorithm, and finally combines the encrypted ciphertext and the signature into the final authorization token. The authorization token encryption based on the national secret SM3 and national secret SM4 cryptographic algorithms is implemented, which improves the security of the transmission of authorization authentication information, and is conducive to promoting the national secret algorithm and strengthening information security.

[0114] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0115] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0116] It should be noted that the technical solutions described in the embodiments of the present invention can be arbitrarily combined without conflict.

[0117] In addition, in the embodiments of the present invention, "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0118] The present application also provides an authentication token generation device, which corresponds to the authentication token generation method of the receiving end, and each step in the above authentication token generation method embodiment is also fully applicable to the present device embodiment. The device includes:

[0119] A first generating module, used to generate payload data of an authentication token based on user information;

[0120] An encryption module, used to encrypt the payload data based on a preset encryption key to obtain a ciphertext of the payload data;

[0121] A signature module, used to sign the ciphertext to obtain a digital signature;

[0122] The second generating module is used to generate an authentication token for security verification authentication based on the ciphertext and the digital signature.

[0123] In one embodiment, the second generating module is specifically used for:

[0124] The ciphertext and the digital signature are concatenated to obtain the authentication token.

[0125] In one embodiment, the encryption module is specifically used for:

[0126] Encrypting the payload data based on a preset encryption key of the national secret SM4 algorithm;

[0127] Correspondingly, the signature module is specifically used for:

[0128] The ciphertext is signed based on the national secret SM3 algorithm.

[0129] In one embodiment, the payload data further includes: an expiration time of the authentication token.

[0130] In one embodiment, the encryption module is specifically used for:

[0131] Dividing the load data into a plurality of groups;

[0132] Perform an XOR operation on each group and the ciphertext of the previous group, and encrypt the XOR operation result based on the preset encryption key.

[0133] In one embodiment, the encryption module is specifically used for:

[0134] XOR the first packet with the initialization vector.

[0135] In one embodiment, the encryption module is specifically used for:

[0136] Encoding the preset encryption key and the character string of the payload data;

[0137] The encoded character string of the payload data is encrypted based on the encoded preset encryption key.

[0138] In actual application, the first generation module, the second generation module, the encryption module and the signature module can be implemented by a processor in the server, such as a central processing unit (CPU), a digital authentication token generator (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA).

[0139] It should be noted that: the authentication token generation device provided in the above embodiment only uses the division of the above modules as an example when generating authentication tokens. In actual applications, the above processing can be assigned to different modules as needed, that is, the internal structure of the device can be divided into different modules to complete all or part of the processing described above. In addition, the authentication token generation device provided in the above embodiment and the authentication token generation method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0140] The above-mentioned authentication token generation device can be in the form of an image file. After the image file is executed, it can be run in the form of a container or a virtual machine to implement the authentication token generation method described in this application. Of course, it is not limited to the image file form. As long as some software forms that can implement the authentication token generation method described in this application are within the scope of protection of this application.

[0141] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a server. Figure 6 A schematic diagram of the hardware structure of a server provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the server includes:

[0142] Communication interface 601, capable of exchanging information with other devices such as network devices;

[0143] The processor 602 is connected to the communication interface 601 to implement information exchange with other devices and is used to execute the method provided by one or more technical solutions when running a computer program. The computer program is stored in the memory 603.

[0144] Of course, in actual application, the various components in the server are coupled together through the bus system 604. It can be understood that the bus system 604 is used to realize the connection and communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 6 Various buses are labeled as bus system 604 .

[0145] The memory 603 in the embodiment of the present application is used to store various types of data to support the operation of the computer device. Examples of such data include: any computer program used to operate on the server.

[0146] It can be understood that the memory 603 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

[0147] The method disclosed in the above embodiment of the present application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in a memory, and the processor reads the program in the memory and completes the steps of the above method in combination with its hardware.

[0148] Optionally, when the processor 602 executes the program, it implements the corresponding processes implemented by the server in each method of the embodiments of the present application, which will not be described here for the sake of brevity.

[0149] In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, including a first memory storing a computer program, and the computer program can be executed by a processor of a computer device to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0150] In the several embodiments provided in the present application, it should be understood that the disclosed devices, computer equipment and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0151] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0152] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0153] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, disks or optical disks.

[0154] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application can be essentially or partly embodied in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0155] In an exemplary embodiment, the embodiment of the present application further provides a computer program product, including a computer program, which can be executed by the processor 602 of the server to complete the steps described in the authentication token generation method in the embodiment of the present application.

[0156] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0157] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0158] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for generating an authentication token, applied to a server, characterized in that: The method comprises: Generate payload data of authentication token based on user information; Encrypting the payload data based on a preset encryption key to obtain encrypted ciphertext of the payload data; Signing the ciphertext to obtain a digital signature; Based on the ciphertext and the digital signature, an authentication token for security verification authentication is generated.

2. The method according to claim 1, characterized in that The step of generating an authentication token for security verification authentication based on the ciphertext and the digital signature comprises: The ciphertext and the digital signature are concatenated to obtain the authentication token.

3. The method according to claim 1, characterized in that The encrypting the payload data based on a preset encryption key includes: Encrypting the payload data based on a preset encryption key of the national secret SM4 algorithm; Correspondingly, signing the ciphertext includes: The ciphertext is signed based on the national secret SM3 algorithm.

4. The method according to claim 1, characterized in that: The payload data also includes: the expiration time of the authentication token.

5. The method according to claim 1, characterized in that: The encrypting the payload data based on a preset encryption key includes: Dividing the load data into a plurality of groups; XOR each block with the ciphertext of the previous block; The XOR operation result is encrypted based on the preset encryption key.

6. The method according to claim 5, characterized in that The XOR operation of each group with the ciphertext of the previous group includes: XOR the first packet with the initialization vector.

7. The method according to claim 1, characterized in that The encrypting the payload data based on a preset encryption key includes: Encoding the preset encryption key and the character string of the payload data; The encoded character string of the payload data is encrypted based on the encoded preset encryption key.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the steps of the authentication token generation method according to any one of claims 1 to 7.

9. A server comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the authentication token generation method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, the processor executes the steps of the authentication token generation method according to any one of claims 1 to 7.

Images