Authentication access method and device for custom signatures applied to content composition

Abstract

The present invention relates to the field of data verification technology, and discloses an authentication access method and device for a custom signature applied to content composition, the method comprising: when the server detects the first access operation of the client, a payload is generated based on the input information, the server determines the header information and secret key of the target token, encrypts the header information, payload and secret key according to the encryption algorithm, obtains a signature, and then generates a target token, which is sent to the client for storage, and when the client accesses again, the client generates an access request based on the target token, the server performs authentication confirmation based on the target token in the access request, obtains an authentication result, and responds to the access request based on the authentication result. It can be seen that the implementation of the present invention can support user-defined signature authentication, improve authentication security and efficiency, and the server does not need to save the client or token information, and can achieve stateless response.

Description

Technical Field

[0001] The present invention relates to the technical field of data verification, and in particular to an authentication access method and device for a custom signature applied to content composition. Background Art

[0002] With the rapid development of industrial intelligence and cross-system collaboration, the application of formation and capacity sorting equipment and related platforms in fields such as battery manufacturing and energy management is becoming increasingly complex. During battery production, the formation (activation) and capacity sorting stages rely on high-frequency data exchange between multiple systems, such as equipment control instructions, process parameter transmission, and real-time status monitoring. In these scenarios, secure authentication becomes a core requirement to ensure data integrity and prevent unauthorized operations. Traditional authentication methods based on usernames and passwords or fixed sessions are difficult to meet the requirements of dynamic, highly concurrent industrial environments. There is an urgent need for a lightweight, stateless, and tamper-resistant authentication mechanism to accommodate efficient and trusted interaction between distributed systems.

[0003] Currently, HTTP Basic Authentication, Session-Cookie, or traditional Token solutions are widely used in the industry, but all have significant flaws: HTTP Basic Authentication credentials are easily intercepted and decoded, resulting in low security; Session-Cookie relies on the server to store session state, which leads to a sharp increase in server resource pressure and difficulty in scalability; Traditional Token solutions require the server to maintain token state, increasing database query overhead, and lack anti-tampering mechanisms, making them vulnerable to forgery or replay attacks. In addition, existing technologies lack support for dynamic expiration times and autonomous verification of client information, making it difficult to adapt to the flexibility and security requirements of content-based scenarios. Therefore, it is particularly important to propose a technical solution that can support user-defined signature authentication and improve authentication security and efficiency. Summary of the Invention

[0004] The present invention provides an authentication access method and device for user-defined signatures applied to content composition, which can support user-defined signature authentication and improve authentication security and efficiency.

[0005] In order to solve the above technical problems, the first aspect of the present invention discloses an authentication access method for a custom signature applied to a componentized content, the method comprising:

[0006] When the server detects the client's first access operation, it generates a payload based on the input information sent by the client, which includes user information, system information, and expiration time;

[0007] The server determines header information of the target token and a preset secret key, wherein the header information includes a token type and an encryption algorithm of the target token;

[0008] The server encrypts the header information, the payload, and the secret key according to the encryption algorithm to obtain a signature;

[0009] The server generates the target token according to the header information, the payload and the signature, and sends the target token to the client;

[0010] The client stores the received target token, and when the client performs a re-access operation on the server, the client generates an access request corresponding to the re-access operation based on the target token, and sends the access request to the server;

[0011] The server authenticates and confirms the access operation according to the target token in the access request, obtains an authentication result, and responds to the access request according to the authentication result.

[0012] As an optional implementation manner, in the first aspect of the present invention, the server authenticates and confirms the access operation according to the target token in the access request to obtain an authentication result, including:

[0013] The server parses the target token in the access request to obtain the parsed target header information, target payload, and target signature;

[0014] The server encrypts the target header information, the target payload, and the secret key according to the encryption algorithm to obtain a verification signature;

[0015] The server determines whether the verification signature matches the target signature and obtains an authentication result.

[0016] As an optional implementation manner, in the first aspect of the present invention, before the server parses the target token in the access request, the method further includes:

[0017] The server detects whether the access request contains the target token and obtains a detection result;

[0018] When the detection result indicates that the access request does not include the target token, the server returns a first error code to the client, where the first error code indicates that the target token is missing from the access request.

[0019] As an optional embodiment, in the first aspect of the present invention, the method further comprises:

[0020] The server obtains the expiration time in the parsed target payload, and determines whether the target token in the access request has expired based on the expiration time, thereby obtaining a determination result;

[0021] When the judgment result indicates that the target token is expired, the server returns a second error code to the client, where the second error code indicates that the target token is expired.

[0022] As an optional implementation manner, in the first aspect of the present invention, the server encrypts the header information, the payload, and the secret key according to the encryption algorithm to obtain a signature, including:

[0023] The server performs deserialization processing on the payload to obtain a character string corresponding to the payload;

[0024] The server encodes the character string corresponding to the payload according to a preset encoding algorithm to obtain an encoded character string corresponding to the payload;

[0025] The server encrypts the header information, the encoded string and the secret key according to the encryption algorithm to obtain a signature.

[0026] As an optional implementation, in the first aspect of the present invention, the server encrypts the header information, the encoded string, and the secret key according to the encryption algorithm to obtain a signature, including:

[0027] The server encodes the header information according to the encoding algorithm to obtain an encoded character string corresponding to the header information;

[0028] The server determines a target string according to the encoded string corresponding to the payload and the encoded string corresponding to the header information;

[0029] The server encrypts the target character string and the secret key according to the encryption algorithm to obtain a signature.

[0030] As an optional implementation, in the first aspect of the present invention, the encoding algorithm includes a Base64Url encoding algorithm, and the encryption algorithm includes an HMACSHA256 algorithm.

[0031] A second aspect of the present invention discloses an authentication access device for a custom signature applied to a componentized content. The device includes a server and a client. The server includes a first generation module, a determination module, an encryption module, and an authentication module. The client includes a storage module and a second generation module, wherein:

[0032] The first generating module is configured to generate a payload based on input information sent by the client upon detecting the first access operation by the client, wherein the input information includes user information, system information, and expiration time;

[0033] The determining module is used to determine header information of a target token and a preset secret key, wherein the header information includes a token type and an encryption algorithm of the target token;

[0034] The encryption module is configured to encrypt the header information, the payload, and the secret key according to the encryption algorithm to obtain a signature;

[0035] The first generating module is further configured to generate the target token according to the header information, the payload, and the signature, and send the target token to the client;

[0036] The storage module is used to store the received target token;

[0037] The second generating module is configured to generate an access request corresponding to the re-access operation based on the target token when the client performs a re-access operation on the server, and send the access request to the server;

[0038] The authentication module is configured to authenticate and confirm the access operation according to the target token in the access request, obtain an authentication result, and respond to the access request according to the authentication result.

[0039] As an optional implementation, in the second aspect of the present invention, the authentication module authenticates and confirms the access operation according to the target token in the access request, and the manner of obtaining the authentication result specifically includes:

[0040] Parsing the target token in the access request to obtain parsed target header information, target payload, and target signature;

[0041] Encrypt the target header information, the target payload, and the secret key according to the encryption algorithm to obtain a verification signature;

[0042] Determine whether the verification signature matches the target signature and obtain an authentication result.

[0043] As an optional implementation, in the second aspect of the present invention, the server further includes a detection module, wherein:

[0044] The detection module is used to detect whether the access request contains the target token before the authentication module parses the target token in the access request, and obtain a detection result; when the detection result indicates that the access request does not contain the target token, the detection module returns a first error code to the client, and the first error code indicates that the target token is missing in the access request.

[0045] As an optional implementation, in the second aspect of the present invention, the server further includes an acquisition module and a judgment module, wherein:

[0046] The acquisition module is used to obtain the expiration time in the parsed target payload;

[0047] The judgment module is used to judge whether the target token in the access request has expired and invalid according to the expiration time, and obtain a judgment result; when the judgment result indicates that the target token has expired and invalid, the judgment module returns a second error code to the client, and the second error code indicates that the target token has expired and invalid.

[0048] As an optional implementation, in the second aspect of the present invention, the encryption module encrypts the header information, the payload, and the secret key according to the encryption algorithm to obtain the signature in a manner specifically including:

[0049] Deserialize the payload to obtain a character string corresponding to the payload;

[0050] Encoding the character string corresponding to the payload according to a preset encoding algorithm to obtain an encoded character string corresponding to the payload;

[0051] The header information, the encoded string and the secret key are encrypted according to the encryption algorithm to obtain a signature.

[0052] As an optional implementation, in the second aspect of the present invention, the encryption module encrypts the header information, the encoded string, and the secret key according to the encryption algorithm to obtain the signature in a manner specifically including:

[0053] The server encodes the header information according to the encoding algorithm to obtain an encoded character string corresponding to the header information;

[0054] The server determines a target string according to the encoded string corresponding to the payload and the encoded string corresponding to the header information;

[0055] The server encrypts the target character string and the secret key according to the encryption algorithm to obtain a signature.

[0056] As an optional implementation, in the second aspect of the present invention, the encoding algorithm includes a Base64Url encoding algorithm, and the encryption algorithm includes an HMACSHA256 algorithm.

[0057] A third aspect of the present invention discloses another authentication access device for a custom signature for content-based content, the device comprising:

[0058] a memory storing executable program code;

[0059] a processor coupled to the memory;

[0060] The processor calls the executable program code stored in the memory to execute the authentication access method for customized signatures applied to content-based content disclosed in the first aspect of the present invention.

[0061] The fourth aspect of the present invention discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute the authentication access method for custom signatures applied to content-fragmented components disclosed in the first aspect of the present invention.

[0062] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0063] In an embodiment of the present invention, when the server detects the first access operation of the client, it generates a payload based on the input information sent by the client, determines the header information of the target token and the preset secret key, and encrypts the header information, the payload and the secret key according to the encryption algorithm to obtain a signature. The server generates a target token based on the header information, the payload and the signature, and sends the target token to the client. The client stores the received target token. When the client performs a second access operation on the server, the client generates an access request corresponding to the second access operation based on the target token, and sends the access request to the server. The server authenticates the access operation based on the target token in the access request, obtains an authentication result, and responds to the access request based on the authentication result. It can be seen that the implementation of the present invention can support user-defined signature authentication, improve authentication security and efficiency, and the server does not need to save client or token information, and can achieve stateless response. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0065] Figure 1 This is a flow chart of an authentication access method for a custom signature applied to content-based content, disclosed in an embodiment of the present invention;

[0066] Figure 2 This is a flow chart of another authentication access method for a custom signature applied to content-based content, disclosed in an embodiment of the present invention;

[0067] Figure 3 This is a schematic diagram of the structure of an authentication access device for a custom signature applied to content-based content, disclosed in an embodiment of the present invention;

[0068] Figure 4 This is a schematic structural diagram of another authentication access device for customized signatures applied to content-based content, disclosed in an embodiment of the present invention;

[0069] Figure 5 This is a structural diagram of another authentication access device for custom signatures applied to content-based content, disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0070] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0071] The terms "first," "second," and so on, in the description and claims of the present invention and the accompanying drawings are used to distinguish between different items, not to describe a specific order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, apparatus, product, or end comprising a series of steps or elements is not limited to the listed steps or elements but may optionally include steps or elements not listed therein, or may optionally include other steps or elements inherent to such process, method, product, or end.

[0072] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0073] The present invention discloses a method and device for authentication access using custom signatures for content-based content. This method supports user-defined signature authentication, improves authentication security and efficiency, and eliminates the need for the server to store client or token information, enabling stateless responses. Details are provided below.

[0074] Example 1

[0075] See also Figure 1 , Figure 1 This is a flow chart of an authentication access method for a custom signature applied to content-based content disclosed in an embodiment of the present invention. Figure 1 The authentication access method for custom signatures applied to component content described above can be applied to an authentication access device applied to custom signatures applied to component content, wherein the authentication access device applied to custom signatures applied to component content can include an intelligent server or intelligent platform for performing authentication verification, and the intelligent server includes a local server or a cloud server, which is not limited in the embodiment of the present invention. Figure 1 As shown, the authentication access method applied to the custom signature of the component content may include the following operations:

[0076] 101. When the server detects the first access operation of the client, it generates a payload based on the input information sent by the client.

[0077] In an embodiment of the present invention, optionally, a user can access a server through a client. When a user accesses a server through a client for the first time, the user needs to log in or register a user account on the client. For example, when a user registers an account on the client, the user information will be entered. The user information may include user ID, user code, user name, login password and other information. When a user accesses a server through a client for the first time, that is, when the server detects the client's first access operation, the client will send input information to the server. The input information may include user information, system information and expiration time. Among them, user information may include one or more combinations of user ID, user code, user name, login password and other information. System information may include system name and / or system version. The expiration time may be set by the user or automatically set by the client, and the present invention does not limit this.

[0078] In the embodiment of the present invention, optionally, in the embodiment of the present invention, the code for generating the payload may be as follows:

[0079] JWTPayload jWTPayload = new JWTPayload

[0080] {

[0081] UserId = theUser.Id,

[0082] UserCode = theUser.UserName,

[0083] UserName = theUser.RealName,

[0084] StorerName= theStorer.StorerName,

[0085] SystemName= theStorer.SystemName,

[0086] SystemVersion= theStorer.SystemVersion,

[0087] Expire=DateTime.Now.AddHours(Convert.ToDouble(theUser.ExpireTimes))

[0088] }

[0089] 102. The server determines the header information of the target token and the preset secret key.

[0090] In an embodiment of the present invention, optionally, the target token may include a JSON Web Token (JWT) token, which can be used to transmit authenticated identity information between an identity provider and a service provider to achieve authenticated access. The JWT may include three parts: a header, a payload, and a signature. The header is used to record the token type and the signature algorithm, that is, the header information includes the token type and encryption algorithm of the target token. The payload can be used to carry stored data, including user code, user name, expiration time, etc. The signature is used to prevent tampering and ensure security. The signature can be calculated or a user-defined string, which is not limited by the present invention.

[0091] In an embodiment of the present invention, optionally, the preset key can be a character string customized on the server, such as ZeqpzEqpzeQpzeqP, or it can be the content of an electronic encryption dongle, that is, the server reads the encryption dongle ciphertext and decrypts it to obtain the key, which is not limited in the present invention.

[0092] 103. The server encrypts the header information, payload, and secret key according to the encryption algorithm to obtain a signature.

[0093] In an embodiment of the present invention, optionally, the server may encrypt the header information, payload, and secret key according to an encryption algorithm to obtain a signature. Specifically, the header information and payload may be encoded, and then the encoded header information and payload may be calculated according to the encryption algorithm to obtain a signature. The signature may also be a fixed string defined by the user, which is not limited by the present invention.

[0094] 104. The server generates a target token based on the header information, payload, and signature, and sends the target token to the client.

[0095] In the embodiment of the present invention, the server may optionally combine the header information, the payload, and the signature to generate the target token, or may generate the target token by calling a function, specifically:

[0096] public static string GetToken(string payloadJsonStr, string secret)

[0097] {

[0098] string payloadBase64Url = payloadJsonStr.Base64UrlEncode();stringsign=$"{_headerBase64Url}.{payloadBase64Url}".ToHMACSHA256String(secret);

[0099] return $"{_headerBase64Url}.{payloadBase64Url}.{sign}";

[0100] }

[0101] 105. The client stores the received target token. When the client performs a re-access operation on the server, the client generates an access request corresponding to the re-access operation based on the target token and sends the access request to the server.

[0102] In an embodiment of the present invention, optionally, after the client receives the target token sent by the server, the client stores the received target token. Specifically, the client can store the target token in localStorage, sessionStorage or Cookie. When the client performs another access operation on the server, that is, when it is detected that the user logs in to the server through the client, requests data from the server, or performs specific operations on the server, the client can generate an access request corresponding to the access operation based on the target token. Specifically, the client can attach the target token in the Authorization header to generate an access request, and the client sends the access request to the server to implement the access operation on the server. The present invention does not limit this.

[0103] 106. The server authenticates the access operation based on the target token in the access request, obtains an authentication result, and responds to the access request based on the authentication result.

[0104] In an embodiment of the present invention, optionally, the server can authenticate and confirm the access operation based on the target token in the access request, obtain an authentication result, and respond to the access request based on the authentication result. For example, when the authentication result indicates that the access operation is legal, the server can authorize the client to perform the access operation, which is not limited by the present invention.

[0105] It can be seen that implementation Figure 1 The described authentication access method for custom signatures applied to content composition can generate a payload based on the input information sent by the client when the server detects the client's first access operation. The server determines the header information of the target token and the preset secret key. The server encrypts the header information, payload and secret key according to the encryption algorithm to obtain a signature. The server generates a target token based on the header information, payload and signature, and sends the target token to the client. It can support user-defined signature authentication and improve authentication security and accuracy. The client stores the received target token. When the client performs a second access operation on the server, the client generates an access request corresponding to the second access operation based on the target token and sends the access request to the server. The server authenticates and confirms the access operation based on the target token in the access request, obtains an authentication result, and responds to the access request based on the authentication result. It can support user-defined signature authentication and improve authentication security and efficiency. The server does not need to save client or token information and can achieve stateless response.

[0106] In an optional embodiment, the server encrypts the header information, payload, and key according to an encryption algorithm to obtain a signature, which may include the following operations:

[0107] The server deserializes the payload and obtains the string corresponding to the payload;

[0108] The server encodes the string corresponding to the payload according to the preset encoding algorithm to obtain the encoded string corresponding to the payload;

[0109] The server encrypts the header information, encoded string, and secret key according to the encryption algorithm to obtain the signature.

[0110] In this optional embodiment, the server may optionally deserialize the payload to obtain a string corresponding to the payload, and then encode the string corresponding to the payload according to a preset encoding algorithm to obtain an encoded string corresponding to the payload. The preset encoding algorithm may include a Base64Url encoding algorithm, specifically:

[0111] public static string Base64UrlEncode(this string text)

[0112] {

[0113] var plainTextBytes = Encoding.UTF8.GetBytes(text);

[0114] var base64 = Convert.ToBase64String(plainTextBytes).Replace('+','-').Replace(' / ', '_').TrimEnd('=');

[0115] return base64;

[0116] }

[0117] In this optional embodiment, the server may optionally encrypt the header information, the encoded string, and the secret key according to an encryption algorithm to obtain a signature. The encryption algorithm may include the HMACSHA256 algorithm. Specifically:

[0118] public static string ToHMACSHA256String(this string text, stringsecret)

[0119] {

[0120] secret = secret ?? "";

[0121] byte[] keyByte = Encoding.UTF8.GetBytes(secret);

[0122] byte[] messageBytes = Encoding.UTF8.GetBytes(text);

[0123] using (var hmacsha256 = new HMACSHA256(keyByte))

[0124] {

[0125] byte[] hashmessage = hmacsha256.ComputeHash(messageBytes);

[0126] return Convert.ToBase64String(hashmessage).Replace('+', '-').Replace(' / ', '_').TrimEnd('=');

[0127] }

[0128] }

[0129] It can be seen that the implementation of this optional embodiment can deserialize the payload through the server to obtain the character string corresponding to the payload, and the server encodes the character string corresponding to the payload according to a preset encoding algorithm to obtain the encoded character string corresponding to the payload. The server encrypts the header information, the encoded character string and the secret key according to the encryption algorithm to obtain the signature, which can improve the accuracy and reliability of authentication through signature.

[0130] In another optional embodiment, the server encrypts the header information, the encoded string, and the secret key according to the encryption algorithm to obtain the signature, which may include the following operations:

[0131] The server encodes the header information according to the encoding algorithm to obtain the encoded string corresponding to the header information;

[0132] The server determines the target string based on the encoded string corresponding to the payload and the encoded string corresponding to the header information;

[0133] The server encrypts the target string and secret key according to the encryption algorithm to obtain the signature.

[0134] In this optional embodiment, the server may optionally encode the header information according to an encoding algorithm to obtain an encoded string corresponding to the header information. Specifically, the header information may be converted into an encoded string using a Base64Url encoding algorithm. The encoding algorithm includes a Base64Url encoding algorithm, and the encryption algorithm includes an HMACSHA256 algorithm. The server determines the target string based on the encoded string corresponding to the payload and the encoded string corresponding to the header information. Specifically, the server may concatenate the encoded string corresponding to the payload and the encoded string corresponding to the header information, for example:

[0135] text=base64UrlEncode(header) + "." + base64UrlEncode(payload)

[0136] Among them, text represents the target string, base64UrlEncode(header) represents the encoded string corresponding to the header information, and base64UrlEncode(payload) represents the encoded string corresponding to the payload. Then, according to the encryption algorithm, the target string and the secret key are encrypted to obtain the signature. Specifically:

[0137] public static string ToHMACSHA256String(this string text, stringsecret)

[0138] {

[0139] secret = secret ?? "";

[0140] byte[] keyByte = Encoding.UTF8.GetBytes(secret);

[0141] byte[] messageBytes = Encoding.UTF8.GetBytes(text);

[0142] using (var hmacsha256 = new HMACSHA256(keyByte))

[0143] {

[0144] byte[] hashmessage = hmacsha256.ComputeHash(messageBytes);

[0145] return Convert.ToBase64String(hashmessage).Replace('+', '-').Replace(' / ', '_').TrimEnd('=');

[0146] }

[0147] }

[0148] It can be seen that the implementation of this optional embodiment can encode the header information according to the encoding algorithm to obtain the encoded string corresponding to the header information, determine the target string according to the encoded string corresponding to the payload and the encoded string corresponding to the header information, and encrypt the target string and the secret key according to the encryption algorithm to obtain the signature, which can improve the security and reliability of the determined signature, and can customize the secret key to improve the flexibility of determining the signature, thereby improving the accuracy and reliability of authentication through the signature.

[0149] Example 2

[0150] See also Figure 2 , Figure 2 This is a flow chart of an authentication access method for a custom signature applied to content-based content disclosed in an embodiment of the present invention. Figure 2 The authentication access method for custom signatures applied to component content described above can be applied to an authentication access device applied to custom signatures applied to component content, wherein the authentication access device applied to custom signatures applied to component content can include an intelligent server or intelligent platform for performing authentication verification, and the intelligent server includes a local server or a cloud server, which is not limited in the embodiment of the present invention. Figure 2 As shown, the authentication access method applied to the custom signature of the component content may include the following operations:

[0151] 201. When the server detects the first access operation of the client, it generates a payload based on the input information sent by the client.

[0152] 202. The server determines the header information of the target token and the preset secret key.

[0153] 203. The server encrypts the header information, payload, and secret key according to the encryption algorithm to obtain a signature.

[0154] 204. The server generates a target token based on the header information, payload, and signature, and sends the target token to the client.

[0155] 205. The client stores the received target token. When the client performs a re-access operation on the server, the client generates an access request corresponding to the re-access operation based on the target token and sends the access request to the server.

[0156] In the embodiment of the present invention, for other descriptions of steps 201 to 205, please refer to the detailed description of steps 101 to 105 in the first embodiment of the present invention, which will not be repeated in this embodiment of the present invention.

[0157] 206. The server parses the target token in the access request to obtain the parsed target header information, target payload, and target signature.

[0158] In an embodiment of the present invention, the server optionally parses the target token in the access request to obtain the parsed target header information, target payload, and target signature. Specifically:

[0159] / / / Get the data in the Token

[0160] / / /

[0161] / / / <typeparam name="T"> Generics< / typeparam>

[0162] / / / <param name="token"> token

[0163] / / / <returns>< / returns>

[0164] public static T GetPayload <t>(string token)

[0165] {

[0166] if (token.IsNullOrEmpty())

[0167] return default;

[0168] return token.Split('.')[1].Base64UrlDecode().ToObject <t>();

[0169] }

[0170] 207. The server encrypts the target header information, target payload, and secret key according to the encryption algorithm to obtain a verification signature.

[0171] In the embodiment of the present invention, the server may optionally encrypt the target header information, target payload, and secret key according to an encryption algorithm to obtain a verification signature. Specifically:

[0172] public static bool CheckToken(string token, string secret)

[0173] {

[0174] var items = token.Split('.');

[0175] var oldSign = items[2];

[0176] string newSign = $"{items[0]}.{items[1]}".ToHMACSHA256String(secret);

[0177] return oldSign == newSign;

[0178] }

[0179] 208. The server determines whether the verification signature matches the target signature, obtains an authentication result, and responds to the access request based on the authentication result.

[0180] In the embodiment of the present invention, the server may optionally determine whether the verification signature matches the target signature to obtain an authentication result. Specifically:

[0181] public override async Task OnActionExecuting(ActionExecutingContextcontext)

[0182] {

[0183] if (context.ContainsFilter <nocheckjwtattribute>())

[0184] return;

[0185] try

[0186] {

[0187] var req = context.HttpContext.Request;

[0188] string token = req.GetToken();

[0189] if (!JWTHelper.CheckToken(token, JWTHelper.JWTSecret))

[0190] {

[0191] context.Result = Error("token verification failed!", _errorCode + 1);

[0192] return;

[0193] }

[0194] }

[0195] catch (Exception ex)

[0196] {

[0197] context.Result = Error(ex.Message, _errorCode);

[0198] }

[0199] await Task.CompletedTask;

[0200] }

[0201] It can be seen that the implementation Figure 2 The described authentication access method for custom signatures applied to content composition can generate a payload based on the input information sent by the client when the server detects the client's first access operation. The server determines the header information of the target token and the preset secret key. The server encrypts the header information, payload and secret key according to the encryption algorithm to obtain the signature. The server generates the target token based on the header information, payload and signature, and sends the target token to the client. It can support user-defined signature authentication and improve authentication security and accuracy. The client stores the received target token. When the client performs another access operation on the server, the client-based An access request corresponding to the re-access operation is generated based on the target token, and the access request is sent to the server. The target token in the access request is parsed by the server to obtain the parsed target header information, target payload and target signature. According to the encryption algorithm, the target header information, target payload and secret key are encrypted to obtain the verification signature, and it is judged whether the verification signature matches the target signature to obtain the authentication result, thereby improving the accuracy and reliability of authentication and certification, and thus improving the security of the system. It can support user-defined signature authentication, improve authentication security and efficiency, and the server does not need to save the client or Token information, and can achieve stateless response.

[0202] In an optional embodiment, before the server parses the target token in the access request, the authentication access method applied to the custom signature of the component content may further include the following operations:

[0203] The server detects whether the access request contains the target token and obtains the detection result;

[0204] When the detection result indicates that the access request does not include the target token, the server returns a first error code to the client, where the first error code indicates that the target token is missing in the access request.

[0205] In this optional embodiment, the server may optionally detect whether the access request contains the target token and obtain a detection result. When the detection result indicates that the access request does not contain the target token, the server returns a first error code to the client. The first error code indicates that the target token is missing in the access request. Specifically:

[0206] public override async Task OnActionExecuting(ActionExecutingContextcontext)

[0207] {

[0208] if (context.ContainsFilter <nocheckjwtattribute>())

[0209] return;

[0210] try

[0211] {

[0212] var req = context.HttpContext.Request;

[0213] string token = req.GetToken();

[0214] if (token.IsNullOrEmpty())

[0215] {

[0216] context.Result = Error("missing token", _errorCode);

[0217] return;

[0218] }

[0219] }

[0220] catch (Exception ex)

[0221] {

[0222] context.Result = Error(ex.Message, _errorCode);

[0223] }

[0224] await Task.CompletedTask;

[0225] }

[0226] It can be seen that the implementation of this optional embodiment can detect whether the target token is included in the access request through the server to obtain a detection result. When the detection result indicates that the access request does not contain the target token, the server returns a first error code to the client. The first error code indicates that the target token is missing in the access request, thereby improving the accuracy of authentication and being able to provide a token missing reminder, making it easier for users to understand the error situation and improving user experience.

[0227] In another optional embodiment, the authentication access method applied to the custom signature of the componentized content may further include the following operations:

[0228] The server obtains the expiration time in the parsed target payload, and determines whether the target token in the access request has expired based on the expiration time, and obtains the judgment result;

[0229] When the determination result indicates that the target token has expired, the server returns a second error code to the client, where the second error code indicates that the target token has expired.

[0230] In this optional embodiment, the server may optionally obtain the expiration time in the parsed target payload and determine whether the target token in the access request has expired based on the expiration time to obtain a determination result. Specifically, the server may determine whether the expiration time in the payload exceeds the current system time. When the expiration time in the payload exceeds the current system time, indicating expiration, the server returns a second error code to the client. The second error code indicates that the target token has expired. Specifically:

[0231] public override async Task OnActionExecuting(ActionExecutingContextcontext)

[0232] {

[0233] if (context.ContainsFilter <nocheckjwtattribute>())

[0234] return;

[0235] try

[0236] {

[0237] var req = context.HttpContext.Request;

[0238] string token = req.GetToken();

[0239] var payload = JWTHelper.GetPayload <jwtpayload>(token);

[0240] if (payload.Expire <DateTime.Now)

[0241] {

[0242] context.Result = Error("token expired!", _errorCode+2);

[0243] return;

[0244] }

[0245] }

[0246] catch (Exception ex)

[0247] {

[0248] context.Result = Error(ex.Message, _errorCode);

[0249] }

[0250] await Task.CompletedTask;

[0251] }

[0252] It can be seen that the implementation of this optional embodiment can obtain the expiration time in the parsed target payload through the server, and judge whether the target token in the access request is expired and invalid based on the expiration time, to obtain a judgment result. When the judgment result indicates that the target token is expired and invalid, the server returns a second error code to the client, and the second error code indicates that the target token is expired and invalid, thereby improving the accuracy of authentication, and being able to provide a token expiration reminder, making it easier for users to understand the error situation and improving user experience.

[0253] Example 3

[0254] See also Figure 3 , Figure 3 This is a schematic diagram of a structure of an authentication access device for a custom signature used in content-based content management disclosed in an embodiment of the present invention. Figure 3 The authentication access device for the custom signature used for content composition described may include an intelligent server or intelligent platform for authentication verification, and the intelligent server includes a local server or a cloud server, which is not limited in the embodiment of the present invention. Figure 3 As shown, the authentication access device for customized signatures for content composition may include a server 30 and a client 40. The server 30 includes a first generation module 301, a determination module 302, an encryption module 303, and an authentication module 304. The client 40 includes a storage module 401 and a second generation module 402.

[0255] The first generating module 301 is configured to generate a payload based on input information sent by the client 40 upon detecting the first access operation by the client 40, where the input information includes user information, system information, and expiration time;

[0256] Determination module 302, used to determine the header information of the target token and the preset secret key, the header information including the token type and encryption algorithm of the target token;

[0257] The encryption module 303 is used to encrypt the header information, payload and secret key according to the encryption algorithm to obtain a signature;

[0258] The first generation module 301 is further configured to generate a target token based on the header information, the payload, and the signature, and send the target token to the client 40;

[0259] The storage module 401 is used to store the received target token;

[0260] The second generating module 402 is configured to generate an access request corresponding to the re-access operation based on the target token when the client 40 performs a re-access operation on the server 30, and send the access request to the server 30;

[0261] The authentication module 304 is configured to authenticate the access operation according to the target token in the access request, obtain an authentication result, and respond to the access request according to the authentication result.

[0262] It can be seen that implementation Figure 3 The described authentication access device for custom signatures applied to content-based content can generate a payload based on the input information sent by the client when the server detects the client's first access operation. The server determines the header information of the target token and the preset secret key. The server encrypts the header information, payload and secret key according to the encryption algorithm to obtain a signature. The server generates a target token based on the header information, payload and signature, and sends the target token to the client. It can support user-defined signature authentication and improve authentication security and accuracy. The client stores the received target token. When the client performs a second access operation on the server, the client generates an access request corresponding to the second access operation based on the target token and sends the access request to the server. The server authenticates and confirms the access operation based on the target token in the access request, obtains an authentication result, and responds to the access request based on the authentication result. It can support user-defined signature authentication and improve authentication security and efficiency. The server does not need to save client or token information and can achieve stateless response.

[0263] In an optional embodiment, if Figure 4 As shown, the authentication module 304 authenticates the access operation according to the target token in the access request, and the specific method of obtaining the authentication result includes:

[0264] Parse the target token in the access request to obtain the parsed target header information, target payload, and target signature;

[0265] According to the encryption algorithm, the target header information, target payload and secret key are encrypted to obtain the verification signature;

[0266] Determine whether the verification signature matches the target signature and obtain the authentication result.

[0267] It can be seen that implementation Figure 4 The described authentication access device for customized signatures applied to content composition can generate a payload based on the input information sent by the client when the server detects the client's first access operation. The server determines the header information of the target token and the preset secret key. The server encrypts the header information, payload and secret key according to the encryption algorithm to obtain the signature. The server generates the target token based on the header information, payload and signature, and sends the target token to the client. It can support user-defined signature authentication and improve the security and accuracy of authentication. The client stores the received target token. When the client performs another access operation on the server, the client-based An access request corresponding to the re-access operation is generated based on the target token, and the access request is sent to the server. The target token in the access request is parsed by the server to obtain the parsed target header information, target payload and target signature. According to the encryption algorithm, the target header information, target payload and secret key are encrypted to obtain the verification signature, and it is judged whether the verification signature matches the target signature to obtain the authentication result, thereby improving the accuracy and reliability of authentication and certification, and thus improving the security of the system. It can support user-defined signature authentication, improve authentication security and efficiency, and the server does not need to save the client or Token information, and can achieve stateless response.

[0268] In another optional embodiment, Figure 4 As shown, the server 30 further includes a detection module 305, wherein:

[0269] The detection module 305 is used to detect whether the access request contains the target token before the authentication module 304 parses the target token in the access request and obtain a detection result; when the detection result indicates that the access request does not contain the target token, the detection module 305 returns a first error code to the client 40, and the first error code indicates that the target token is missing in the access request.

[0270] It can be seen that implementation Figure 4 The described authentication access device for custom signatures applied to component content can detect whether the target token is included in the access request through the server and obtain a detection result. When the detection result indicates that the access request does not contain the target token, the server returns a first error code to the client. The first error code indicates that the target token is missing in the access request, thereby improving the accuracy of authentication and being able to provide a token missing reminder, making it easier for users to understand the error situation and improving the user experience.

[0271] In another optional embodiment, Figure 4 As shown, the server 30 further includes an acquisition module 306 and a judgment module 307, wherein:

[0272] An acquisition module 306 is configured to acquire the expiration time in the parsed target payload;

[0273] The judgment module 307 is used to judge whether the target token in the access request has expired and invalid according to the expiration time, and obtain a judgment result; when the judgment result indicates that the target token has expired and invalid, the judgment module 307 returns a second error code to the client 40, and the second error code indicates that the target token has expired and invalid.

[0274] It can be seen that implementation Figure 4 The described authentication access device for custom signatures applied to component content can obtain the expiration time in the parsed target payload through the server, and judge whether the target token in the access request has expired and invalid based on the expiration time, and obtain a judgment result. When the judgment result indicates that the target token has expired and invalid, the server returns a second error code to the client, and the second error code indicates that the target token has expired and invalid, thereby improving the accuracy of authentication and being able to provide token expiration reminders, making it easier for users to understand the error situation and improving user experience.

[0275] In another optional embodiment, Figure 4 As shown, the first generation module 301 encrypts the header information, payload, and secret key according to the encryption algorithm. The specific method of obtaining the signature includes:

[0276] Deserialize the payload to obtain the string corresponding to the payload;

[0277] Encode the string corresponding to the payload according to a preset encoding algorithm to obtain an encoded string corresponding to the payload;

[0278] According to the encryption algorithm, the header information, encoded string and secret key are encrypted to obtain the signature.

[0279] In this optional embodiment, the encoding algorithm includes the Base64Url encoding algorithm, and the encryption algorithm includes the HMACSHA256 algorithm.

[0280] It can be seen that implementation Figure 4 The described authentication access device for custom signatures applied to component content can deserialize the payload through the server to obtain the character string corresponding to the payload. The server encodes the character string corresponding to the payload according to a preset encoding algorithm to obtain the encoded character string corresponding to the payload. The server encrypts the header information, the encoded character string and the secret key according to the encryption algorithm to obtain the signature, which can improve the accuracy and reliability of authentication through signature.

[0281] In another optional embodiment, Figure 4 As shown, the encryption module 303 encrypts the header information, the encoded string, and the secret key according to the encryption algorithm. The specific method of obtaining the signature includes:

[0282] The server encodes the header information according to the encoding algorithm to obtain the encoded string corresponding to the header information;

[0283] The server determines the target string based on the encoded string corresponding to the payload and the encoded string corresponding to the header information;

[0284] The server encrypts the target string and secret key according to the encryption algorithm to obtain the signature.

[0285] It can be seen that implementation Figure 4 The described authentication access device for customized signatures applied to content-based components can encode header information according to an encoding algorithm to obtain an encoded string corresponding to the header information, determine a target string based on the encoded string corresponding to the payload and the encoded string corresponding to the header information, and encrypt the target string and the secret key according to an encryption algorithm to obtain a signature. This can improve the security and reliability of the determined signature, and can customize the secret key to improve the flexibility of determining the signature, thereby improving the accuracy and reliability of authentication through the signature.

[0286] Example 4

[0287] See also Figure 5 , Figure 5 This is a structural diagram of another authentication access device for customized signatures applied to content-based content disclosed in an embodiment of the present invention. Figure 5 As shown, the authentication access device applied to the customized signature of the content may include:

[0288] A memory 501 storing executable program code;

[0289] a processor 502 coupled to the memory 501;

[0290] The processor 502 calls the executable program code stored in the memory 501 to execute the steps of the authentication access method for the customized signature applied to the content component as described in the first embodiment or the second embodiment of the present invention.

[0291] Example 5

[0292] An embodiment of the present invention discloses a computer storage medium storing computer instructions. When the computer instructions are called, they are used to execute the steps of the authentication access method for customized signatures applied to content-fragmented content as described in the first embodiment or the second embodiment of the present invention.

[0293] Example 6

[0294] An embodiment of the present invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute the steps of the authentication access method for custom signatures applied to content-fragmented components described in Example 1 or Example 2.

[0295] The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Those skilled in the art can understand and implement the present invention without inventive effort.

[0296] Through the detailed description of the above embodiments, those skilled in the art will clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by means of hardware. Based on this understanding, the above technical solution, in essence, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM), or other optical disk storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.

[0297] Finally, it should be noted that the authentication access method and device for customized signatures applied to content composition disclosed in the embodiments of the present invention are only preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.< / jwtpayload> < / nocheckjwtattribute> < / nocheckjwtattribute> < / nocheckjwtattribute> < / t> < / t>

Claims

1. An authentication access method for a custom signature applied to a component, characterized in that: The method comprises: When the server detects the client's first access operation, it generates a payload based on the input information sent by the client, which includes user information, system information, and expiration time; The server determines header information of the target token and a preset secret key, wherein the header information includes a token type and an encryption algorithm of the target token; The server encrypts the header information, the payload, and the secret key according to the encryption algorithm to obtain a signature; The server generates the target token according to the header information, the payload and the signature, and sends the target token to the client; The client stores the received target token, and when the client performs a re-access operation on the server, the client generates an access request corresponding to the re-access operation based on the target token, and sends the access request to the server; The server authenticates and confirms the access operation according to the target token in the access request, obtains an authentication result, and responds to the access request according to the authentication result.

2. The authentication access method for custom signatures applied to content-based content according to claim 1, characterized in that: The server authenticates and confirms the access operation according to the target token in the access request, and obtains an authentication result, including: The server parses the target token in the access request to obtain the parsed target header information, target payload, and target signature; The server encrypts the target header information, the target payload, and the secret key according to the encryption algorithm to obtain a verification signature; The server determines whether the verification signature matches the target signature and obtains an authentication result.

3. The authentication access method for custom signatures applied to content-based content according to claim 2, characterized in that: Before the server parses the target token in the access request, the method further includes: The server detects whether the access request contains the target token and obtains a detection result; When the detection result indicates that the access request does not include the target token, the server returns a first error code to the client, where the first error code indicates that the target token is missing from the access request.

4. The authentication access method for custom signatures applied to content-based content according to claim 2 or 3, characterized in that: The method further comprises: The server obtains the expiration time in the parsed target payload, and determines whether the target token in the access request has expired based on the expiration time, thereby obtaining a determination result; When the judgment result indicates that the target token is expired, the server returns a second error code to the client, where the second error code indicates that the target token is expired.

5. The authentication access method for custom signatures applied to content-based content according to any one of claims 1 to 3, characterized in that: The server encrypts the header information, the payload, and the secret key according to the encryption algorithm to obtain a signature, including: The server performs deserialization processing on the payload to obtain a character string corresponding to the payload; The server encodes the character string corresponding to the payload according to a preset encoding algorithm to obtain an encoded character string corresponding to the payload; The server encrypts the header information, the encoded string and the secret key according to the encryption algorithm to obtain a signature.

6. The authentication access method for custom signatures applied to content-based content according to claim 5, characterized in that: The server encrypts the header information, the encoded string, and the secret key according to the encryption algorithm to obtain a signature, including: The server encodes the header information according to the encoding algorithm to obtain an encoded character string corresponding to the header information; The server determines a target string according to the encoded string corresponding to the payload and the encoded string corresponding to the header information; The server encrypts the target character string and the secret key according to the encryption algorithm to obtain a signature.

7. The authentication access method for custom signatures applied to content-based content according to claim 5, characterized in that: The encoding algorithm includes the Base64Url encoding algorithm, and the encryption algorithm includes the HMACSHA256 algorithm.

8. An authentication access device for customized signatures applied to content composition, characterized in that: The device includes a server and a client, wherein the server includes a first generation module, a determination module, an encryption module, and an authentication module, and the client includes a storage module and a second generation module, wherein: The first generating module is configured to generate a payload based on input information sent by the client upon detecting the first access operation by the client, wherein the input information includes user information, system information, and expiration time; The determining module is used to determine header information of a target token and a preset secret key, wherein the header information includes a token type and an encryption algorithm of the target token; The encryption module is configured to encrypt the header information, the payload, and the secret key according to the encryption algorithm to obtain a signature; The first generating module is further configured to generate the target token according to the header information, the payload, and the signature, and send the target token to the client; The storage module is used to store the received target token; The second generating module is configured to generate an access request corresponding to the re-access operation based on the target token when the client performs a re-access operation on the server, and send the access request to the server; The authentication module is configured to authenticate and confirm the access operation according to the target token in the access request, obtain an authentication result, and respond to the access request according to the authentication result.

9. An authentication access device for customized signatures applied to content composition, characterized in that: The device comprises: a memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the authentication access method for custom signatures applied to content-fragmented content according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that The computer storage medium stores computer instructions, which, when called, are used to execute the authentication access method for custom signatures applied to content-fragmented content according to any one of claims 1 to 7.

Images