Token renewal authentication method and device, program product and electronic equipment

Abstract

The invention provides a token renewal authentication method and device, a program product and electronic equipment, and relates to the technical field of computers. The method comprises the following steps: receiving a Token renewal request sent by a client; the Token renewal request carries first behavior record information of the client; and performing verification processing on the first behavior record information of the client, and if the verification is passed, issuing a new login state Token to the client. According to the method and the device, verification of the user behavior sequence can be additionally added, namely verification of the first behavior record information is added, so that the security threshold of Token renewal is improved, and the security and the reliability of Token renewal authentication are improved to a certain extent.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computers and Internet technologies. More specifically, the embodiments of the present disclosure relate to a token renewal authentication method, a token renewal authentication device, a computer program product, and an electronic device. Background Art

[0002] Currently, when a user logs in to a client for the first time, they are authenticated through a trusted authentication method. Upon successful authentication, a user login token is returned to the client. The client then carries this token in all network requests it makes to the server to request services.

[0003] The client sends a token renewal request to the server system at regular intervals. After receiving the request, the server verifies whether the token is valid. If it is still within the validity period, it generates a new valid token based on the user ID (userId) corresponding to the token and returns it to the client. If the server determines that the token is no longer valid, it will not generate a new valid token and the client will log out. Summary of the Invention

[0004] However, because token renewal lacks a security verification mechanism, if a valid token from the first login is stolen, the thief can continue to renew the token. Furthermore, if there is a client-side program failure, a server-side program failure, or the token is lost during network transmission, the user's login token cannot be renewed.

[0005] In view of this, the present disclosure provides a token renewal authentication method, a token renewal authentication device, a computer program product and an electronic device to improve the security and reliability of token renewal authentication to a certain extent.

[0006] According to a first aspect of the present disclosure, a token renewal authentication method is provided, the method comprising:

[0007] Receive a token renewal request sent by a client; the token renewal request carries the client's first behavior record information;

[0008] Verify the first behavior of the client as recorded information, and if the verification passes, issue a new login token to the client.

[0009] In a possible implementation, the client's first behavior record information carried in the Token renewal request includes a behavior description.

[0010] In a possible implementation, the behavior description includes a behavior name and a behavior time.

[0011] In a possible implementation, the behavior description includes a behavior operation object.

[0012] In a possible implementation manner, the behavior description includes an IP address.

[0013] In a possible implementation, the verifying the first behavior record information of the client includes:

[0014] Verification is performed based on the first behavior record information sent by the client and the second behavior record information recorded by the server for the client.

[0015] In one possible implementation, the token renewal request further carries identity credential information of the client, and the verification process based on the first behavior record information sent by the client and the second behavior record information recorded by the server for the client includes:

[0016] Parsing the first behavior record information to obtain at least one line of behavior record content;

[0017] Verify the behavior record content of each row in the at least one row and the identity credential information according to the second behavior record information to obtain at least one verification result;

[0018] When the at least one verification result indicates that the verification is passed, it is determined that the verification is passed.

[0019] In a possible implementation, verifying the behavior record content of each row in the at least one row and the identity credential information based on the second behavior record information to obtain at least one verification result includes:

[0020] For each line of the at least one line, the following operations are performed:

[0021] determining whether the first device identification information in the second behavior record information and the second device identification information in the identity credential information are the same;

[0022] If it is determined that the first device identification information and the second device identification information are the same, searching the second behavior record information for a target record corresponding to the information of the behavior operation object in each line of the behavior record;

[0023] If the target record is found, determine whether the target record and the behavior name, behavior time, and IP address in each line of the behavior record content meet the preset conditions;

[0024] If it is determined that the target record and the behavior name, behavior time, and IP address in each line of the behavior record content meet the preset conditions, then determining whether the second behavior record information and the user identification information in each line of the behavior record content are the same;

[0025] If it is determined that the second behavior record information is identical to the user identification information in each line of the behavior record content, it is determined that the verification of each line of the behavior record content has passed, and a verification result indicating that the verification of each line of the behavior record has passed is obtained.

[0026] In a possible implementation, before receiving the token renewal request sent by the client, the method includes:

[0027] Sending a behavior recording task to the client; wherein the first behavior recording information is behavior information recorded according to the behavior recording task.

[0028] In a possible implementation, the behavior recording task sent to the first client is different from the behavior recording task sent to the second client.

[0029] In a possible implementation, before verifying the first behavior record information of the client, the method further includes:

[0030] receiving a service request sent by the client;

[0031] Obtaining single behavior information of the server according to the business request;

[0032] According to the obtained single behavior information of the plurality of servers, second behavior record information recorded by the server for the client is obtained.

[0033] In a possible implementation, after obtaining the second behavior record information recorded by the server for the client, the method further includes:

[0034] Determining a preset format index for recording information of the second behavior, and storing the recording information of the second behavior using the preset format index;

[0035] The preset format index includes device identification information when sending the service request, operation object information, and the time when the operation object is executed.

[0036] According to a second aspect of the present disclosure, a token renewal authentication device is provided, the device comprising:

[0037] A receiving unit, configured to receive a token renewal request sent by a client; the token renewal request carries the first action record information of the client;

[0038] A verification unit, configured to verify the first behavior record information;

[0039] The sending unit is configured to issue a new login token to the client if the verification is passed.

[0040] In a possible implementation, the client's first behavior record information carried in the Token renewal request includes a behavior description.

[0041] In a possible implementation, the behavior description includes a behavior name and a behavior time.

[0042] In a possible implementation, the behavior description includes a behavior operation object.

[0043] In a possible implementation manner, the behavior description includes an IP address.

[0044] In a possible implementation, the verification unit is specifically configured to:

[0045] Verification is performed based on the first behavior record information sent by the client and the second behavior record information recorded by the server for the client.

[0046] In a possible implementation, the Token renewal request further carries the identity credential information of the client, and the verification unit is specifically configured to:

[0047] Parsing the first behavior record information to obtain at least one line of behavior record content;

[0048] Verify the behavior record content of each row in the at least one row and the identity credential information according to the second behavior record information to obtain at least one verification result;

[0049] When the at least one verification result indicates that the verification is passed, it is determined that the verification is passed.

[0050] In a possible implementation, the verification unit is specifically configured to:

[0051] For each line of the at least one line, the following operations are performed:

[0052] determining whether the first device identification information in the second behavior record information and the second device identification information in the identity credential information are the same;

[0053] If it is determined that the first device identification information and the second device identification information are the same, searching the second behavior record information for a target record corresponding to the information of the behavior operation object in each line of the behavior record;

[0054] If the target record is found, determine whether the target record and the behavior name, behavior time, and IP address in each line of the behavior record content meet the preset conditions;

[0055] If it is determined that the target record and the behavior name, behavior time, and IP address in each line of the behavior record content meet the preset conditions, then determining whether the second behavior record information and the user identification information in each line of the behavior record content are the same;

[0056] If it is determined that the second behavior record information is identical to the user identification information in each line of the behavior record content, it is determined that the verification of each line of the behavior record content has passed, and a verification result indicating that the verification of each line of the behavior record has passed is obtained.

[0057] In a possible implementation, before receiving the token renewal request sent by the client, the sending unit is further configured to:

[0058] Sending a behavior recording task to the client; wherein the first behavior recording information is behavior information recorded according to the behavior recording task.

[0059] In a possible implementation, the behavior recording task sent to the first client is different from the behavior recording task sent to the second client.

[0060] In a possible implementation, the device further includes a processing unit configured to:

[0061] receiving a service request sent by the client;

[0062] Obtaining single behavior information of the server according to the business request;

[0063] According to the obtained single behavior information of the plurality of servers, second behavior record information recorded by the server for the client is obtained.

[0064] In a possible implementation, the device further includes a storage unit, configured to:

[0065] Determining a preset format index for recording information of the second behavior, and storing the recording information of the second behavior using the preset format index;

[0066] The preset format index includes device identification information when sending the service request, operation object information, and the time when the operation object is executed.

[0067] According to a third aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the method of the first aspect and possible implementations thereof are implemented.

[0068] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the method of the above-mentioned first aspect and its possible implementation methods by executing the executable instructions.

[0069] The technical solution disclosed in this disclosure has the following beneficial effects:

[0070] In the disclosed embodiment, a token renewal request sent by a client can be received; wherein the token renewal request carries the client's first behavior record information, and then the client's first behavior record information is verified and processed; if the verification passes, a new login-state token is issued to the client. It can be seen that in the disclosed embodiment, verification processing can be performed based on the client's first behavior record information, which provides a more secure user login-state automatic renewal mechanism. For risky users and risky devices, additional verification of the user behavior sequence is added, thereby raising the security threshold of token renewal and, to a certain extent, improving the security and reliability of token renewal authentication.

[0071] Other features and advantages of the present disclosure will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present disclosure. The purposes and other advantages of the present disclosure can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments of the present disclosure. Obviously, the drawings introduced below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0073] Figure 1 A flowchart illustrating a related token renewal authentication method is shown;

[0074] Figure 2 A schematic diagram illustrating a usage scenario of a user login state Token in this exemplary embodiment;

[0075] Figure 3A schematic diagram showing a specific user operation behavior sequence in this exemplary embodiment;

[0076] Figure 4 A schematic diagram of an application scenario in this exemplary embodiment is shown;

[0077] Figure 5 A schematic diagram illustrating another application scenario in this exemplary embodiment;

[0078] Figure 6 A schematic diagram showing a flow chart of a token renewal authentication method in this exemplary embodiment;

[0079] Figure 7 A schematic diagram showing a process flow of business execution in this exemplary embodiment is shown;

[0080] Figure 8 A schematic structural diagram of a token renewal authentication device in this exemplary embodiment is shown;

[0081] Figure 9 A schematic structural diagram of an electronic device in this exemplary embodiment is shown. DETAILED DESCRIPTION

[0082] In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure. In the absence of conflict, the embodiments in the present disclosure and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0083] The terms "comprises" and "comprising" and any variations thereof in the specification and claims of this disclosure are intended to cover non-exclusive protection. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements, but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or apparatus.

[0084] In the embodiments of the present disclosure, one or more, "many" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or plural.

[0085] It should be noted that the terms "first," "second," and the like in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order, precedence, size, and priority. For example, the first client and the second client in the embodiments of the present disclosure are only used to distinguish different clients. It should be understood that the terms used in this way are interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of apparatuses and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.

[0086] The following describes exemplary embodiments of the present disclosure in conjunction with the accompanying drawings. The accompanying drawings are schematic diagrams of the present disclosure and are not necessarily drawn to scale. Some of the block diagrams shown in the accompanying drawings may be functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, or in hardware modules or integrated circuits, or in networks, processors or microcontrollers. The embodiments can be implemented in various forms and should not be construed as being limited to the examples set forth herein. The features, structures or characteristics described in the present disclosure can be combined in one or more embodiments in any suitable manner. In the description below, many specific details are provided to provide a full description of the embodiments of the present disclosure. However, those skilled in the art will appreciate that one or more specific details may be omitted when implementing the technical solutions of the present disclosure, or that other methods, components, devices, steps, etc. may be used to replace one or more specific details.

[0087] It should be noted that in the embodiments of this disclosure, certain software, components, models, and other existing industry solutions may be mentioned. These should be considered exemplary and are intended solely to illustrate the feasibility of implementing the technical solutions of this disclosure. This does not mean that the applicant has or will necessarily use such solutions. The collection, dissemination, use, and display of data in this technical solution comply with relevant national laws and regulations. SUMMARY OF THE INVENTION

[0089] See also Figure 1 As shown, Figure 1 This is a flowchart of the automatic renewal solution for client user login status token in related technology.

[0090] When a user logs in to a client for the first time, the server verifies the user through a trusted authentication method (such as mobile phone number verification, SMS verification code, account and password). Upon successful verification, the server returns a user login token to the client. After this, the client includes the previously obtained user login token in all network requests it makes to the server, and requests services normally.

[0091] The client periodically sends a token renewal request to the server. Upon receiving the request, the server verifies the token's validity. If it is still valid, it generates a new valid token based on the user ID associated with the token and returns it to the client. If the token is no longer valid, no new valid token is generated, and the client is logged out.

[0092] It can be seen that the solutions provided in the related art have the following problems:

[0093] (1) Insufficient availability. The client needs to regularly send token renewal requests to the server. If the user is inactive or the token renewal frequency is too low, the automatic renewal mechanism may not be effective for most clients.

[0094] (2) Low security. Once a thief obtains a valid user token during the first login, there is no security verification mechanism for subsequent renewals, and the token can be renewed almost at no cost.

[0095] (3) Poor reliability. If there is a client program failure, a server program failure, or the token is lost during network transmission, it may result in the inability to renew the existing login token.

[0096] In view of this, the present disclosure provides a token renewal authentication method, through which a token renewal request sent by a client can be received; wherein the token renewal request carries the client's first behavior record information, and then the client's first behavior record information is verified and processed; if the verification passes, a new login-state token is issued to the client. It can be seen that in the embodiment of the present disclosure, verification processing can be performed based on the client's first behavior record information, that is, a more secure user login-state automatic renewal mechanism is provided, and the verification of the user behavior sequence is additionally added for risky users and risky devices, thereby raising the security threshold of token renewal and improving the security and reliability of token renewal authentication to a certain extent.

[0097] Application Scenario Overview

[0098] To better understand the technical solutions provided by the embodiments of the present disclosure, the following briefly introduces the application scenarios to which the technical solutions provided by the embodiments of the present disclosure are applicable. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present disclosure and are not limiting. In specific implementations, the technical solutions provided by the embodiments of the present disclosure can be flexibly applied according to actual needs.

[0099] In the embodiments of the present disclosure, in order to facilitate understanding of the technical solutions provided by the present disclosure, some key terms involved in the present disclosure are first introduced below:

[0100] (1) User Identity Document (ID): The unique identity of a user in a software system.

[0101] (2) User login token: User login token is a secure, scalable and convenient mechanism for verifying user identity and maintaining session status. It provides an effective way to protect user privacy and system security. For example, see Figure 2 As shown, Figure 2 A schematic diagram of a common usage scenario of a user login token provided in an embodiment of the present disclosure.

[0102] Specifically, using user login tokens can meet the following requirements:

[0103] 1. Authentication: After a user logs in, the system issues a unique token to the user. When the user makes subsequent requests, the token is sent to the server for verification to confirm the user's identity and permissions. This helps prevent unauthorized users from accessing sensitive information or performing certain operations.

[0104] 2. Session state maintenance: Tokens can be used to maintain the user's session state. By storing the token in a client cookie or local storage, users can remain logged in when switching between different pages without having to re-authenticate.

[0105] 3. Scalability and support for distributed environments: In distributed systems, using tokens for authentication and session state maintenance is more scalable. Because tokens are stored on the client, each service in the system can independently verify the validity of the token without maintaining a shared session state.

[0106] 4. Security: Using tokens for authentication can improve security. Tokens can be signed using cryptographic algorithms to ensure their integrity and authenticity. Furthermore, tokens can have an expiration date, requiring users to re-authenticate upon expiration.

[0107] (3) User action sequence: an ordered set of actions or behaviors performed by a user within a specific timeframe. These actions include clicking, browsing pages, searching, submitting forms, purchasing products, and so on in applications and websites. For example, see Figure 3 As shown, Figure 3 A schematic diagram of a specific user operation behavior sequence provided in an embodiment of the present disclosure.

[0108] See also Figure 4 As shown, Figure 4 This is an application scenario to which the technical solution of the embodiment of the present disclosure can be applied. In this scenario diagram, a terminal device 110 and an electronic device 120 are included. There may be one or more terminal devices 110, and each terminal device 110 may be provided with a client, so that different users can log in to the client on the corresponding terminal device 110. The client provided on each terminal device 110 may be different, and different clients may be clients developed for different operating systems. Figure 4 In the figure, a terminal device 110 is used as an example. The electronic device 120 can be understood as a device provided with a server. In addition, the terminal device 110 and the electronic device 120 communicate with each other via one or more networks 130.

[0109] In the disclosed embodiment, if a user logs in to the client deployed on the corresponding terminal device 110 for the first time, the client sends the user's login credentials to the gateway, which then forwards the login credentials to the server deployed on the electronic device 120. The server deployed on the electronic device 120 can then verify the login credentials and return a user login token to the client after the verification is successful. Furthermore, the server can receive a token renewal request sent by the client; the token renewal request carries the client's first behavior record information; the server can then verify the client's first behavior record information and, if the verification is successful, issue a new login token to the client.

[0110] In the embodiment of the present disclosure, the client has newly added a client local behavior recording module and a client Token and other credential management modules. Among them, the client local behavior recording module is used to store user behavior record data locally on the client. For example, the user behavior record data is the song IDs of the ten songs that the user has recently listened to using this client, the start and end time of each song, etc. The client Token and other credential managers are used to store credential information such as the login state Token, current device ID, device fingerprint, etc. obtained after the user is authenticated and logged in for the first time through a trusted authentication method. In other words, the client can independently and securely save such credential information.

[0111] In the embodiment of the present disclosure, the server also adds a server-side device behavior recording module and a Token management module. Among them, the server-side device behavior recording module is used to store user behavior record data on the server. User behavior record data, for example, the song IDs of the ten songs that the user has recently listened to using a certain device, the start and end time of listening to each song, etc. In addition, the server-side device behavior recording module can retrieve user behavior according to dimensions such as user ID and device ID. The Token management module is used to issue a login token to the corresponding device after the user's account is verified, determine whether a login token is legal, and whether the login token can be renewed successfully.

[0112] For example, see Figure 5As shown, when the client sends a normal business request to the server through the gateway, the server-side device behavior recording module can record the behavior corresponding to the business request and store the user behavior record data. When the client sends a Token renewal request to the server through the gateway; wherein, the Token renewal request carries the client's first behavior record information; then, the server can verify the client's first behavior record information. If the verification passes, a new login state Token is issued to the client, that is, the automatic renewal of the login state Token is realized. In addition, when an abnormality occurs in the login state Token, the server verifies the user behavior record data corresponding to the client by identifying and authenticating the client data stored in the server-side device behavior recording module. If the verification passes, the login state Token corresponding to the user ID of the client is reissued. In other words, the server can solve the problem of being unable to renew the existing login state Token due to client program failure, server program failure, loss of Token during network transmission, etc., thereby improving the reliability of the system. Among them, Figure 5 The gateway can parse out common information such as user device type, client version information, device ID, etc. from the request sent by the client, and rely on the Token management module to parse out information such as the user ID corresponding to the logged-in user state, assisting the server to implement the management of the two functions of Token authentication interception and automatic renewal.

[0113] In the embodiments of the present disclosure, Figure 4 The terminal device 110 can be a mobile phone, a tablet computer (PAD), a personal computer, a smart TV, a smart watch, a smart speaker, a smart car device, and a wearable device, but is not limited thereto.

[0114] In the embodiments of the present disclosure, Figure 4 The electronic device 120 may also be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server or cloud server cluster that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms, but is not limited to these.

[0115] Of course, the method provided in the embodiment of the present disclosure is not limited to Figure 4 The application scenario shown can also be used in other possible application scenarios, for example, only the electronic device 120 executes the token renewal authentication method, which is not limited in the embodiment of the present disclosure.

[0116] Exemplary Methods

[0117] To further illustrate the technical solutions provided by the embodiments of the present disclosure, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of the present disclosure provide the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiments of the present disclosure. In the actual processing process or when the device is executed, the method may be executed in the order of the methods shown in the embodiments or drawings or in parallel.

[0118] See Figure 6 , Figure 6 FIG. 1 is a flow chart of a token renewal authentication method according to an embodiment of the present disclosure. The flow of the method may be executed by an electronic device, which may be Figure 4 The electronic device 120 in the embodiment of the present invention is implemented as follows:

[0119] Step 601: Receive a token renewal request sent by a client; the token renewal request carries the client's first behavior record information.

[0120] In the embodiment of the present disclosure, after the user logs in to the client, the client can communicate with the server, so that the server can send a behavior recording task to the client; wherein the first behavior recording information is the behavior information recorded according to the behavior recording task.

[0121] In the disclosed embodiment, to enhance security, the server may issue personalized behavior recording tasks for user IDs. In other words, the behavior recording tasks sent by the server to the first client are different from those sent to the second client.

[0122] For example, a task is sent to client 1 to record the behavior of user A corresponding to client 1 performing playback and clicking the search box, and a task is sent to client 2 to record the behavior of user B corresponding to client 2 performing playback and clicking the scan code button.

[0123] It can be seen that the behavior recording task sent by the server to the client can be a personalized behavior recording task issued to different users. In this way, when the login token is subsequently renewed and verified, more accurate verification basic information can be provided, thereby improving the verification accuracy.

[0124] In an embodiment of the present disclosure, when a user performs a behavior in a behavior recording task issued by a server, the client can store the single behavior in a preset format.

[0125] Optionally, the preset format of a single action is as shown in Table 1 below:

[0126]

[0127]

[0128] Table 1

[0129] In the embodiment of the present disclosure, the client can store the single action records shown in Table 1 in a local file in the order of the start time of occurrence, and then determine the first action record information based on the stored single action information. Optionally, the first action record information can be understood as a sequence of user operation actions.

[0130] In an embodiment of the present disclosure, the server can receive a service request sent by the client, and then obtain the server's single behavior information based on the service request, and obtain the second behavior record information recorded by the server for the client based on the obtained single behavior information of multiple servers.

[0131] In an embodiment of the present disclosure, after obtaining the second behavior record information recorded by the server for the client, the server can determine a preset format index of the second behavior record information and store the second behavior record information with the preset format index; wherein the preset format index includes the device identification information when sending the service request, the operation object information, and the time when the behavior of executing the operation object occurs.

[0132] That is to say, the server's storage format for single actions remains consistent with that of the client. In addition, the server can store multiple single action records in the database in the order of the starting events that occurred, thereby obtaining the second action record information. Among them, the preset format index includes: device ID + operateObjectType operation object behavior + operateObjectID + actionStartTime. Optionally, the server can also store the second action record information of each client separately, so that it is convenient to quickly find the second action record information of the client later, and quickly query and verify the action record of a specific row based on the preset format index.

[0133] In an embodiment of the present disclosure, when a server receives a token renewal request from a client, it can determine that the client's first behavior record information carried in the token renewal request includes a behavior description. Optionally, the behavior description includes a behavior name and a behavior time. Optionally, the behavior description includes a behavior operation object. Optionally, the behavior description includes an IP address. In other words, the first behavior record information includes at least one of the behavior name, behavior time, operation pair, and IP address.

[0134] Step 602: Verify the first behavior record information of the client. If the verification passes, issue a new login token to the client.

[0135] In the embodiment of the present disclosure, verification processing may be performed based on the first behavior record information sent by the client and the second behavior record information recorded by the server for the client.

[0136] In one possible implementation, the token renewal request also carries the client's identity credential information. The server can parse the first behavior record information to obtain at least one line of behavior record content, and then verify the behavior record content and identity credential information of each line in the at least one line based on the second behavior record information to obtain at least one verification result. In this way, when at least one verification result indicates that the verification is passed, it is determined that the verification is passed.

[0137] In an embodiment of the present disclosure, the following operations are performed for each line of behavior record content in at least one row: determining whether the first device identification information in the second behavior record information and the second device identification information in the identity credential information are the same; if it is determined that the first device identification information and the second device identification information are the same, searching the second behavior record information for a target record corresponding to the information of the behavior operation object in each line of the behavior record content; if the target record is found, determining whether the target record and the behavior name, behavior time and IP address in each line of the behavior record content meet preset conditions; if it is determined that the target record and the behavior name, behavior time and IP address in each line of the behavior record content meet preset conditions, determining whether the second behavior record information and the user identification information in each line of the behavior record content are the same; if it is determined that the second behavior record information and the user identification information in each line of the behavior record content are the same, determining that the verification of each line of the behavior record content has passed, and obtaining a verification result indicating that the verification of each line of the behavior record has passed.

[0138] In the embodiment of the present disclosure, if the verification is successful according to the verification result, a new login token is issued to the client. If the verification fails according to the verification result, no new login token is issued to the client.

[0139] In the embodiment of the present disclosure, when the client carries a locally stored behavior record file and requests the server to verify it, the server parses each line of behavior record content in the request and verifies each line of behavior record content.

[0140] Optionally, the server can determine whether each line of behavior record content meets the following verification conditions:

[0141] (1) The device ID in the second behavior record information recorded by the server is the same as the behavior record content of the current row in the first behavior record information of the client, that is, the device ID of the current request;

[0142] (2) The server searches for the server record based on the device ID + the name of the operateObjectType operation object + the ID of the operateObjectID operation object in the current row of the client's first behavior record information, and is able to find the server record;

[0143] (3) The action, IP, actionStartTime, actionEndTime, and operateObjectContent (if any) recorded in the second action record on the server are completely consistent with the action record content of the current row in the first action record on the client;

[0144] (4) The userID in all records on the client and server is the same;

[0145] In this way, when the content of each line of behavior record meets all of the above four verification conditions, it means that the user behavior recorded by the client is completely consistent with the user behavior information recorded by the server, and the user ID of the operation is unique and clear.

[0146] In this embodiment, the unique user ID found in the verification step above indicates that the device has been used by the user, and the likelihood of local activity records being falsified is extremely low. Therefore, the device can be considered highly secure and likely used by a legitimate user. Therefore, the user's device login token can be renewed and a new login token issued.

[0147] In the embodiment of the present disclosure, if a large-scale failure of the client program or the server program occurs, "compensation" for the login-state Token can be urgently enabled. Specifically, for a token renewal request, if the unique user ID found in the above verification step can determine that the device has been used by this user ID, a new login-state Token can be issued even if the renewal request does not carry the last issued Token. In this way, it is possible to avoid the situation where a large number of users log out of the login state and cannot make business requests normally and must log in again when a large-scale failure of the client program or the server program occurs, and the risk that a sudden large number of login requests may cause the login system to be overwhelmed, thereby improving system security.

[0148] In the embodiment of the present disclosure, if a small number of network requests from a small number of users lose the login token, and based on the unique user ID found in the above verification step, it can be determined that the device has been used by this user ID, then it can be determined whether the user's attribute information is the preset attribute. For example, if the user's attribute information is that of an ordinary user, a new login token can be issued. Moreover, issuing a new login token may fix the problem of the token being lost during transmission between the client and the server.

[0149] The verification scheme disclosed in this disclosure, based on the first behavior record information of the client and the second behavior record information of the server, can be applied not only to the security verification scenario of automatic renewal of users in the user login state, but also to other verification scenarios for determining whether the client is a robot program. It can also greatly increase the difficulty of forging requests and conducting business security attacks, thereby improving system security. In addition, since the login state requirement is no longer strongly dependent on the previous client login state token, even if there is a client program failure, a server program failure, or the token is lost during network transmission, the user login state token is still likely to be successfully renewed, thereby improving the user experience.

[0150] To better introduce the token renewal authentication scheme provided by this disclosure, see Figure 7 As shown, the token renewal authentication solution provided by the present disclosure is introduced below by taking a business execution process as an example.

[0151] exist Figure 7 When a user logs in to a client for the first time, they can send their login credentials to the client. The login credentials include at least one of a mobile phone number, a text message verification code, or an account password. The client can then send the login credentials to the server through the gateway. Once the server verifies the credentials, it sends the user's login status token to the client through the gateway.

[0152] exist Figure 7 In the example, the client can receive a task from the server that includes a local behavior recording task. For example, the local behavior to be recorded is listening to music. Thus, when a user listens to music through the client, the client can send a request to the server to obtain song A, so that the server can record the information about song A. Furthermore, the client can record the information about song A.

[0153] exist Figure 7 In the example, when the client initiates a token renewal request to the server, the token renewal request carries the information of song A. The server then compares the information of song A with the information of song A it has recorded. When it is determined that the verification is passed, a new user login token can be issued and sent to the client.

[0154] It can be seen that the embodiment of the present disclosure provides a more secure user login state automatic renewal mechanism. For risky users and risky devices, additional verification of user behavior sequences can be added to improve the security threshold of user login state token renewal.

[0155] Exemplary devices

[0156] The exemplary embodiment of the present disclosure also provides a token renewal authentication device. Figure 8 As shown, the token renewal authentication device 800 includes the following program units:

[0157] The receiving unit 801 is configured to receive a token renewal request sent by a client; the token renewal request carries the first action record information of the client;

[0158] A verification unit 802 is configured to verify the first behavior record information;

[0159] The sending unit 803 is configured to issue a new login token to the client if the verification is successful.

[0160] In a possible implementation, the client's first behavior record information carried in the Token renewal request includes a behavior description.

[0161] In a possible implementation, the behavior description includes a behavior name and a behavior time.

[0162] In a possible implementation, the behavior description includes a behavior operation object.

[0163] In a possible implementation manner, the behavior description includes an IP address.

[0164] In a possible implementation, the verification unit 802 is specifically configured to:

[0165] Verification is performed based on the first behavior record information sent by the client and the second behavior record information recorded by the server for the client.

[0166] In a possible implementation, the Token renewal request further carries the identity credential information of the client, and the verification unit 802 is specifically configured to:

[0167] Parsing the first behavior record information to obtain at least one line of behavior record content;

[0168] Verify the behavior record content of each row in the at least one row and the identity credential information according to the second behavior record information to obtain at least one verification result;

[0169] When the at least one verification result indicates that the verification is passed, it is determined that the verification is passed.

[0170] In a possible implementation, the verification unit 802 is specifically configured to:

[0171] For each line of the at least one line, the following operations are performed:

[0172] determining whether the first device identification information in the second behavior record information and the second device identification information in the identity credential information are the same;

[0173] If it is determined that the first device identification information and the second device identification information are the same, searching the second behavior record information for a target record corresponding to the information of the behavior operation object in each line of the behavior record;

[0174] If the target record is found, determine whether the target record and the behavior name, behavior time, and IP address in each line of the behavior record content meet the preset conditions;

[0175] If it is determined that the target record and the behavior name, behavior time, and IP address in each line of the behavior record content meet the preset conditions, then determining whether the second behavior record information and the user identification information in each line of the behavior record content are the same;

[0176] If it is determined that the second behavior record information is identical to the user identification information in each line of the behavior record content, it is determined that the verification of each line of the behavior record content has passed, and a verification result indicating that the verification of each line of the behavior record has passed is obtained.

[0177] In a possible implementation, before receiving the token renewal request sent by the client, the sending unit 803 is further configured to:

[0178] Sending a behavior recording task to the client; wherein the first behavior recording information is behavior information recorded according to the behavior recording task.

[0179] In a possible implementation, the behavior recording task sent to the first client is different from the behavior recording task sent to the second client.

[0180] In a possible implementation, the device further includes a processing unit configured to:

[0181] receiving a service request sent by the client;

[0182] Obtaining single behavior information of the server according to the business request;

[0183] According to the obtained single behavior information of the plurality of servers, second behavior record information recorded by the server for the client is obtained.

[0184] In a possible implementation, the device further includes a storage unit, configured to:

[0185] Determining a preset format index for recording information of the second behavior, and storing the recording information of the second behavior using the preset format index;

[0186] The preset format index includes device identification information when sending the service request, operation object information, and the time when the operation object is executed.

[0187] The specific details of each part of the above-mentioned device have been described in detail in the implementation method part. The undisclosed details can be found in the implementation method part, so they will not be repeated here.

[0188] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the exemplary embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0189] Exemplary Program Products

[0190] The exemplary embodiments of the present disclosure further provide a computer program product, which includes a computer program, and when the computer program is executed by a processor, implements the above token renewal authentication method.

[0191] In one embodiment, a computer program product may be a tangible product containing a computer program, such as a computer-readable storage medium storing the computer program. The computer-readable storage medium may be a storage medium based on electrical, magnetic, optical, electromagnetic, infrared, or other signals, including but not limited to random access memory (RAM), read-only memory (ROM), magnetic tape, floppy disk, flash memory (Flash), mechanical hard disk drive (HDD), solid-state drive (SSD), and the like. Exemplarily, the computer program product may be implemented as a non-volatile storage medium storing the computer program, such as a read-only memory, a NAND flash memory (NandFlash), and the like.

[0192] In one embodiment, the computer program product may be an intangible product containing a computer program. For example, the computer program product may be implemented as a virtual digital product, such as a digital file such as an executable file or installation package storing the computer program.

[0193] The code of the computer program can be written in one or more programming languages. Programming languages include C, Java, C++, etc. The program code can be executed entirely on the user computing device, partially on the user computing device, or as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device via any type of network, such as a local area network (LAN), a wide area network (WAN), etc., or can be connected to an external computing device (e.g., via an Internet connection provided by a carrier).

[0194] Computer programs can be carried or transmitted via electrical, magnetic, optical, electromagnetic, infrared, or other signals. Electronic devices can convert signals carrying computer programs into digital signals, thereby running the computer programs. When the computer program runs on an electronic device, its code is used to cause the electronic device to execute (more specifically, to cause the processor of the electronic device to execute) the method steps of various exemplary embodiments of the present disclosure, such as the above-mentioned token renewal authentication method, which includes the following steps:

[0195] Step 601: Receive a token renewal request from the client; the token renewal request carries the client's first behavior record information; Step 602: Verify the client's first behavior record information, and if the verification passes, issue a new login token to the client.

[0196] By implementing the above method steps through a computer program, a token renewal request sent by a client can be received; wherein the token renewal request carries the client's first behavior record information, and then the client's first behavior record information is verified and processed; if the verification passes, a new login-state token is issued to the client. It can be seen that in the disclosed embodiment, verification processing can be performed based on the client's first behavior record information, thereby providing a more secure user login-state automatic renewal mechanism. For risky users and risky devices, additional user behavior sequence verification is added, thereby raising the security threshold of token renewal and, to a certain extent, improving the security and reliability of token renewal authentication.

[0197] Exemplary electronic devices

[0198] The exemplary embodiments of the present disclosure further provide an electronic device. The electronic device may include a processor and a memory. The memory stores executable instructions for the processor, such as a computer program. The processor executes the executable instructions to perform the method steps of various exemplary embodiments of the present disclosure.

[0199] Reference below Figure 9 , the electronic device is exemplarily described in the form of a general-purpose computing device. It should be understood that Figure 9 The electronic device 900 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0200] like Figure 9 As shown, the electronic device 900 may include: a processor 910 , a memory 920 , a bus 930 , an I / O (input / output) interface 940 , and a network adapter 950 .

[0201] The memory 920 may include volatile memory, such as RAM 921 and cache unit 922, and may also include non-volatile memory, such as ROM 923. The memory 920 may also include one or more program modules 924. Such program modules 924 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. For example, the program modules 924 may include the various units in the aforementioned apparatus.

[0202] The processor 910 may include one or more processing units, for example: the processor 910 may include an AP (Application Processor), a modem processor, a GPU (Graphics Processing Unit), an ISP (Image Signal Processor), a controller, an encoder, a decoder, a DSP (Digital Signal Processor), a baseband processor and / or an NPU (Neural-Network Processing Unit), etc.

[0203] The processor 910 can be used to execute executable instructions stored in the memory 920, such as the above-mentioned token renewal authentication method, which includes the following steps: Step 601: Receive a token renewal request sent by the client; the token renewal request carries the client's first behavior record information; Step 602: Verify the client's first behavior record information, and if the verification passes, issue a new login status Token to the client.

[0204] By executing the above method steps through processor 910, a token renewal request sent by a client can be received; wherein, the token renewal request carries the client's first behavior record information, and then the client's first behavior record information is verified and processed; if the verification passes, a new login-state token is issued to the client. It can be seen that in the embodiment of the present disclosure, verification processing can be performed based on the client's first behavior record information, that is, a more secure user login-state automatic renewal mechanism is provided, and additional verification of user behavior sequences is added for risky users and risky devices, thereby raising the security threshold of token renewal and, to a certain extent, improving the security and reliability of token renewal authentication.

[0205] The bus 930 is used to connect different components of the electronic device 900 and may include a data bus, an address bus, and a control bus.

[0206] The electronic device 900 can communicate with one or more external devices 1000 (eg, a keyboard, a mouse, an external controller, etc.) through the I / O interface 940 .

[0207] The electronic device 900 can communicate with one or more networks via the network adapter 950. For example, the network adapter 950 can provide mobile communication solutions such as 3G / 4G / 5G / 6G, or wireless communication solutions such as wireless LAN, Bluetooth, and near-field communication. The network adapter 950 can communicate with other modules of the electronic device 900 via the bus 930.

[0208] although Figure 9 Not shown, other hardware and / or software modules may also be provided in the electronic device 900, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0209] As can be seen from the above, the technical solutions of the present disclosure can be implemented as methods, devices, systems, computer program products, storage media, electronic devices, etc. Those skilled in the art will understand that various aspects of the present disclosure can be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, such as "circuit", "module" or "system".

[0210] It should be understood that the present disclosure is not limited to the specific method steps or structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. Those skilled in the art will easily think of other embodiments based on the specific embodiments provided by the present disclosure. Therefore, the specific embodiments provided by the present disclosure are merely exemplary, and the scope and spirit of the present disclosure are indicated by the claims, which should cover any variations, uses or adaptive changes of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the field of the present technology that are not disclosed in the present disclosure.

Claims

1. A token renewal authentication method, characterized in that: The method comprises: Receive a token renewal request sent by a client; the token renewal request carries the client's first behavior record information; Verifying the first behavior record information of the client; If the verification passes, a new login token is issued to the client.

2. The method according to claim 1, characterized in that The client's first behavior record information carried in the Token renewal request includes a behavior description.

3. The method according to claim 2, characterized in that The behavior description includes the behavior name and behavior time.

4. The method according to claim 2, characterized in that The behavior description includes a behavior operation object.

5. The method according to claim 2, characterized in that The behavior description includes an IP address.

6. The method according to claim 1, characterized in that The verifying and processing the first behavior record information of the client includes: Verification is performed based on the first behavior record information sent by the client and the second behavior record information recorded by the server for the client.

7. The method according to claim 6, characterized in that The token renewal request also carries the identity credential information of the client. The verification process based on the first behavior record information sent by the client and the second behavior record information recorded by the server for the client includes: Parsing the first behavior record information to obtain at least one line of behavior record content; Verify the behavior record content of each row in the at least one row and the identity credential information according to the second behavior record information to obtain at least one verification result; When the at least one verification result indicates that the verification is passed, it is determined that the verification is passed.

8. A token renewal authentication device, characterized in that: The device comprises: A receiving unit, configured to receive a token renewal request sent by a client; the token renewal request carries the first action record information of the client; A verification unit, configured to verify the first behavior record information; The sending unit is configured to issue a new login token to the client if the verification is passed.

9. An electronic device, characterized in that: include: processor; a memory for storing executable instructions of the processor; The processor is configured to perform the method according to any one of claims 1 to 7 by executing the executable instructions.

10. A computer program product having a computer program stored thereon, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images