System authentication method and device, computer readable medium and electronic equipment

Abstract

The embodiment of the invention provides a system authentication method and device, a computer readable medium and electronic equipment, and the method comprises the steps: generating authentication information for a user when the user successfully logs in a system; encrypting the authentication information based on a preset key to obtain encrypted authentication information, and returning the encrypted authentication information to the user; when a user request is received, decrypting the encrypted authentication information in the user request based on a preset key; if the encrypted authentication information is successfully decrypted, determining whether the authentication information obtained by decryption is valid, and sending a user message in the user request to a message transfer party under the condition of determining that the authentication information is valid, so that the message transfer party schedules the user message to a target message processing party in a plurality of message processing parties, and processing the user message by the target message processing party. The embodiment of the invention can be applied to the cloud server, the convenience of using the service can be improved, and the concurrency and expansion capability of the service can be improved.

Description

Technical Field

[0001] This application relates to the field of access control technology, and more specifically, to a system authentication method, apparatus, computer-readable medium, and electronic device. Background Technology

[0002] Currently, many traditional software services require users to deploy them in a local environment. This process involves downloading and installing software, which is complex, costly, and makes upgrading the software services difficult. Summary of the Invention

[0003] The embodiments of this application provide a systematic authentication method, apparatus, computer-readable medium, and electronic device, which can at least to some extent improve the convenience of using services and enhance the concurrency and scalability of services.

[0004] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0005] According to one aspect of the embodiments of this application, a system authentication method is provided, the method comprising: when a user successfully logs into the system, generating authentication information for the user; encrypting the authentication information based on a pre-set key to obtain encrypted authentication information, and returning the encrypted authentication information to the user; when a user request is received, decrypting the encrypted authentication information in the user request based on the pre-set key; if the decryption of the encrypted authentication information is successful, determining whether the decrypted authentication information is valid, and if the authentication information is determined to be valid, sending the user message in the user request to a message relay party, so that the message relay party schedules the user message to a target message processor among multiple message processors, and the target message processor processes the user message.

[0006] According to one aspect of the embodiments of this application, an authentication device for a system is provided. The device includes: a generation unit, configured to generate authentication information for a user when the user successfully logs into the system; an encryption and return unit, configured to encrypt the authentication information based on a pre-set key to obtain encrypted authentication information, and return the encrypted authentication information to the user; a decryption unit, configured to decrypt the encrypted authentication information in a user request based on the pre-set key when a user request is received; and a determination and sending unit, configured to determine whether the decrypted authentication information is valid if the decryption of the encrypted authentication information is successful, and if the authentication information is determined to be valid, to send the user message in the user request to a message relay party, so that the message relay party can schedule the user message to a target message processor among multiple message processors, and the target message processor can process the user message.

[0007] In some embodiments of this application, based on the foregoing scheme, the device further includes a login verification unit; before generating authentication information for the user, the login verification unit is configured to: obtain the user account and password from the system login request from the user; verify the system login request based on the user account and the password; if the system login request passes verification, the user successfully logs into the system.

[0008] In some embodiments of this application, based on the foregoing scheme, the apparatus further includes a generation and storage unit; before obtaining the user account and password from the system login request from the user, the generation and storage unit is configured to: when the user completes registration in the system, generate first verification information based on the user's password, wherein the password cannot be determined based on the first verification information; store the user's account and the first verification information in a first storage space; the login verification unit is configured to: if the first storage space contains a user account that matches the user account in the system login request, obtain the first verification information stored corresponding to the user account; generate second verification information based on the password in the system login request; and determine whether the system login request passes verification based on the comparison result of the first verification information and the second verification information.

[0009] In some embodiments of this application, based on the foregoing scheme, the generation and storage unit is configured to: obtain the user's password and the user's account creation time; construct first original verification information based on the password and the user's account creation time, and perform a hash operation on the first original verification information to obtain first verification information; store the user's account, the user's account creation time, and the first verification information in a first storage space; the login verification unit is configured to: obtain the first verification information and the user's account creation time stored corresponding to the user's account; construct second original verification information based on the password and the user's account creation time in the system login request, and perform a hash operation on the second original verification information to obtain second verification information.

[0010] In some embodiments of this application, based on the aforementioned scheme, the authentication information includes the user's identification information, and the device further includes an identification information storage unit; after obtaining the encrypted authentication information, the identification information storage unit is used to: store the user's identification information in a second storage space; the determining and sending unit is configured to: determine whether the decrypted authentication information is valid based on whether there is identification information in the second storage space that is consistent with the decrypted user's identification information.

[0011] In some embodiments of this application, based on the foregoing scheme, the device further includes a setting unit and a resetting unit; after storing the user's identification information in the second storage space, the setting unit is used to: set a remaining timeout for the user's identification information in the second storage space; after determining whether the authentication information obtained by decryption is valid, the resetting unit is used to: reset the remaining timeout for the user's identification information in the second storage space.

[0012] In some embodiments of this application, based on the foregoing scheme, the authentication information includes time information describing the validity period of the authentication information, and the determining and sending unit is configured to: determine whether the decrypted authentication information is valid based on the time information obtained from decryption.

[0013] In some embodiments of this application, based on the foregoing scheme, the authentication information includes the identifier information of the generator of the authentication information, and the determining and sending unit is configured to: determine whether the decrypted authentication information is valid based on the identifier information of the generator obtained by decryption.

[0014] In some embodiments of this application, based on the aforementioned scheme, the device is applied to an authentication service, the authentication service includes multiple authentication service providers, and the generator of the encrypted authentication information and the decryptor of the encrypted authentication information are two different authentication service providers among the multiple authentication service providers.

[0015] According to one aspect of the embodiments of this application, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the authentication method of the system as described in the above embodiments.

[0016] According to one aspect of the embodiments of this application, an electronic device is provided, including: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the authentication method of the system as described in the above embodiments.

[0017] According to one aspect of the embodiments of this application, a computer program product is provided, the computer program product including computer instructions stored in a computer-readable storage medium, a processor of a computer device reading the computer instructions from the computer-readable storage medium, and the processor executing the computer instructions, causing the computer device to perform the authentication method of the system as described in the above embodiments.

[0018] In some embodiments of this application, after a user successfully logs into the system, authentication information is generated for them and encrypted using a pre-set key to obtain encrypted authentication information, which is then returned to the user. Then, upon receiving a user request carrying the encrypted authentication information, the encrypted authentication information is decrypted using a pre-set key. If decryption is successful, the validity of the decrypted authentication information is further determined. Finally, if the authentication information is deemed valid, the user message in the user request is sent to a message relay party. The message relay party then dispatches the user message to a target message processor among multiple message processors, where the target message processor processes the user message. In the solution of this application embodiment, on the one hand, since the user accesses the target message processor remotely, the user does not need to download and install the service locally, which greatly simplifies the operation, effectively improves the convenience of using the service, reduces the cost of use, and enhances the user experience; on the other hand, since authentication is performed by the execution subject of this application embodiment rather than the target message processor (i.e., the service), the solution of this application embodiment also achieves decoupling between authentication and message processing. That is to say, this application embodiment provides a stateless service, which can improve the concurrency and scalability of the service; in addition, thanks to the use of stateless service, the service is easier to upgrade and iterate, which can further improve the user experience.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0021] Figure 1 This diagram illustrates the principle of authentication when deploying an IDE in a user's local environment, as shown in related technologies.

[0022] Figure 2 This diagram illustrates the authentication principle when deploying an IDE as a cloud service in related technologies.

[0023] Figure 3 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown;

[0024] Figure 4 A flowchart of an authentication method for a system according to an embodiment of this application is shown;

[0025] Figure 5 An embodiment according to this application is shown. Figure 4 A flowchart of the steps preceding step 440 in the embodiment;

[0026] Figure 6 A schematic diagram illustrating the principle of system authentication according to an embodiment of this application is shown;

[0027] Figure 7 A schematic diagram of a user registration and login system according to an embodiment of this application is shown;

[0028] Figure 8 A flowchart illustrating a system login request verification based on a user account and password according to an embodiment of this application is shown;

[0029] Figure 9 A schematic diagram illustrating the principle of generating encrypted cookies according to an embodiment of this application is shown;

[0030] Figure 10 An embodiment according to this application is shown. Figure 4 A flowchart detailing the steps following step 450 and step 480 in the embodiment;

[0031] Figure 11 A schematic diagram illustrating the principle of cookie verification according to an embodiment of this application is shown;

[0032] Figure 12A block diagram of an authentication apparatus for a system according to an embodiment of this application is shown;

[0033] Figure 13 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0034] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0035] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0036] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0037] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0038] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0039] In related technologies, an Integrated Development Environment (IDE) is an application that provides a program development environment, typically including tools such as a code editor, compiler, debugger, and graphical user interface. In blockchain, an IDE can be used to edit and develop smart contracts.

[0040] Integrated development environments (IDEs) for blockchain technology include SmartEditor, RemixIDE, and AntDAO (open-sourced by Chang'an Chain). Users typically utilize IDEs in the following ways: Figure 1 and Figure 2 The two methods shown.

[0041] Figure 1 This diagram illustrates the authentication principle when deploying an IDE in a user's local environment, as described in related technologies. Please refer to... Figure 1 As shown, the authentication process when deploying an IDE in a user's local environment is as follows:

[0042] 1. The user's client establishes a session connection with the IDE service.

[0043] 2. The IDE service generates a session ID and returns it to the client. Both the IDE service and the client store the session ID as session information.

[0044] 3. The user's client sends a message to the IDE service, which carries session information.

[0045] 4. The IDE service verifies the session messages in the received messages based on the stored session information, and processes the messages after successful verification.

[0046] Figure 1 The technology shown describes deploying an IDE using a user's local environment or a user-built environment, typically a physical host. This technology provides services for a single user only, cannot be scaled, and requires users to download and install the IDE, resulting in complex operations and high operating costs.

[0047] Another related technology is to deploy the IDE as a cloud service. In this solution, the IDE service runs in a Pod and requires multiple Pods to meet disaster recovery and concurrency requirements. If session authentication is also used, then the IDE service becomes a stateful service.

[0048] Specifically, Figure 2 This diagram illustrates the authentication principle when deploying an IDE as a cloud service in related technologies. Please refer to... Figure 2As shown, the authentication process when deploying an IDE as a cloud service is as follows:

[0049] 1. The user's client sends a session request to the service to request the establishment of a session connection with the IDE service.

[0050] 2. The service forwards the session request to Pod1, and the IDE service deployed on Pod1 will generate a session identifier (SessionID).

[0051] 3. Pod1 returns the session identifier to the client. The IDE service on Pod1 and the client also store the session identifier as session information.

[0052] 4. The user's client sends a new request message to the service, which carries session information.

[0053] 5. The service forwards the request message to Pod2. Since Pod2 does not have the user's session information, authentication fails and the message is rejected.

[0054] As you can see, Figure 2 The related technology shown provides a stateful authentication service. However, when the IDE service is run in a multi-pod manner, messages are rejected, which causes problems for users. This makes it difficult to provide users with a solution for running the IDE service in a multi-pod manner, thereby reducing the concurrency and scalability of the service.

[0055] Therefore, this application first provides a systematic authentication method. The systematic authentication method provided by the embodiments of this application can overcome the above-mentioned deficiencies, not only enabling the deployment of IDE services in a cloud environment, thereby simplifying operations and reducing operating costs, but also providing a stateless service, which can improve the concurrency and scalability of the service and reduce the resource costs used by the service.

[0056] Figure 3 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown. For example... Figure 3As shown, the system architecture 300 may include a user terminal 310 and a cloud 320. The cloud 320 includes a proxy server 321 and an IDE server 322. The user terminal 310 establishes a communication connection with the cloud 320, enabling the user terminal 310 to communicate with the proxy server 321. The proxy server 321 and the IDE server 322 in the cloud 320 can also communicate with each other. The blockchain IDE system is deployed on the proxy server 321 and the IDE server 322 in the cloud 320, while the user terminal 310 has a client (such as a browser) deployed on it that can access the blockchain IDE system on the cloud 320. The IDE server 322 may include multiple Pods, each Pod may include one or more containers, and the containers in all the Pods may deploy the blockchain IDE service of the blockchain IDE system. The proxy server 321 deploys the authentication service of the blockchain IDE system, which acts as a proxy before the backend blockchain IDE service to perform authentication. When the authentication method of the system provided in this embodiment is applied... Figure 3 In the system architecture shown, a process can be as follows: First, the user sends a login request carrying their username and password to the blockchain IDE system in the cloud 320 through the client of user terminal 310. Then, the proxy server 321 receives the login request, verifies the username and password in the login request, and if the verification is successful, generates a cookie for the user and returns it to the user terminal 310. The user terminal 310 and the proxy server 321 will save the cookie. Next, the user sends a new login request carrying the cookie to the proxy server 321 through the client of user terminal 310. The proxy server 321 checks the validity of the cookie, and if the cookie is valid, forwards the user message in the login request to a Pod of the IDE server 322, where the blockchain IDE service processes the user message.

[0057] In some embodiments of this application, the proxy server 321 includes multiple Pods, each Pod including an authentication service. The proxy server 321 performs user account and password verification and cookie checking in the login request through different Pods in the proxy server 321.

[0058] In some embodiments of this application, the content of the cookie includes a user identifier, expiration date information, and generator information.

[0059] In some embodiments of this application, the cloud 320 also includes a database, and different Pods in the proxy server 321 verify login requests based on information in the database.

[0060] In some embodiments of this application, both the proxy server 321 and the IDE server 322 include a service module, and the request messages received by the proxy server 321 and the IDE server 322 are forwarded to the backend Pod for processing through their service modules.

[0061] It should be understood that Figure 3 The number of user terminals, cloud devices, and proxy servers and IDE servers in the cloud are merely illustrative. Depending on the implementation requirements, there can be any number of user terminals, cloud devices, proxy servers, and IDE servers; that is, there can be multiple user terminals and multiple cloud devices, and the proxy servers and IDE servers can be a server cluster composed of multiple servers.

[0062] It should be noted that Figure 3 The illustration shown is merely one embodiment of this application. Although in Figure 3 In the embodiment of the scheme, the service deployed on the cloud is a blockchain IDE service, but in other embodiments of this application, the service deployed on the cloud can be other types of IDE services, or even various other types of services; although in Figure 3 In the embodiment of the scheme, the authentication service is deployed in the cloud. However, in other embodiments of this application, the authentication service can also be deployed outside the cloud, such as on a regular server. Figure 3 In the embodiment, both the authentication service and the blockchain IDE service are deployed as Pods. Alternatively, they can be deployed as containers, and the authentication service can even be deployed without using Pods or containers. Figure 3 In the embodiment, the cookie contains a user identifier, and the user logs in using a user account. However, in other embodiments of this application, the user can also log in using a user identifier, and when the user logs in using a user account, the cookie can also contain the user account. This application does not limit the scope of protection in any way, nor should it restrict the scope of protection of this application.

[0063] As is readily understood, the authentication method of the system provided in this application embodiment is generally executed by the server, and correspondingly, the system authentication device is generally located in the server. However, in other embodiments of this application, the terminal device may also have similar functions to the server, thereby executing the authentication scheme of the system provided in this application embodiment.

[0064] Therefore, the embodiments of this application can be applied to terminals or servers. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, and this application does not impose any restrictions.

[0065] As mentioned above, the solutions in this application can be applied to cloud computing scenarios. Cloud computing is a computing model that distributes computing tasks across a resource pool composed of a large number of computers, enabling various application systems to obtain computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, the resources in the "cloud" are infinitely scalable, readily available, on-demand, expandable, and pay-as-you-go.

[0066] As a provider of fundamental cloud computing capabilities, a cloud resource pool (referred to as a cloud platform, generally called an IaaS (Infrastructure as a Service) platform) is established. Various types of virtual resources are deployed in the resource pool for external customers to choose from. The cloud resource pool mainly includes: computing devices (virtualized machines containing operating systems), storage devices, and network devices.

[0067] Based on logical function, a PaaS (Platform as a Service) layer can be deployed on top of the IaaS (Infrastructure as a Service) layer, and a SaaS (Software as a Service) layer can be deployed on top of the PaaS layer. Alternatively, SaaS can be deployed directly on top of IaaS. PaaS is a platform for running software, such as databases and web containers. SaaS refers to various types of business software, such as web portals and bulk SMS senders. Generally speaking, SaaS and PaaS are upper layers compared to IaaS.

[0068] As mentioned above, the solutions in this application embodiment can be used to build a blockchain IDE system. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer.

[0069] The underlying blockchain platform can include modules for user management, basic services, smart contracts, and operational monitoring. The user management module is responsible for managing the identity information of all blockchain participants, including maintaining public and private key generation (account management), key management, and maintaining the correspondence between user identities and blockchain addresses (access management). Under authorization, it also monitors and audits transactions of certain real identities and provides risk control rule configuration (risk control audit). The basic services module is deployed on all blockchain node devices to verify the validity of business requests. After consensus is reached on valid requests, they are recorded in storage. For a new business request, the basic services first perform interface adaptation parsing and authentication (interface adaptation), and then encrypt the business information using a consensus algorithm (consensus management). After encryption, the data is transmitted completely and consistently to the shared ledger (network communication) and recorded and stored. The smart contract module is responsible for contract registration, issuance, triggering, and execution. Developers can define contract logic using a programming language and publish it to the blockchain (contract registration). According to the contract terms, the key or other events are invoked to trigger execution and complete the contract logic. It also provides functions for contract upgrades and cancellations. The operation and monitoring module is mainly responsible for deployment, configuration modification, contract settings, cloud adaptation, and real-time status visualization output during product release, such as alarms, network status monitoring, and node device health status monitoring.

[0070] The platform's product service layer provides the basic capabilities and implementation frameworks for typical applications. Developers can leverage these basic capabilities, along with the specific characteristics of their business needs, to implement blockchain-based business logic. The application service layer provides blockchain-based application services to business stakeholders.

[0071] The implementation details of the technical solutions in the embodiments of this application are described in detail below:

[0072] Figure 4A flowchart illustrating an authentication method for a system according to an embodiment of this application is shown. This authentication method can be executed by various devices with processing and computing capabilities. Specifically, it can be executed by a target device, such as a user terminal or a cloud server. User terminals include, but are not limited to, mobile phones, computers, smart voice interaction devices, smart home appliances, vehicle terminals, aircraft, smartwatches, etc. Please refer to... Figure 4 As shown, the authentication method of this system includes at least the following steps:

[0073] Step 440: Once the user successfully logs into the system, generate authentication information for the user.

[0074] Step 450: Encrypt the authentication information based on the pre-set key to obtain encrypted authentication information, and return the encrypted authentication information to the user.

[0075] Step 470: Upon receiving a user request, decrypt the encrypted authentication information in the user request based on the pre-set key.

[0076] Step 480: If the encrypted authentication information is successfully decrypted, determine whether the decrypted authentication information is valid. If the authentication information is valid, send the user message in the user request to the message relay party so that the message relay party can schedule the user message to the target message processor among multiple message processors and process the user message.

[0077] In detail Figure 4 Before showing the steps, let's first introduce... Figure 4 The steps preceding the steps shown.

[0078] Figure 5 An embodiment according to this application is shown. Figure 4 A flowchart of the steps preceding step 440 in this embodiment. Please refer to [link / reference]. Figure 5 As shown, before generating authentication information for users, the authentication method of this system may include the following steps:

[0079] In step 410, the user account and password are obtained from the system login request from the user.

[0080] Users can enter their username and password in a form on the system's login page and click the "Login" button displayed on the page to trigger a system login request.

[0081] Figure 6 A schematic diagram illustrating the principle of system authentication according to an embodiment of this application is shown. Please refer to... Figure 6 As shown, when a user requests to log in, a login message is sent. This login message is the system login request, which carries the user's account and password.

[0082] The authentication method of the system provided in this application embodiment can be executed by the authentication service in the system (such as a blockchain IDE system), and the authentication service is an application used for authentication. The authentication service can be deployed on only one server, container or Pod; the authentication service can also include multiple authentication service providers, that is, the authentication service can be deployed on multiple containers or multiple Pods, and each authentication service provider is an authentication service deployed on one container or Pod.

[0083] A Pod is the smallest deployable unit of computation that can be created and managed in Kubernetes. Kubernetes is a portable, scalable, open-source platform for managing containerized workloads and services, facilitating declarative configuration and automation. A Pod is a group (or group of) containers that share storage, networking, and declarations of how to run them. The contents of a Pod are always colocated and scheduled together, running in a shared context. A Pod models an application-specific "logical host" containing one or more application containers that are relatively tightly coupled together. In non-cloud environments, applications running on the same physical machine or virtual machine are analogous to cloud applications running on the same logical host. Deployments provide declarative update capabilities for Pods. Users are responsible for describing the target state in a Deployment, and the Deployment controller changes the actual state at a controlled rate to bring it to the desired state. Deployments deploy stateless services, and this is the most commonly used controller. They are generally used to manage and maintain stateless microservices within an enterprise, such as ConfigServer, Zuul, and Spring Boot. It can manage Pods with multiple replicas to achieve seamless migration, automatic scaling up and down, automatic disaster recovery, one-click rollback and other functions.

[0084] Therefore, this application embodiment can use Deployment in Kubernetes to deploy the authentication service in the system provided in this application embodiment.

[0085] For details, please continue to see Figure 6 As shown, the actual authentication service application is deployed on each authentication (Auth) Pod after the authentication service (Service), and the authentication Service before each authentication Pod is the authentication service's Service. In Kubernetes, a Service is a way to expose a network application running on one or a group of Pods as a network service. All authentication Pods can be deployed on a physical server (host).

[0086] A key goal of Services in Kubernetes is to enable the use of unfamiliar service discovery mechanisms without modifying existing applications. Users can run code in Pods without worrying whether it's code designed for the cloud-native world or for legacy containerized applications. Users can use Services to make a group of Pods available on the network, allowing clients to interact with them. If users use Deployments to run applications, Deployments can dynamically create and destroy Pods. At any given moment, it's unknown how many such Pods are working or healthy; it might not even know how the healthy Pods are named. Kubernetes Pods are created and destroyed to match the expected state of the cluster. Pods are ephemeral resources (individual Pods shouldn't be expected to be both reliable and durable). Each Pod obtains its own IP address (Kubernetes expects network plugins to ensure IP address allocation). For a given Deployment in the cluster, the group of Pods running at one moment may be different from the group of Pods running the application at the next moment.

[0087] A Service is a component of Kubernetes; it's an abstraction that helps users expose compositions of Pods over the network. Each Service object defines the endpoints (typically Pods) of a logical group and the policies for accessing those Pods.

[0088] Please see Figure 6 As shown, it includes the following steps:

[0089] 1. Users send their login message to the authentication service through the client, which carries the user's account and password.

[0090] 2. The authentication service determines the destination for forwarding, namely authentication Pod1, through random methods or predetermined load balancing rules, and forwards the received login message to authentication Pod1.

[0091] Pre-defined load balancing rules could include assigning the least loaded authentication Pod to the Pod.

[0092] In one embodiment of this application, before obtaining the user account and password from the system login request from the user, the authentication method of the system may include the following steps: when the user completes registration in the system, first verification information is generated based on the user's password, wherein the password cannot be determined based on the first verification information; the user's account and the first verification information are stored in a first storage space.

[0093] After a user completes registration on the system, the system obtains the user's password. When a user requests access to the system for the first time, they need to register and submit a user-defined username and password. The username, also known as a user account or name, is a string used to uniquely identify the user, and can be information such as a mobile phone number or email address. Usernames are easy to remember, and the system can also provide users with the function to modify their usernames. In other embodiments of this application, the username and password can also be automatically generated by the system. For example, a username could be "account:12ada".

[0094] The initial verification information can be generated by directly hashing the user's password. The initial storage space can be a conventional database, such as a relational database.

[0095] Figure 7 A schematic diagram illustrating the principle of a user registration and login system according to an embodiment of this application is shown. Please refer to... Figure 7 As shown, the user registration and login process is as follows:

[0096] 1. Users send a registration request carrying a registration message to the authentication service through the client to register an account. The registration message includes the user's username and password.

[0097] 2. The authentication service forwards the registration message to the authentication Pod1 according to a random method or a predetermined load balancing rule.

[0098] In one embodiment of this application, generating first verification information based on a user's password includes: obtaining the user's password and the user's account creation time; constructing first original verification information based on the password and the user account creation time; and performing a hash operation on the first original verification information to obtain the first verification information.

[0099] The system stores the generated initial verification information, not the password. Furthermore, the password cannot be determined based on the initial verification information. This prevents user passwords from being leaked through the backend, thus improving user privacy and system security.

[0100] User account creation time can be the time when the user completes registration in the system. Once a user completes registration, the current time can be recorded as the user's registration completion time. User account creation time can be recorded in the standard year-month-day-hour-minute-second format, for example, 2023-12-12 08:00:00. Of course, user account creation time can also include only the year-month-day or only the hour-minute-second. Furthermore, user account creation time can also be a timestamp.

[0101] There are various ways to construct the initial verification information based on the password and user account creation time.

[0102] For example, the first original verification information can be obtained by concatenating the password and the user account creation time. In this case, the first verification information can be hash(user password + creation time). If the user account creation time is 2023-12-12 and the user password is adbsda, the first verification information can be hash(adbsda20231212). Of course, if the user account creation time is 2023-12-12 08:00:00, only a part of the user account creation time can be taken and concatenated with the user password for hashing. For example, "20231212" from the user account creation time can be concatenated with the user password, or "080000" from the user account creation time can be concatenated with the user password. Furthermore, if it is necessary to construct the initial verification information using the password and the complete user account creation time, other methods can be used. For example, the initial verification information can be obtained by concatenating the user account creation time and the password; in this case, the initial verification information can be hash(creation time + user password). Alternatively, a portion of the user account creation time (such as year, month, and day) can be concatenated before the password, and another portion (such as hour, minute, and second) can be concatenated after the password; in this case, the initial verification information can be hash(year, month, and day of creation time + user password + hour, minute, and second of creation time). Additionally, the initial verification information can also be obtained by incorporating the password and user account creation time into a specific data structure.

[0103] In one embodiment of this application, constructing first original verification information based on the password and the user account creation time includes: performing a hash operation on the password to obtain a first hash result; performing a hash operation on the user account creation time to obtain a second hash result; and concatenating the first hash result and the second hash result to obtain the first original verification information.

[0104] A hash algorithm, also known as a digest algorithm, is used to calculate a fixed-length output digest from any set of input data.

[0105] By constructing the first original verification information provided in the above embodiments, the security of system login can be guaranteed.

[0106] In this embodiment, by first constructing the first original verification information based on the password and the user account creation time, and then performing a hash operation on the first original verification information, the password information is salted. Even if the hash algorithm and hash password are leaked, password brute-force attacks will almost never occur, thus ensuring the security of system access.

[0107] If the first verification information is determined using the user account creation time, then the user account creation time needs to be stored.

[0108] In one embodiment of this application, storing a user's account and first verification information in a first storage space includes: storing the user's account, the user account creation time, and the first verification information in the first storage space.

[0109] When a user registers with the system, the system can also generate a unique identifier for that user, namely a user ID, which could be, for example, "1". The user's identifier can also be stored in association with their user account. Therefore, the user's account, account creation time, initial verification information, and identifier can be stored in the primary storage space (such as a database table).

[0110] Of course, other information can also be used for salting, as long as this information can be uniquely associated with the user and is saved in relation to the user account.

[0111] Please continue reading Figure 7 As shown, after the authentication service forwards the registration message to the authentication Pod1, the user registration and login process still includes the following steps:

[0112] 3. Authentication Pod1 saves the user account and the hash value generated based on the password to the database (DB).

[0113] Please continue reading Figure 5 As shown, in step 420, the system login request is verified based on the user account and password.

[0114] The system login request can be verified by matching the user account and password in the system login request.

[0115] Figure 8 A flowchart illustrating the verification of a system login request based on a user account and password according to an embodiment of this application is shown. Please refer to... Figure 8 As shown, the system login request is verified based on the user account and password, which may include the following steps:

[0116] In step 810, if a user account exists in the first storage space that matches the user account in the system login request, then the first verification information corresponding to the user account is obtained.

[0117] In this embodiment, the first storage space is queried to determine if the user account exists. If it exists, the password in the system login request is then verified. The system login request is considered successful only if the user account exists and the password passes verification. If the user account does not exist, or if the user account exists but the password fails verification, the system login request fails verification.

[0118] In one embodiment of this application, obtaining the first verification information stored corresponding to the user account includes: obtaining the first verification information stored corresponding to the user account and the user account creation time.

[0119] If the initial verification information is generated using the user account creation time, then it is also necessary to further obtain the user account creation time to verify the system login request.

[0120] By querying the database based on the user account, the first verification information corresponding to the user account and the user account creation time can be obtained.

[0121] In step 820, second verification information is generated based on the password in the system login request.

[0122] Based on the password in the system login request, generate the second verification information in the same way as generating the first verification information.

[0123] In one embodiment of this application, generating second verification information based on the password in the system login request includes: constructing second original verification information based on the password in the system login request and the user account creation time, and performing a hash operation on the second original verification information to obtain the second verification information.

[0124] Specifically, the second original verification information can be obtained by first concatenating the password in the system login request with the user account creation time, and then performing a hash operation on the second original verification information to obtain the second verification information.

[0125] In step 830, the system login request is determined to pass verification based on the comparison result between the first verification information and the second verification information.

[0126] If the first verification information matches the second verification information, then the system login request is deemed to have passed verification; otherwise, the system login request is deemed to have failed verification.

[0127] Please continue reading Figure 5As shown, in step 430, if the system login request passes verification, the user successfully logs into the system.

[0128] If the system login request is successfully verified, the user is redirected to the system's internal page; if the system login request fails verification, the user's login is denied.

[0129] Please continue reading Figure 7 As shown, after authentication Pod1 saves the user account and the hash value generated based on the password to the database (DB), the user registration and login process also includes the following steps:

[0130] 4. The user sends a system login request to the authentication service through the client. The system login request carries login information, including the user account and the password entered by the user.

[0131] 5. The authentication service forwards login messages to the authentication Pod3 according to a random method or a pre-defined load balancing rule.

[0132] As is easy to understand, the authentication service can forward login messages to any authentication Pod after the authentication service. Therefore, in this step, the login message is forwarded to authentication Pod3 and... Figure 6 The meaning of forwarding the login message to the authentication Pod1 in the embodiment is similar.

[0133] 6. Authentication Pod3 checks whether the user account and password in the login message match by querying the database (DB).

[0134] Below is a detailed introduction. Figure 4 The steps are shown in the example. Please refer to... Figure 4 As shown, the authentication method of this system includes at least the following steps:

[0135] In step 440, when a user successfully logs into the system, authentication information is generated for the user.

[0136] Authentication information is known as cookies. A cookie's statement may include at least one of the following: the user's identification information, time information describing the validity period of the authentication information, and the identification information of the party that generated the authentication information.

[0137] When applying the scheme of this application embodiment, the Cookie declaration content may include all of the above information.

[0138] The time information used to describe the validity period of authentication information can be, for example, the expiration time of a cookie, or the effective time and expiration period of a cookie. Specifically, the cookie's expiration period can be 6 hours, the effective time can be 2023-12-12 08:00:00, and the expiration time can be 2023-12-12 14:00:00. The identifier information for the generator of the authentication information can be an IDE, and the user's identifier information can be "1".

[0139] In step 450, the authentication information is encrypted based on a pre-set key to obtain encrypted authentication information, and the encrypted authentication information is returned to the user.

[0140] Authentication information can be encrypted using a pre-set symmetric encryption algorithm and key to generate the ciphertext of the cookie. For example, the pre-set symmetric encryption algorithm could be AES128, and the key could be 12qadad. If the ciphertext of the cookie is valid, the user can directly log in to the system using the ciphertext of the cookie without needing a username and password.

[0141] Please continue reading Figure 6 As shown, after the authentication service forwards the received login message to authentication Pod1, the following steps are also included:

[0142] 3. Authentication Pod1 checks the database to see if the user exists and if the password is correct. If the user exists and the password is correct, a cookie is generated.

[0143] Figure 9 A schematic diagram illustrating the principle of generating encrypted cookies according to an embodiment of this application is shown. Please refer to... Figure 9 As shown, the process of generating an encrypted cookie is as follows: First, a user cookie is generated. The declaration of the user cookie includes the user ID, the cookie expiration time (i.e., the cookie's validity period), the identifier of the cookie generator, and the cookie generation time. Then, the user cookie is encrypted using the AES algorithm and a key obtained from the backend database to obtain the ciphertext of the cookie, and the ciphertext of the cookie is returned to the user.

[0144] It's easy to understand that the same key can be used to encrypt cookies for all users; of course, different keys can also be used to encrypt cookies for different users; or different keys can be used to encrypt cookies for different batches of users, while the same key can be used to encrypt cookies for the same batch of users.

[0145] Figure 10 An embodiment according to this application is shown. Figure 4 A flowchart detailing the steps following step 450 and step 480 in the embodiment. Please refer to [link / reference]. Figure 10 As shown, after obtaining the encrypted authentication information, the authentication method of this system may include the following steps:

[0146] In step 460, the user's identification information is stored in the second storage space.

[0147] The second storage space can be a cache, such as a Redis database. User identification information and encrypted authentication information can be stored in the second storage space.

[0148] In this embodiment of the application, by generating a user ID and storing the user ID in the second storage space, the format can be made more standardized and uniform, which facilitates querying and management. Since it is hidden in the background and cannot be seen by the user, the security of information can be improved. Moreover, the user ID cannot be modified, while the user account can be modified, thus the system provides users with the ability to modify their user accounts.

[0149] Although in this application embodiment the first verification information and the encrypted authentication information are stored in different storage spaces, in other embodiments of this application the two can be stored in the same storage space.

[0150] Please continue reading Figure 9 As shown, after obtaining the ciphertext of the cookie, the user ID and the ciphertext of the cookie are saved to the Redis database with the user ID as the key and the ciphertext of the cookie as the value.

[0151] Please continue reading Figure 6 As shown, after generating a cookie, the following steps are also included:

[0152] 4. Authentication Pod1 saves the user ID and corresponding cookie to Redis.

[0153] In one embodiment of this application, after storing the user's identification information in the second storage space, the method further includes: setting a remaining timeout for the user's identification information in the second storage space.

[0154] When user identification information and encrypted authentication information are stored in the secondary storage space, the remaining timeout is actually the cache timeout period for the cached user identification information and encrypted authentication information. If the storage time of the user identification information and encrypted authentication information in the secondary storage space exceeds the cache timeout period, the secondary storage space (such as Redis) will automatically delete the cookie to reduce the risk of cookie leakage due to prolonged inactivity. The remaining timeout period can be 30 minutes. Please see below. Figure 9 As shown, the time-to-live (TTL) setting for encrypted cookies in Redis is 30 minutes.

[0155] In step 470, when a user request is received, the encrypted authentication information in the user request is decrypted based on a pre-set key.

[0156] The encrypted authentication information can be decrypted using a pre-set symmetric encryption algorithm and a key obtained from a database.

[0157] The received user request message can contain encrypted authentication information and user messages.

[0158] In step 480, if the encrypted authentication information is successfully decrypted, it is determined whether the decrypted authentication information is valid. If the authentication information is determined to be valid, the user message in the user request is sent to the message relay party so that the message relay party can schedule the user message to the target message processor among multiple message processors, and the target message processor can process the user message.

[0159] The message relay can determine the target message processor to which the message is dispatched by using a random method or according to load balancing rules.

[0160] In this embodiment, the message relay and the target message processor can be IDE services within a system (such as a blockchain IDE system). An IDE service can include multiple message processors; that is, the IDE service can be deployed on multiple containers or Pods, with each message processor being an IDE service deployed on a single container or Pod. By adopting this approach, Deployments can be used to deploy IDE services, achieving statelessness. This allows for seamless migration, automatic scaling up and down, automatic disaster recovery, one-click rollback, and other functionalities, enhancing the service's concurrency and scalability.

[0161] Figure 11 A schematic diagram illustrating the principle of cookie verification according to an embodiment of this application is shown. Please refer to... Figure 11As shown, the process includes the following steps: After receiving a user's IDE request, first check if the encrypted cookie exists in the user's IDE request. If not, return an error message directly and reject the user's IDE request. If the encrypted cookie exists in the user's IDE request, query the database for a pre-set key (the key used to encrypt the cookie), and decrypt the cookie's encrypted text based on this key and a pre-set symmetric encryption algorithm. Then, determine whether the decryption was successful. If the decryption failed, return an error message to the user and reject the user's IDE request. If the decryption was successful, continue executing the subsequent verification logic.

[0162] In one embodiment of this application, the authentication information includes time information describing the validity period of the authentication information. Determining whether the decrypted authentication information is valid includes: determining whether the decrypted authentication information is valid based on the time information obtained from the decryption.

[0163] If a cookie includes an expiration date and a generation time, then the validity of the authentication information can be determined by adding the generation time to the expiration date and comparing the sum with the current time. Specifically, if the generation time is 2023-12-12 08:00:00 and the expiration time is 6 hours, then the sum is 2023-12-12 14:00:00. Then, it is checked whether the current time has exceeded this time. If it has, the cookie has expired; otherwise, the cookie is still valid.

[0164] Please continue reading Figure 11 As shown, after successfully decrypting the ciphertext of the cookie, the following process is also included: adding the generation time and the expiration date, comparing the sum with the current time to determine whether the cookie has expired; if the cookie has expired, an error message is returned to the user, and the user's IDE request is rejected.

[0165] In one embodiment of this application, the authentication information includes the identifier information of the generator of the authentication information. Determining whether the decrypted authentication information is valid includes: determining whether the decrypted authentication information is valid based on the identifier information of the generator obtained through decryption.

[0166] The generator's identification information obtained from decryption is compared with the identification information of this system (such as "IDE"). If they match, the generator's identification information passes verification; if they do not match, the generator's identification information fails verification.

[0167] In one embodiment of this application, the authentication information includes the user's identification information. Determining whether the decrypted authentication information is valid includes: determining whether the decrypted authentication information is valid based on whether there is identification information in the second storage space that is consistent with the decrypted user's identification information.

[0168] Of course, if the second storage space also stores encrypted authentication information, i.e., the ciphertext of the cookie, then the validity of the decrypted authentication information can be determined by checking whether encrypted authentication information corresponding to the decrypted user's identification information exists in the second storage space. This method is essentially the same as the method used in the above embodiments to determine the validity of the decrypted authentication information.

[0169] In one embodiment of this application, after determining whether the authentication information obtained through decryption is valid, the method further includes: resetting the remaining timeout for the user's identification information in the second storage space.

[0170] Specifically, the remaining timeout period for the user's identification information and the corresponding stored encrypted authentication information can be reset.

[0171] In this embodiment of the application, by resetting the remaining timeout time, the cookies of users who need to use the service frequently in the short term can be used by the users continuously, thereby improving the convenience of users using the service.

[0172] Please continue reading Figure 11 As shown, after determining that the cookie has not expired based on the comparison between the sum and the current time, the following process is also included: checking whether there is encrypted authentication information with the corresponding key being the user ID in Redis. If it does not exist, it means that the cookie has not been used for a long time, and an error message is returned to reject the user's request; if it exists, it means that the cookie is normal. At this time, the TTL time of the user cookie cache in Redis is refreshed to 30 minutes, indicating that the user is still using the cookie, thereby keeping the current cookie alive; finally, authentication is completed, and the user message in the user's IDE request is forwarded to the IDE service.

[0173] Please continue reading Figure 6 As shown, after authentication Pod1 saves the user ID and cookie to Redis, the following steps are also included:

[0174] 5. The user makes a new request call, that is, the user sends a new user request to the authentication service through the client to access the IDE service. The user request carries the cookie provided by the authentication Pod1, and the user does not need to use an account and password.

[0175] 6. The authentication service determines the destination for forwarding, namely authentication Pod3, through random means or according to the predetermined load balancing rules, and forwards the message in the received request to the authentication Pod3.

[0176] 7. The authentication Pod3 checks the cookies in the message by querying Redis. If the cookies pass the check successfully, the authentication Pod3 forwards the user message to the IDE Service.

[0177] When Pod3 examines cookies in a message, it needs to decrypt the ciphertext of the cookies; that is, in this embodiment of the application, the generator of the encrypted authentication information and the decryptor of the encrypted authentication information are two different authentication service providers among multiple authentication service providers.

[0178] 8. Authentication Pod3 forwards user messages to the IDE service.

[0179] The IDE service is the aforementioned message relay.

[0180] 9. The IDE service determines the destination for forwarding, namely IDEPod1, through random means or according to predetermined load balancing rules, and forwards the received user messages to IDEPod1.

[0181] 10. After processing the message, the IDE service on IDE Pod1 returns a processing response, thus enabling users to use the IDE service.

[0182] In summary, the authentication method of the system provided in this application embodiment can achieve at least the following technical effects: It realizes SaaS-ification of the blockchain IDE, providing a stateless service, improving the service's concurrency and scalability, reducing the resource costs of service usage, and enabling more users to be served with the same resource consumption, making the IDE cloud solution more economically advantageous. Simultaneously, statelessness makes the service easier to upgrade and iterate, providing users with a better product experience. Furthermore, since user access to the IDE requires authentication, a network security solution is provided, which can prevent malicious sniffing of cloud service resources by contracts, protect IDE business services and other cloud services, make remote contract debugging of the IDE possible, and provide users with free and convenient contract simulation and debugging functions.

[0183] In summary, this application proposes a web authentication solution for a stateless blockchain IDE SaaS service. It provides the functionality of an online blockchain IDE. Compared to the Chang'an Chain IDE and other contract IDEs (Remix IDE) that provide tools and use the user's local environment, the IDE service in this application provides SaaS services. Users can log in to the platform to edit and simulate contracts online. The service runs in a cloud cluster, avoiding the cumbersome environment installation and resource costs for users. Simulated contract debugging does not actually occur on the blockchain, so no gas fees are incurred. Contracts can be debugged immediately after they are built.

[0184] The following describes an embodiment of the apparatus described in this application, which can be used to execute the authentication method of the system described in the above embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the authentication method of the system described in the above embodiments of this application.

[0185] Figure 12 A block diagram of an authentication apparatus for a system according to an embodiment of this application is shown. (Refer to...) Figure 12 As shown, an authentication device 1200 according to an embodiment of this application includes: a generation unit 1210, an encryption and return unit 1220, a decryption unit 1230, and a determination and sending unit 1240. The generation unit 1210 generates authentication information for a user upon successful login to the system. The encryption and return unit 1220 encrypts the authentication information using a pre-set key to obtain encrypted authentication information and returns it to the user. The decryption unit 1230 decrypts the encrypted authentication information in a user request using the pre-set key upon receiving a user request. The determination and sending unit 1240, if the decryption of the encrypted authentication information is successful, determines whether the decrypted authentication information is valid, and if the authentication information is valid, sends the user message in the user request to a message relay party, so that the message relay party schedules the user message to a target message processor among multiple message processors for processing.

[0186] In some embodiments of this application, based on the foregoing scheme, the device further includes a login verification unit; before generating authentication information for the user, the login verification unit is configured to: obtain the user account and password from the system login request from the user; verify the system login request based on the user account and the password; if the system login request passes verification, the user successfully logs into the system.

[0187] In some embodiments of this application, based on the foregoing scheme, the apparatus further includes a generation and storage unit; before obtaining the user account and password from the system login request from the user, the generation and storage unit is configured to: when the user completes registration in the system, generate first verification information based on the user's password, wherein the password cannot be determined based on the first verification information; store the user's account and the first verification information in a first storage space; the login verification unit is configured to: if the first storage space contains a user account that matches the user account in the system login request, obtain the first verification information stored corresponding to the user account; generate second verification information based on the password in the system login request; and determine whether the system login request passes verification based on the comparison result of the first verification information and the second verification information.

[0188] In some embodiments of this application, based on the foregoing scheme, the generation and storage unit is configured to: obtain the user's password and the user's account creation time; construct first original verification information based on the password and the user's account creation time, and perform a hash operation on the first original verification information to obtain first verification information; store the user's account, the user's account creation time, and the first verification information in a first storage space; the login verification unit is configured to: obtain the first verification information and the user's account creation time stored corresponding to the user's account; construct second original verification information based on the password and the user's account creation time in the system login request, and perform a hash operation on the second original verification information to obtain second verification information.

[0189] In some embodiments of this application, based on the aforementioned scheme, the authentication information includes the user's identification information, and the device further includes an identification information storage unit; after obtaining the encrypted authentication information, the identification information storage unit is used to: store the user's identification information in a second storage space; the determination and sending unit 1240 is configured to: determine whether the decrypted authentication information is valid based on whether there is identification information in the second storage space that is consistent with the decrypted user's identification information.

[0190] In some embodiments of this application, based on the foregoing scheme, the device further includes a setting unit and a resetting unit; after storing the user's identification information in the second storage space, the setting unit is used to: set a remaining timeout for the user's identification information in the second storage space; after determining whether the authentication information obtained by decryption is valid, the resetting unit is used to: reset the remaining timeout for the user's identification information in the second storage space.

[0191] In some embodiments of this application, based on the foregoing scheme, the authentication information includes time information describing the validity period of the authentication information, and the determining and sending unit 1240 is configured to: determine whether the decrypted authentication information is valid based on the time information obtained from decryption.

[0192] In some embodiments of this application, based on the aforementioned scheme, the authentication information includes the identifier information of the generator of the authentication information, and the determining and sending unit 1240 is configured to: determine whether the decrypted authentication information is valid based on the identifier information of the generator obtained by decryption.

[0193] In some embodiments of this application, based on the aforementioned scheme, the device is applied to an authentication service, the authentication service includes multiple authentication service providers, and the generator of the encrypted authentication information and the decryptor of the encrypted authentication information are two different authentication service providers among the multiple authentication service providers.

[0194] Figure 13 A schematic diagram of the structure of a computer system suitable for implementing an electronic device according to an embodiment of the present application is shown.

[0195] It should be noted that Figure 13 The computer system 1300 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0196] like Figure 13 As shown, the computer system 1300 includes a Central Processing Unit (CPU) 1301, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 1302 or programs loaded from storage portion 1308 into Random Access Memory (RAM) 1303, such as performing the methods described in the above embodiments. Various programs and data required for system operation are also stored in RAM 1303. The CPU 1301, ROM 1302, and RAM 1303 are interconnected via bus 1304. An Input / Output (I / O) interface 1305 is also connected to bus 1304.

[0197] The following components are connected to I / O interface 1305: an input section 1306 including a keyboard, mouse, etc.; an output section 1307 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1308 including a hard disk, etc.; and a communication section 1309 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 1309 performs communication processing via a network such as the Internet. A drive 1310 is also connected to I / O interface 1305 as needed. Removable media 1311, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1310 as needed so that computer programs read from them can be installed into storage section 1308 as needed.

[0198] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1309, and / or installed from removable medium 1311. When the computer program is executed by central processing unit (CPU) 1301, it performs various functions defined in the system of this application.

[0199] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0200] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. Among them, each box in the flowchart or block diagram can represent a module, program segment, or part of the code, and the above-mentioned module, program segment, or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0201] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. In some cases, the names of these units do not constitute limitations on the units themselves.

[0202] In one aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0203] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0204] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application.

[0205] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0206] The data collection and processing plan outlined in this application must be implemented in strict accordance with the requirements of relevant national laws and regulations, obtaining the informed consent or separate consent of the data subject (or having a legal basis as stipulated by the relevant national laws and regulations), and conducting subsequent data use and processing within the scope authorized by laws and regulations and the data subject.

[0207] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A systematic authentication method, characterized in that, The method comprises: When a user successfully logs into the system, authentication information is generated for that user; The authentication information is encrypted using a pre-set key to obtain encrypted authentication information, which is then returned to the user. Upon receiving a user request, the encrypted authentication information in the user request is decrypted based on the pre-set key; If the encrypted authentication information is successfully decrypted, it is determined whether the decrypted authentication information is valid. If the authentication information is determined to be valid, the user message in the user request is sent to the message relay party so that the message relay party can schedule the user message to the target message processor among multiple message processors, and the target message processor can process the user message.

2. The authentication method of the system according to claim 1, characterized in that, Before generating authentication information for the user, the method further includes: Obtain the user's username and password from the system login request received by the user; The system login request is verified based on the user account and the password. If the system login request is verified, the user successfully logs into the system.

3. The authentication method of the system according to claim 2, characterized in that, Before obtaining the user account and password from the system login request from the user, the method further includes: When the user completes registration in the system, first verification information is generated based on the user's password, wherein the password cannot be determined based on the first verification information; The user's account and the first verification information are stored in the first storage space; The step of verifying the system login request based on the user account and the password includes: If the first storage space contains a user account that matches the user account in the system login request, then obtain the first verification information stored corresponding to the user account; Generate second verification information based on the password in the system login request; The system login request is determined to pass verification based on the comparison result between the first verification information and the second verification information.

4. The authentication method of the system according to claim 3, characterized in that, The step of generating the first verification information based on the user's password includes: Obtain the user's password and the user's account creation time; The first original verification information is constructed based on the password and the user account creation time, and a hash operation is performed on the first original verification information to obtain the first verification information. The step of storing the user's account and the first verification information in the first storage space includes: The user's account, the user account creation time, and the first verification information are stored in the first storage space; The step of obtaining the first verification information stored corresponding to the user account includes: Obtain the first verification information and the user account creation time stored corresponding to the user account; The step of generating second verification information based on the password in the system login request includes: The second original verification information is constructed based on the password in the system login request and the user account creation time, and a hash operation is performed on the second original verification information to obtain the second verification information.

5. The authentication method of the system according to claim 1, characterized in that, The authentication information includes the user's identification information. After obtaining the encrypted authentication information, the method further includes: Store the user's identification information in the second storage space; Determining whether the authentication information obtained through decryption is valid includes: The validity of the decrypted authentication information is determined based on whether there is an identifier in the second storage space that matches the identifier information of the decrypted user.

6. The authentication method of the system according to claim 5, characterized in that, After storing the user's identification information in the second storage space, the method further includes: Set the remaining timeout for the user's identification information in the second storage space; After determining whether the authentication information obtained through decryption is valid, the method further includes: The remaining timeout period is reset for the user's identification information in the second storage space.

7. The authentication method of the system according to claim 1, characterized in that, The authentication information includes time information describing the validity period of the authentication information, and determining whether the decrypted authentication information is valid includes: The validity of the authentication information obtained from decryption is determined based on the time information obtained from the decryption.

8. The authentication method of the system according to claim 1, characterized in that, The authentication information includes the identifier information of the generator of the authentication information, and determining whether the decrypted authentication information is valid includes: The validity of the authentication information obtained from the decryption is determined based on the identifier information of the generator obtained from the decryption.

9. The authentication method of the system according to any one of claims 1-8, characterized in that, The method is executed by an authentication service, which includes multiple authentication service providers. The generator of the encrypted authentication information and the recipient of the user request are two different authentication service providers among the multiple authentication service providers.

10. A system authentication device, characterized in that, The device comprises: The generation unit is used to generate authentication information for the user when the user successfully logs into the system. The encryption and return unit is used to encrypt the authentication information based on a pre-set key to obtain encrypted authentication information, and return the encrypted authentication information to the user. The decryption unit is used to decrypt the encrypted authentication information in the user request based on the pre-set key when a user request is received. The determining and sending unit is configured to, if the encrypted authentication information is successfully decrypted, determine whether the decrypted authentication information is valid, and if the authentication information is determined to be valid, send the user message in the user request to the message relay party, so that the message relay party can schedule the user message to a target message processor among multiple message processors, and the target message processor can process the user message.

11. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the authentication method of the system as described in any one of claims 1 to 9.

12. An electronic device, characterized in that, include: one or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the authentication method of the system as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium, a processor of a computer device reading the computer instructions from the computer-readable storage medium, and the processor executing the computer instructions to cause the computer device to perform the authentication method of the system as described in any one of claims 1 to 9.

Images