Access authentication method and system based on message queue telemetry transport protocol

Abstract

The application relates to a message queue telemetry transport protocol-based access authentication method and system, wherein the message queue telemetry transport protocol-based access authentication method comprises the following steps: after receiving a user login request sent by a message queue telemetry transport client, performing identity authentication on the user, and after the identity authentication succeeds, generating a core ticket and user permission information; after receiving an access request sent by the message queue telemetry transport client, performing validity verification on the core ticket in the access request, and after confirming the validity, generating a common ticket; and the message queue telemetry transport client uses the common ticket and the user permission information to access a message queue telemetry transport server. The method can separate identity authentication and service access, realizes bidirectional authentication between the message queue telemetry transport client and the message queue telemetry transport server, and improves the security of user password transmission of the message queue telemetry transport client.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information technology and software development, in particular to an access authentication method and system based on a message queue telemetry transport protocol. BACKGROUND

[0002] The message queue telemetry transport (MQTT) protocol is a lightweight, publish-subscribe-based message transmission protocol suitable for resource-constrained devices and low-bandwidth, high-latency or unstable network environments. It is widely used in Internet of Things applications and can enable efficient communication between sensors, actuators and other devices.

[0003] An MQTT client refers to any application or device running an MQTT client library, such as an instant messaging application using the MQTT protocol, various sensors reporting data using the MQTT protocol, and various MQTT testing tools. An MQTT server refers to a key component responsible for handling MQTT client requests, including connection establishment, disconnection, subscription and unsubscription, and is also responsible for message forwarding.

[0004] MQTT services are usually built on public networks, and existing MQTT services only support some simple authentication, such as password authentication and token authentication. There are problems such as insecure password transmission for MQTT clients, and inability for mutual authentication between MQTT clients and MQTT servers. SUMMARY

[0005] The present application provides an access authentication method and system based on a message queue telemetry transport protocol to solve the problems of insecure password transmission for MQTT clients and inability for mutual authentication between MQTT clients and MQTT servers in related technologies.

[0006] In a first aspect, the present application provides an access authentication method based on a message queue telemetry transport protocol for authenticating a service; the authentication service is connected to an MQTT client and an MQTT server to enable mutual authentication between the MQTT client and the MQTT server; the method comprises:

[0007] After receiving a registration request sent by the MQTT server, the identity of the MQTT server is verified, and the registration request contains encrypted identity information of the MQTT server and an encrypted first key preset for the MQTT server;

[0008] After receiving the user login request sent by the message queue telemetry transport client, the user is authenticated, and after the authentication is successful, an encrypted core ticket and encrypted user permission information are generated, the encrypted core ticket and the encrypted user permission information are spliced to obtain spliced information, the spliced information is encrypted, and then sent to the message queue telemetry transport client, the user login request contains an encrypted username and an encrypted password;

[0009] After receiving the access request sent by the message queue telemetry transport client to the message queue telemetry transport server, the encrypted core ticket contained in the access request is verified for validity, and after confirming that the encrypted core ticket is valid, a normal ticket is generated, the normal ticket is symmetrically encrypted using the first key to obtain an encrypted normal ticket;

[0010] The encrypted normal ticket and the encrypted user permission information are sent to the message queue telemetry transport client, so that the message queue telemetry transport client uses the encrypted normal ticket and the encrypted user permission information to access the message queue telemetry transport server.

[0011] In some embodiments, after receiving the registration request sent by the message queue telemetry transport server, the message queue telemetry transport server is authenticated, and the registration request contains encrypted identity information of the message queue telemetry transport server and an encrypted first key preset for the message queue telemetry transport server, which includes:

[0012] The encrypted identity information of the message queue telemetry transport server and the encrypted first key preset for the message queue telemetry transport server are respectively decrypted using a preset private key to obtain decrypted identity information of the message queue telemetry transport server and a first key preset for the message queue telemetry transport server; the decrypted identity information of the message queue telemetry transport server is compared with the identity information of the message queue telemetry transport server stored in the relational database in advance to obtain a first comparison result; the decrypted first key preset for the message queue telemetry transport server is compared with the first key preset for the message queue telemetry transport server stored in the relational database in advance to obtain a second comparison result; and the authentication result is confirmed according to the first comparison result and the second comparison result.

[0013] In some embodiments, after receiving the user login request sent by the message queue telemetry transport client, the user is authenticated, which includes:

[0014] decrypt the encrypted username and the encrypted password using a preset private key to obtain decrypted username and password, and compare the decrypted username and password with the username and password stored in the relational database in advance.

[0015] In some embodiments, after the identity authentication succeeds, an encrypted core ticket and encrypted user permission information are generated, the encrypted core ticket and the encrypted user permission information are spliced to obtain spliced information, and after the spliced information is encrypted, the spliced information is sent to the message queue telemetry transmission client.

[0016] After the identity authentication succeeds, a core ticket and user permission information are generated, and the core ticket and the user permission information are symmetrically encrypted using a second key to obtain the encrypted core ticket and the encrypted user permission information.

[0017] The encrypted core ticket and the encrypted user permission information are spliced to obtain the spliced information.

[0018] After the spliced information is symmetrically encrypted using the password stored in the relational database in advance, the encrypted spliced information is sent to the message queue telemetry transmission client.

[0019] In some embodiments, after receiving the access request for the message queue telemetry transmission service end sent by the message queue telemetry transmission client, the encrypted core ticket contained in the access request is verified for validity, including:

[0020] The encrypted core ticket contained in the access request is decrypted using the second key to obtain a decrypted core ticket, and the decrypted core ticket is verified for validity.

[0021] In a second aspect, an access authentication service is provided in the present embodiment, which is used to execute the access authentication method of the first aspect.

[0022] In some embodiments, the access authentication service includes an identity authentication module and a ticket authorization module.

[0023] The identity authentication module is configured to verify user identity information of the message queue telemetry transmission client and generate a core ticket and user permission information.

[0024] The ticket authorization module is configured to generate a general ticket according to an access request of the message queue telemetry transmission client, so as to access the message queue telemetry transmission service end.

[0025] In a third aspect, an access authentication system based on a message queue telemetry transport protocol is provided in the embodiments. The system includes a message queue telemetry transport client, a message queue telemetry transport server, and the access authentication service of the second aspect.

[0026] In a fourth aspect, an electronic device is provided in the embodiments. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor implements the access authentication method of the first aspect when executing the computer program.

[0027] In a fifth aspect, a storage medium is provided in the embodiments. The storage medium stores a computer program. The computer program is executable on a processor to implement the access authentication method of the first aspect.

[0028] Compared with related technologies, the access authentication method and system based on a message queue telemetry transport protocol are provided in the embodiments. The access authentication method includes: after receiving a registration request sent by a message queue telemetry transport server, generating a first key for the message queue telemetry transport server and sending the first key to the message queue telemetry transport server, the registration request containing identity information of the message queue telemetry transport server; after receiving a user login request sent by a message queue telemetry transport client, performing identity verification on the user, generating an encrypted core ticket and encrypted user permission information after the identity verification is successful, splicing the encrypted core ticket and the encrypted user permission information to obtain splicing information, sending the splicing information to the message queue telemetry transport client after the splicing information is encrypted, the user login request containing an encrypted username and an encrypted password; after receiving an access request for the message queue telemetry transport server sent by the message queue telemetry transport client, performing validity verification on an encrypted core ticket contained in the access request, generating a normal ticket after confirming that the encrypted core ticket is valid, performing symmetric encryption on the normal ticket using the first key to obtain an encrypted normal ticket; sending the encrypted normal ticket and the encrypted user permission information to the message queue telemetry transport client, so that the message queue telemetry transport client uses the encrypted normal ticket and the encrypted user permission information to access the message queue telemetry transport server. The method can centrally manage identity verification, separate identity verification and service access, implement bidirectional authentication between the message queue telemetry transport client and the message queue telemetry transport server, and improve the security of user password transmission of the message queue telemetry transport client.

[0029] Details of one or more embodiments of the present application are presented in the following drawings and description to make other features, objects, and advantages of the present application more apparent. BRIEF DESCRIPTION OF DRAWINGS

[0030] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and serve to explain the principles of the application. In the drawings:

[0031] Figure 1 is a terminal hardware structure block diagram of the access authentication method based on the message queue telemetry transfer protocol of the embodiment;

[0032] Figure 2 is a flow chart of the access authentication method based on the message queue telemetry transfer protocol of the embodiment;

[0033] Figure 3 is an access authentication service structure block diagram of the access authentication method based on the message queue telemetry transfer protocol of the embodiment;

[0034] Figure 4 is a structure block diagram of the access authentication system based on the message queue telemetry transfer protocol of the embodiment. DETAILED DESCRIPTION

[0035] In order to more clearly understand the purpose, technical scheme and advantages of the present application, the present application is described and explained below in combination with the drawings and embodiments.

[0036] Unless otherwise defined, technical terms or scientific terms used in the present application shall have the same meaning as those commonly understood by a person of ordinary skill in the art to which the present application belongs. The terms "one", "a", "an", "the", "these", and similar terms in the present application do not mean "only one" or "exactly one", but can mean "one or more" or "at least one". The terms "include", "contain", "have", and any variant thereof in the present application are intended to cover the non-exclusive inclusion; for example, a process, method, and system, product or device containing a series of steps or modules (units) are not limited to the listed steps or modules (units), but can include steps or modules (units) not listed, or can include other steps or modules (units) inherent to the process, method, product or device. The terms "connect", "connect", "couple" and the like in the present application are not limited to physical or mechanical connection, but can include electrical connection, whether direct or indirect. The term "multiple" in the present application means two or more. The term "and / or" describes the association between the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that A exists alone, A and B exist together, and B exists alone. Generally, the character " / " represents the relationship between the objects before and after it as "or". The terms "first", "second", "third" and the like in the present application are only used to distinguish similar objects, and do not represent a specific order of the objects.

[0037] The method embodiments provided in the present embodiment can be executed in a terminal, a computer or a similar computing device. For example, the method embodiments are executed on a terminal, Figure 1 is a hardware structure diagram of a terminal based on the message queue telemetry transmission protocol access authentication method of the present embodiment. As shown in Figure 1 , the terminal can include one or more (only one is shown in Figure 1 ) processor 102 and memory 104 for storing data, wherein the processor 102 can include but not limited to processing devices such as microprocessor MCU or programmable logic device FPGA. The above terminal can also include transmission device 106 for communication function and input / output device 108. Those skilled in the art can understand that Figure 1 The structure shown is only schematic, which does not limit the structure of the above terminal. For example, the terminal can include more or less components than those shown in Figure 1 , or have a different configuration from that shown in Figure 1 .

[0038] The memory 104 can be configured to store computer programs, such as software programs of application software and modules, such as the computer program of the message queue telemetry transport protocol-based access authentication method in the embodiment, and the processor 102 can execute various functional applications and data processing, i.e., implement the method described above, by running the computer programs stored in the memory 104. The memory 104 can include a high-speed random access memory, and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include memories remotely arranged with respect to the processor 102, which can be connected to the terminal through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0039] The transmission device 106 is configured to receive or send data via a network. The network described above includes a wireless network provided by a communication provider of the terminal. In one example, the transmission device 106 includes a network interface controller (NIC) that can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module configured to communicate with the Internet in a wireless manner.

[0040] In the embodiment, a message queue telemetry transport protocol-based access authentication method is provided, which is configured to authenticate a service; the authentication service is connected with a message queue telemetry transport client and a message queue telemetry transport server respectively, so as to implement bidirectional authentication between the message queue telemetry transport client and the message queue telemetry transport server. Figure 2 FIG. 1 is a flowchart of the message queue telemetry transport protocol-based access authentication method of the embodiment, as shown in FIG. 1, the flow includes the following steps: Figure 2

[0041] In step S210, after receiving a registration request sent by the message queue telemetry transport server, the identity of the message queue telemetry transport server is verified, and the registration request contains encrypted identity information of the message queue telemetry transport server and an encrypted first key preset for the message queue telemetry transport server.

[0042] The authentication service is connected with the message queue telemetry transport client and the message queue telemetry transport server respectively, which can centrally manage identity verification and implement bidirectional authentication between the message queue telemetry transport client and the message queue telemetry transport server. The authentication service can be a cloud server or a local server, and the message queue telemetry transport server can be a cloud server or a local server.

[0043] ​The message queue telemetry transport server sends a registration request to the authentication service. After receiving the registration request, the authentication service decrypts the encrypted identity information of the message queue telemetry transport server and the encrypted first key preset for the message queue telemetry transport server in the registration request, respectively, obtains the decrypted identity information of the message queue telemetry transport server and the first key preset for the message queue telemetry transport server, and verifies the decrypted identity information of the message queue telemetry transport server and the first key preset for the message queue telemetry transport server. After successful verification, the authentication service sends a heartbeat packet to the message queue telemetry transport server to confirm the survival of the message queue telemetry transport server.

[0044] In step S220, after receiving the user login request sent by the message queue telemetry transport client, the identity of the user is verified, and after successful identity verification, an encrypted core ticket and encrypted user permission information are generated, the encrypted core ticket and the encrypted user permission information are spliced to obtain spliced information, and after the spliced information is encrypted, the spliced information is sent to the message queue telemetry transport client.

[0045] The message queue telemetry transport client can be an instant messaging application using the message queue telemetry transport protocol, a sensor reporting data using the message queue telemetry transport protocol, or a message queue telemetry transport test tool. The user login request includes an encrypted username and an encrypted password. The encrypted username is obtained by using a public key of the message queue telemetry transport client to perform SM9 asymmetric encryption on the username. The encrypted password is obtained by using the public key of the message queue telemetry transport client to perform SM9 asymmetric encryption on the password. The core ticket includes the identity information of the user and the validity period of the core ticket. The spliced information is a 16-bit string.

[0046] The message queue telemetry transport client sends a user login request to the authentication service. After receiving the user login request, the authentication service decrypts the encrypted username and the encrypted password included in the user login request, respectively, obtains the decrypted username and the password, and verifies the decrypted username and the password. After successful verification, an encrypted core ticket and encrypted user permission information are generated, the encrypted core ticket and the encrypted user permission information are spliced to obtain spliced information, and after the spliced information is encrypted, the spliced information is sent to the message queue telemetry transport client.

[0047] In step S230, after receiving the access request sent by the message queue telemetry transport client to the message queue telemetry transport server, the validity of the encrypted core ticket included in the access request is verified, and after confirming that the encrypted core ticket is valid, a normal ticket is generated, the normal ticket is symmetrically encrypted using the first key, and the encrypted normal ticket is obtained.

[0048] The access request includes an encrypted core ticket, identity information of a message queue telemetry transport service end to which access is requested, and a validity period requested to be acquired; the validity verification includes checking whether it is expired, whether it is tampered, etc.; the common ticket includes identity information of a user, identity information of the message queue telemetry transport service end to which access is requested, and a validity period of the common ticket.

[0049] The message queue telemetry transport client sends an access request for the message queue telemetry transport service end to the authentication service, the authentication service decrypts the encrypted core ticket included in the access request after receiving the access request, obtains the decrypted core ticket, and performs validity verification on the decrypted core ticket; after confirming that the core ticket is valid, a common ticket is generated, the common ticket is SM4 symmetrically encrypted using the first key, and the encrypted common ticket is obtained.

[0050] In step S240, the encrypted common ticket and the encrypted user permission information are sent to the message queue telemetry transport client, so that the message queue telemetry transport client uses the encrypted common ticket and the encrypted user permission information to access the message queue telemetry transport service end.

[0051] The authentication service sends the encrypted common ticket and the encrypted user permission information to the message queue telemetry transport client, and the message queue telemetry transport client receives the encrypted common ticket and the encrypted user permission information and sends them to the message queue telemetry transport service end, which uses the first key to perform SM4 symmetric decryption on the encrypted common ticket to obtain the decrypted common ticket. The message queue telemetry transport service end performs validity verification on the decrypted common ticket, which includes checking whether it is expired, whether it is tampered, etc.; after confirming that the common ticket is valid, the message queue telemetry transport service end sends the encrypted user permission information to the authentication service, which receives the encrypted user permission information and uses the second key to perform SM4 symmetric decryption to obtain the decrypted user permission information. The authentication service verifies the decrypted user permission information to obtain a verification result, and sends the verification result to the message queue telemetry transport service end, which determines whether to receive the access request of the message queue telemetry transport client according to the verification result.

[0052] By introducing the authentication service, using a double-ticket verification mechanism, and using SM4 symmetric encryption algorithm and SM9 asymmetric encryption algorithm, bidirectional authentication between the message queue telemetry transport client and the message queue telemetry transport service end is realized, replay attacks are effectively prevented, and the security of the password of the user of the message queue telemetry transport client is improved.

[0053] By the above steps S210 to S240, compared with the related art, the application realizes the mutual authentication between the message queue telemetry transport client and the message queue telemetry transport server through the authentication service. The method comprises: after receiving the registration request sent by the message queue telemetry transport server, authenticating the identity of the message queue telemetry transport server, the registration request containing the encrypted identity information of the message queue telemetry transport server and the encrypted first key preset for the message queue telemetry transport server; after receiving the user login request sent by the message queue telemetry transport client, authenticating the identity of the user, after the identity authentication succeeds, generating an encrypted core ticket and encrypted user permission information, splicing the encrypted core ticket and the encrypted user permission information to obtain spliced information, after encrypting the spliced information, sending it to the message queue telemetry transport client, the user login request containing the encrypted username and the encrypted password; after receiving the access request sent by the message queue telemetry transport client to the message queue telemetry transport server, verifying the validity of the encrypted core ticket contained in the access request, after confirming that the encrypted core ticket is valid, generating a normal ticket, using the first key to symmetrically encrypt the normal ticket to obtain an encrypted normal ticket; sending the encrypted normal ticket and the encrypted user permission information to the message queue telemetry transport client, so that the message queue telemetry transport client uses the encrypted normal ticket and the encrypted user permission information to access the message queue telemetry transport server. It can centrally manage identity authentication, separate identity authentication and service access, realize mutual authentication between the message queue telemetry transport client and the message queue telemetry transport server, and improve the security of message queue telemetry transport client user password transmission.

[0054] In one embodiment, after receiving the registration request sent by the message queue telemetry transport server, the identity of the message queue telemetry transport server is authenticated, and the registration request contains the encrypted identity information of the message queue telemetry transport server and the encrypted first key preset for the message queue telemetry transport server, comprising:

[0055] The identity information of the encrypted message queue telemetry transport service end and the encrypted preset first key for the message queue telemetry transport service end are respectively decrypted using a preset private key, to obtain decrypted identity information of the message queue telemetry transport service end and a preset first key for the message queue telemetry transport service end; the decrypted identity information of the message queue telemetry transport service end is compared with identity information of the message queue telemetry transport service end pre-stored in the relational database to obtain a first comparison result; the decrypted preset first key for the message queue telemetry transport service end is compared with a preset first key for the message queue telemetry transport service end pre-stored in the relational database to obtain a second comparison result; and the identity authentication result is confirmed according to the first comparison result and the second comparison result.

[0056] Specifically, the authentication service uses a preset private key to respectively perform SM9 asymmetric decryption on the encrypted identity information of the message queue telemetry transport service end and the encrypted preset first key for the message queue telemetry transport service end, to obtain decrypted identity information of the message queue telemetry transport service end and a preset first key for the message queue telemetry transport service end; the decrypted identity information of the message queue telemetry transport service end is compared with identity information of the message queue telemetry transport service end pre-stored in the relational database to obtain a first comparison result; the decrypted preset first key for the message queue telemetry transport service end is compared with a preset first key for the message queue telemetry transport service end pre-stored in the relational database to obtain a second comparison result; and the identity authentication result is confirmed according to the first comparison result and the second comparison result. When the first comparison result and the second comparison result are both consistent, the identity authentication passes; otherwise, the identity authentication fails. The preset first key for the message queue telemetry transport service end pre-stored in the relational database is stored using an SM3 encryption algorithm.

[0057] By comparing the decrypted identity information of the message queue telemetry transport service end and the preset first key for the message queue telemetry transport service end with the identity information of the message queue telemetry transport service end and the preset first key for the message queue telemetry transport service end pre-stored in the relational database in the authentication service, identity authentication of the message queue telemetry transport service end can be performed.

[0058] In one embodiment, after receiving a user login request sent by a message queue telemetry transport client, identity authentication of the user is performed, including:

[0059] The encrypted username and the encrypted password are respectively decrypted using a preset private key, to obtain decrypted username and password; and the decrypted username and password are compared with username and password pre-stored in the relational database.

[0060] Specifically, the authentication service uses a preset private key to respectively perform SM9 asymmetric decryption on the encrypted username and the encrypted password, to obtain decrypted username and password, and compares the decrypted username and password with the username and password stored in advance in the relational database in the authentication service. The password stored in advance in the relational database is stored by using the SM3 encryption algorithm.

[0061] By comparing the decrypted username and password with the username and password stored in advance in the relational database in the authentication service, the user identity of the message queue telemetry transmission client can be verified.

[0062] In one embodiment, after the identity verification is successful, an encrypted core ticket and encrypted user permission information are generated, the encrypted core ticket and the encrypted user permission information are spliced to obtain spliced information, the spliced information is encrypted, and then sent to the message queue telemetry transmission client, including:

[0063] After the identity verification is successful, a core ticket and user permission information are generated, the core ticket and the user permission information are respectively symmetrically encrypted using a second key to obtain an encrypted core ticket and encrypted user permission information; the encrypted core ticket and the encrypted user permission information are spliced to obtain spliced information; the spliced information is symmetrically encrypted using a password stored in advance in a relational database, and then the encrypted spliced information is sent to the message queue telemetry transmission client.

[0064] Specifically, after the user identity verification of the message queue telemetry transmission client is successful, the authentication service generates a core ticket and user permission information, and respectively performs SM4 symmetric encryption on the core ticket and the user permission information using a second key to obtain an encrypted core ticket and encrypted user permission information; the authentication service splices the encrypted core ticket and the encrypted user permission information to obtain spliced information, which is a 16-bit string; the authentication service performs SM4 symmetric encryption on the spliced information using a password stored in advance in a relational database, and then sends the encrypted spliced information to the message queue telemetry transmission client. The password is a 16-bit string.

[0065] In this embodiment, by using the password stored in advance in the relational database to symmetrically encrypt the spliced information, the security of the message queue telemetry transmission client can be ensured.

[0066] In one embodiment, after receiving an access request sent by the message queue telemetry transmission client to the message queue telemetry transmission service, the validity of the encrypted core ticket contained in the access request is verified, including:

[0067] The encrypted core ticket contained in the access request is decrypted using the second key to obtain a decrypted core ticket, and the decrypted core ticket is verified for validity.

[0068] Specifically, the message queue telemetry transport client uses the user password to perform SM4 symmetric decryption on the encrypted spliced information to obtain the encrypted core ticket and the encrypted user permission information; the message queue telemetry transport client sends an access request for the message queue telemetry transport server to the authentication service, the access request containing the encrypted core ticket and an identifier of the message queue telemetry transport server; the authentication service performs SM4 symmetric decryption on the encrypted core ticket contained in the access request using the second key to obtain a decrypted core ticket, and verifies the decrypted core ticket for validity. The validity verification includes checking whether the core ticket is expired or tampered with, etc. In this embodiment, the authentication service can determine whether to generate a normal ticket according to the verification result by verifying the decrypted core ticket for validity.

[0069] In this embodiment, an access authentication service 30 is also provided, as shown in the figure, for performing the access authentication method provided in any of the above embodiments. The access authentication service 30 can centrally manage identity verification, separate identity verification and service access, and achieve mutual authentication between the message queue telemetry transport client and the message queue telemetry transport server, thereby improving the security of user password transmission of the message queue telemetry transport client. Figure 3

[0070] In one embodiment, the access authentication service 30 includes an identity verification module 302 and a ticket authorization module 304. The identity verification module 302 is configured to verify the user identity information of the message queue telemetry transport client and generate a core ticket and user permission information. The ticket authorization module 304 is configured to generate a normal ticket according to an access request of the message queue telemetry transport client, so as to access the message queue telemetry transport server.

[0071] The identity verification module 302 is responsible for receiving a user login request sent by the message queue telemetry transport client, verifying the identity of the user, generating an encrypted core ticket and encrypted user permission information after successful identity verification, splicing the encrypted core ticket and the encrypted user permission information to obtain spliced information, encrypting the spliced information, and then sending the encrypted spliced information to the message queue telemetry transport client. The ticket authorization module 304 is responsible for receiving an access request for the message queue telemetry transport server sent by the message queue telemetry transport client, verifying the validity of the encrypted core ticket contained in the access request, generating a normal ticket after confirming that the encrypted core ticket is valid, performing symmetric encryption on the normal ticket using the first key, obtaining an encrypted normal ticket, and then sending the encrypted normal ticket to the message queue telemetry transport client.

[0072] ​In the embodiment, an access authentication system 40 based on the message queue telemetry transport protocol is also provided, as shown in Figure 4 The access authentication system 40 includes a message queue telemetry transport client 41, a message queue telemetry transport server 42, and the access authentication service 30 provided in the above embodiment.

[0073] In the embodiment, an electronic device is also provided, which includes a memory and a processor. The memory stores a computer program, and the processor is configured to execute the computer program to perform the steps in any of the above method embodiments.

[0074] Optionally, the electronic device can further include a transmission device connected to the processor and an input / output device connected to the processor.

[0075] Optionally, in the embodiment, the processor can be configured to execute the following steps through the computer program:

[0076] S1, after receiving a registration request sent by the message queue telemetry transport server, a first key for the message queue telemetry transport server is generated and sent to the message queue telemetry transport server, and the registration request contains identity information of the message queue telemetry transport server;

[0077] S2, after receiving a user login request sent by the message queue telemetry transport client, the user is authenticated, and after the authentication is successful, an encrypted core ticket and encrypted user permission information are generated, the encrypted core ticket and the encrypted user permission information are spliced to obtain spliced information, the spliced information is encrypted, and then sent to the message queue telemetry transport client, and the user login request contains an encrypted username and an encrypted password;

[0078] S3, after receiving an access request sent by the message queue telemetry transport client for the message queue telemetry transport server, the encrypted core ticket contained in the access request is verified for validity, and after confirming that the encrypted core ticket is valid, a normal ticket is generated, the normal ticket is symmetrically encrypted using the first key to obtain an encrypted normal ticket;

[0079] S4, the encrypted normal ticket and the encrypted user permission information are sent to the message queue telemetry transport client, so that the message queue telemetry transport client uses the encrypted normal ticket and the encrypted user permission information to access the message queue telemetry transport server.

[0080] It should be noted that the specific examples in the embodiment can refer to the examples described in the above embodiments and optional implementation manners, which will not be described herein again.

[0081] In addition, in combination with the access authentication method based on the message queue telemetry transport protocol provided in the above-mentioned embodiments, a storage medium can also be provided to implement the access authentication method based on the message queue telemetry transport protocol in the present embodiment. The storage medium has a computer program stored thereon. The computer program is executed by a processor to implement any one of the access authentication methods based on the message queue telemetry transport protocol in the above-mentioned embodiments.

[0082] It should be understood that the specific embodiments described herein are merely exemplary and are not intended to limit the application. All other embodiments obtained by those of ordinary skill in the art without creative labor based on the embodiments provided in the present application are within the scope of protection of the present application.

[0083] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0084] Obviously, the drawings are only some examples or embodiments of the present application, and those of ordinary skill in the art can also apply the present application to other similar situations according to the drawings without creative labor. In addition, it can be understood that although the work done in the development process may be complex and long, some design, manufacture or production changes made by those of ordinary skill in the art according to the technical content disclosed in the present application are only routine technical means and should not be regarded as insufficient disclosure of the present application.

[0085] The term "embodiment" in the present application means that the specific features, structures or characteristics described in combination with the embodiment can be included in at least one embodiment of the present application. The presence of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean independence or alternative to other embodiments. It can be clearly or implicitly understood by those of ordinary skill in the art that the embodiments described in the present application can be combined with other embodiments without conflict.

[0086] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of patent protection. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A method for access authentication based on message queue telemetry transport protocol, characterized in that, The authentication service is connected with the message queue telemetry transport client and the message queue telemetry transport server respectively to realize bidirectional authentication between the message queue telemetry transport client and the message queue telemetry transport server. After receiving the registration request sent by the message queue telemetry transport server, the identity of the message queue telemetry transport server is verified, and the registration request contains encrypted identity information of the message queue telemetry transport server and encrypted first key preset for the message queue telemetry transport server. After receiving the user login request sent by the message queue telemetry transport client, the identity of the user is verified, and after the identity verification is successful, encrypted core ticket and encrypted user permission information are generated, the encrypted core ticket and the encrypted user permission information are spliced to obtain spliced information, the spliced information is encrypted and then sent to the message queue telemetry transport client, and the user login request contains encrypted username and encrypted password. After receiving the access request for the message queue telemetry transport server sent by the message queue telemetry transport client, the encrypted core ticket contained in the access request is verified for validity, and after it is confirmed that the encrypted core ticket is valid, a normal ticket is generated, the normal ticket is symmetrically encrypted using the first key to obtain an encrypted normal ticket. The encrypted normal ticket and the encrypted user permission information are sent to the message queue telemetry transport client, so that the message queue telemetry transport client uses the encrypted normal ticket and the encrypted user permission information to access the message queue telemetry transport server.

2. The access authentication method according to claim 1, characterized in that, After receiving the registration request sent by the message queue telemetry transport server, the identity of the message queue telemetry transport server is verified, and the registration request contains encrypted identity information of the message queue telemetry transport server and encrypted first key preset for the message queue telemetry transport server. The encrypted identity information of the message queue telemetry transport server and the encrypted first key preset for the message queue telemetry transport server are respectively decrypted using a preset private key to obtain decrypted identity information of the message queue telemetry transport server and a preset first key for the message queue telemetry transport server. The decrypted identity information of the message queue telemetry transport server is compared with the identity information of the message queue telemetry transport server stored in the relational database in advance to obtain a first comparison result. The decrypted preset first key for the message queue telemetry transport server is compared with the preset first key for the message queue telemetry transport server stored in the relational database in advance to obtain a second comparison result. According to the first comparison result and the second comparison result, the identity verification result is confirmed.

3. The access authentication method of claim 1, wherein, The identity of the user is authenticated after receiving the user login request sent by the message queue telemetry transport client, including: The encrypted username and the encrypted password are respectively decrypted using a preset private key to obtain decrypted username and password, and the decrypted username and password are compared with the username and password stored in the relational database in advance.

4. The access authentication method according to claim 3, wherein After the identity authentication is successful, an encrypted core ticket and encrypted user permission information are generated, the encrypted core ticket and the encrypted user permission information are spliced to obtain spliced information, and the spliced information is encrypted and then sent to the message queue telemetry transport client, including: After the identity authentication is successful, a core ticket and user permission information are generated, and the core ticket and the user permission information are respectively symmetrically encrypted using a second key to obtain the encrypted core ticket and the encrypted user permission information; The encrypted core ticket and the encrypted user permission information are spliced to obtain the spliced information; The spliced information is symmetrically encrypted using the password stored in the relational database in advance, and the encrypted spliced information is sent to the message queue telemetry transport client.

5. The access authentication method according to claim 4, wherein After receiving the access request sent by the message queue telemetry transport client to the message queue telemetry transport service end, the encrypted core ticket contained in the access request is verified for validity, including: The encrypted core ticket contained in the access request is decrypted using the second key to obtain a decrypted core ticket, and the decrypted core ticket is verified for validity.

6. An access authentication service apparatus characterized by comprising: An access authentication method for performing any one of claims 1 to 5, including an identity authentication module and a ticket authorization module; The identity authentication module is used to verify the identity information of the user of the message queue telemetry transport client and generate a core ticket and user permission information; The ticket authorization module is used to generate a general ticket according to the access request of the message queue telemetry transport client to access the message queue telemetry transport service end.

7. A message queue telemetry transport protocol based access authentication system, characterized in that, Including: The message queue telemetry transport client, the message queue telemetry transport service end, and the access authentication service device of claim 6. 8.An electronic device comprising a memory and a processor, the electronic device comprising: The memory stores a computer program, and the processor is configured to run the computer program to execute the access authentication method of any one of claims 1 to 5.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the access authentication method of any one of claims 1 to 5.

Images