Universal interface security authentication method and system based on secondary password verification
By judging and generating status codes and unique authorization identifiers in interface call requests, the problems of redundant code and low development efficiency in existing technologies are solved, and flexible interface security authentication is achieved, which can adapt to complex and ever-changing business scenarios and improve the reliability of backend interface security authentication.
Patent Information
- Application Number
- CN202510873979.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-27
- Publication Date
- 2025-11-04
AI Technical Summary
Existing two-factor authentication technologies suffer from problems such as redundant code, low development efficiency, and difficulty in adapting to complex and ever-changing business scenarios in backend interface security authentication.
When a user request is received, it is determined whether the target interface requires secondary password verification. A response status code is generated, and the front end initiates the secondary password information retrieval. Upon successful retrieval, a unique authorization identifier is generated and associated with a cookie. Flexible authentication strategies are implemented using the status code and the unique authorization identifier.
It effectively avoids redundant code, improves development efficiency and maintenance convenience, adapts to complex and ever-changing business scenarios, and enhances the reliability and flexibility of interface security authentication.
Smart Images
Figure CN120893029A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of information security and access control, and particularly relates to a general interface security authentication method and system based on secondary password verification. BACKGROUND
[0002] With the development of information technology, the security authentication of the backend interface is crucial. The existing secondary authentication technology has limitations. On the one hand, the logic processing or modification of the interface alone invades the business. If multiple interfaces need secondary authentication, a large amount of redundant code will be generated, resulting in low development efficiency and maintenance difficulty. On the other hand, the declarative verification based on annotations has the problem of reflection performance loss, and it is difficult to implement dynamic authentication strategy, which cannot adapt to complex and variable business scenarios.
[0003] Therefore, there is an urgent need to provide a technical solution to solve the above problems. SUMMARY
[0004] To solve the above technical problems, the present application provides a general interface security authentication method and system based on secondary password verification.
[0005] In a first aspect, the present application provides a general interface security authentication method based on secondary password verification. The technical scheme of the method is as follows: When receiving an interface call request of a user for a target general interface, a request verification module is used to determine whether the target general interface is a general interface to be verified by secondary password, and a response status code generated according to the determination result is sent to the front end. When the response status code is a secondary verification status code, the secondary password verification information obtained by the front end according to the secondary verification status code is received. When the secondary password verification information is verified successfully, a unique authorization identifier is generated and associated with the target Cookie of the user, and it is determined that the secondary password verification is successful.
[0006] The beneficial effects of the general interface security authentication method based on secondary password verification of the present application are as follows: The method of the present application can effectively avoid invading the business logic and generating redundant code, improve the development efficiency and maintenance convenience, realize the dynamic authentication strategy by using the status code and the unique authorization identifier association, adapt to complex and variable business scenarios, and enhance the reliability and flexibility of the security authentication of the backend interface.
[0007] On the basis of the above-mentioned scheme, the general interface security authentication method based on secondary password verification of the present application can be further improved as follows.
[0008] In an optional mode, the step of judging whether the target general interface is a general interface to be subjected to secondary password verification by using the request verification module and sending a response status code generated according to a judgment result to a front end comprises: judging whether the target general interface is a general interface to be subjected to secondary password verification by using the request verification module to obtain a first judgment result. When the first judgment result is yes, the interface call request is parsed by using the request verification module to obtain the target Cookie, and it is judged whether the target Cookie contains an authorization code to obtain a second judgment result. When the second judgment result is yes, it is judged whether the authorization code in the target Cookie exists in Redis by using the request verification module to obtain a third judgment result. When the third judgment result is no, the secondary verification status code is generated by using the request verification module and sent to the front end.
[0009] In an optional mode, the step of judging whether the target general interface is a general interface to be subjected to secondary password verification by using the request verification module and sending a response status code generated according to a judgment result to a front end further comprises: when the second judgment result is no, the secondary verification status code is generated by using the request verification module and sent to the front end.
[0010] In an optional mode, the system further comprises: The target general interface is configured as a general interface to be subjected to secondary password verification, and a maximum authorization duration of the target general interface is set.
[0011] In an optional mode, the secondary password verification information comprises a secondary verification password and an expected authorization duration; and the expected authorization duration is not greater than the maximum authorization duration.
[0012] In an optional mode, the system further comprises: When the secondary password verification information fails to pass verification, prompt information of a secondary password verification error is output by the front end.
[0013] In an optional mode, the request verification module is an AOP interceptor or an API gateway.
[0014] In a second aspect, the application provides a general interface security authentication system based on secondary password verification, and a technical scheme of the system is as follows: The system comprises a front end and a back end; and the back end is configured to: When receiving an interface call request of a user for a target general interface, a request checking module is used to determine whether the target general interface is a general interface to be subjected to secondary password checking, and a response status code generated according to a determination result is sent to a front end; when the response status code is a secondary checking status code, secondary password checking information obtained by the front end according to a secondary checking status code initiated by the front end is received; When the secondary password checking information is checked successfully, a unique authorization identifier is generated and associated with a target Cookie of the user, and it is determined that the secondary password checking is successful.
[0015] The system based on secondary password checking of the application has the following advantages: The system can effectively avoid intrusion into business logic and generate redundant codes, improve development efficiency and maintenance convenience, realize a flexible authentication strategy by using state code and unique authorization identifier association, adapt to complex and changeable business scenarios, and enhance the reliability and flexibility of back-end interface security authentication.
[0016] On the basis of the above-mentioned scheme, the system based on secondary password checking of the application can be further improved as follows.
[0017] In an optional mode, the back end is specifically used for: The request checking module is used to determine whether the target general interface is a general interface to be subjected to secondary password checking, and a first determination result is obtained; When the first determination result is yes, the request checking module is used to analyze the interface call request, obtain the target Cookie, and determine whether an authorization code exists in the target Cookie, and a second determination result is obtained; When the second determination result is yes, the request checking module is used to determine whether the authorization code in the target Cookie exists in Redis, and a third determination result is obtained; When the third determination result is no, the request checking module is used to generate the secondary checking status code and send it to the front end.
[0018] In an optional mode, the back end is specifically used for: When the second determination result is no, the request checking module is used to generate the secondary checking status code and send it to the front end.
[0019] The above description is only a summary of the technical solutions of the present application. In order to enable one skilled in the art to better understand the technical means of the present application, the specific embodiments of the present application are described in detail below according to the contents of the description, and in order to enable the above and other purposes, characteristics and advantages of the present application to be more obvious and easy to understand, the specific embodiments of the present application are described in detail below. BRIEF DESCRIPTION OF DRAWINGS
[0020] The accompanying drawings are used to show the embodiments and are not considered as limiting the present application. Moreover, the same reference numerals are used to represent the same components throughout the drawings. In the drawings: Figure 1 A flowchart of an embodiment of a general interface security authentication method based on secondary password verification of the present application; Figure 2 A structural diagram of an embodiment of a general interface security authentication system based on secondary password verification of the present application. DETAILED DESCRIPTION
[0021] Exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein.
[0022] Figure 1 A flowchart of an embodiment of a general interface security authentication method based on secondary password verification of the present application is shown, which is applied to the back end. As shown in Figure 1 , the following steps are included: S1, when receiving an interface call request of a user for a target general interface, using a request verification module, judging whether the target general interface is a general interface to be subjected to secondary password verification, and sending a response status code generated according to the judgment result to the front end.
[0023] Wherein, the target general interface refers to any business interface that needs to be strengthened in security, which can be marked as an object to be subjected to secondary password verification through dynamic configuration. Its range covers high-risk interfaces such as fund operation and sensitive data change, and supports flexible adjustment of protection range according to business needs. The interface call request refers to an access request (such as HTTP / HTTPS protocol request) initiated by the user through the front end for the target general interface, which contains operation instructions and related parameters, and triggers the execution of back-end business logic. The request verification module is an AOP interceptor or an API gateway. The response status code is an HTTP status code (such as 401 unauthorized, 460 secondary verification required, etc.).
[0024] Specifically: ① the user initiates an interface call request for a target general interface through the front end, and the front end sends the interface call request to the back end for verification. ② the back end intercepts the interface call request using the request verification module and verifies the interface call request to determine whether the target general interface is a general interface that requires secondary password verification. ③ When the target general interface is a general interface that requires secondary password verification, and the authorization code carried in the interface call request fails to pass the verification or the authorization is invalid, a secondary response status code is generated and sent to the front end.
[0025] S2, when the response status code is a secondary verification status code, receiving the secondary password verification information obtained by the front end initiating a secondary password information acquisition request according to the secondary verification status code.
[0026] Among them, the secondary password verification information includes: secondary verification password and expected authorization duration. The secondary password information acquisition request is an interactive instruction triggered automatically by the front end according to the secondary verification status code, which requests the user to input the secondary verification password and the expected authorization duration through a special pop-up window component to form structured authentication data.
[0027] Specifically: ① When the response status code is a secondary verification status code, the front end automatically triggers a special pop-up window component through a pop-up box according to the secondary verification status code to initiate a secondary password information acquisition request to the user. ② The user inputs the secondary verification password and the expected authorization duration in the corresponding pop-up box area of the front end according to the secondary password information acquisition request. ③ The front end sends a secondary password verification request to the back end and sends the secondary verification password and the expected authorization duration input by the user to the back end for verification.
[0028] It should be noted that the pop-up window component can reasonably prompt the remaining input times and the authorization range to guide the user to complete the security verification. In addition, in order to prevent man-in-the-middle attacks, the front end transmits all sensitive information (secondary verification password and expected authorization duration) in encrypted form, supports multiple factors such as verification code and sliding block, and can be flexibly expanded according to the configuration.
[0029] S3, when the secondary password verification information verification is successful, a unique authorization identifier is generated and associated to the target Cookie of the user, and it is determined that the secondary password verification is successful.
[0030] Among them, the unique authorization identifier refers to an encrypted string (Key) generated by the back end as a temporary credential for passing the secondary verification. It is stored in a distributed cache (such as Redis) with user ID + interface + random code as the index, and a timing invalidation mechanism (TTL) is set. The target Cookie refers to a specific Cookie item stored in the user's browser, which is used to carry the unique authorization identifier. The back end automatically writes this Cookie after verification is successful, and subsequent requests are automatically passed through this identifier to achieve fast verification.
[0031] Specifically: ① When the back-end password verification information verification is successful, a unique authorization identifier (Key) is generated and recorded in the distributed cache Redis, and the Key has a timing validity (TTL). ② The back-end sets the generated Key in the target Cookie of the user, and the subsequent related interface call request only needs to carry the target Cookie to automatically complete the secondary verification, without the need for the user to repeatedly input the password, thereby improving the user experience. ③ When the back-end determines that the secondary password verification is successful, a prompt information of the successful secondary password verification can be output through the front-end.
[0032] The technical scheme of the embodiment can effectively avoid intrusion into business logic and generate redundant code, improve development efficiency and maintenance convenience, and realize a flexible authentication strategy by using the association of the status code and the unique authorization identifier, adapt to complex and variable business scenarios, and enhance the reliability and flexibility of the back-end interface security authentication.
[0033] In an optional manner, the step of determining whether the target general interface is a general interface to be subjected to secondary password verification by using the request verification module and sending a response status code generated according to the determination result to the front-end comprises: Determining whether the target general interface is a general interface to be subjected to secondary password verification by using the request verification module to obtain a first determination result.
[0034] In the embodiment, the same request verification module is used for verification, such as an AOP interceptor or an API gateway.
[0035] When the first determination result is yes, the request verification module is used to parse the interface call request to obtain the target Cookie, and determine whether the authorization code exists in the target Cookie to obtain a second determination result.
[0036] It should be noted that when the first determination result is no, a status code indicating that no secondary verification is required is generated and sent to the front-end, so that the front-end normally returns the interface call request.
[0037] When the second determination result is yes, the request verification module is used to determine whether the authorization code in the target Cookie exists in Redis to obtain a third determination result.
[0038] When the third determination result is no, the request verification module is used to generate the secondary verification status code and send it to the front-end.
[0039] When the authorization code in the target Cookie does not exist in Redis, it means that the authorization code in the Cookie is incorrect or invalid.
[0040] In the optional manner described above, by judging whether the target general interface is a general interface to be subjected to secondary password verification and judging whether the authorization code exists in the target Cookie, when the third judgment result is no, a secondary verification status code is generated and sent to the front end, further improving the accuracy and security of secondary password verification, reducing unnecessary secondary verification process, and improving interface security authentication efficiency.
[0041] In an optional manner, the step of judging whether the target general interface is a general interface to be subjected to secondary password verification and sending a response status code generated according to the judgment result to the front end by using the request verification module further includes: when the second judgment result is no, using the request verification module to generate the secondary verification status code and send it to the front end.
[0042] When the authorization code does not exist in the target Cookie, a secondary verification status code is directly generated and sent to the front end.
[0043] In the optional manner described above, the triggering condition of secondary verification is further simplified, the secondary verification process is more efficient, the processing time for invalid requests is reduced, and the response speed is improved.
[0044] In an optional manner, the method further includes: The target general interface is configured as a general interface to be subjected to secondary password verification, and the maximum authorization duration of the target general interface is set.
[0045] Among them, the backend will be configured as a general interface to be subjected to secondary password verification for sensitive API or service interface that needs to be protected, and set the default authorization duration and the maximum authorization duration for each interface when configuring. Support operation and maintenance personnel to adjust and refine the protection strength of different interfaces at any time to meet the needs of different business scenarios for security.
[0046] In the optional manner described above, further security management of different interfaces can be further refined according to business needs, further improving the reliability of interface security authentication.
[0047] In an optional manner, the secondary password verification information includes: secondary verification password and expected authorization duration; the expected authorization duration is not greater than the maximum authorization duration.
[0048] The secondary password verification is a secondary authentication credential of the user independent of the login password, is encrypted by the front end and transmitted to the back end for verification, and supports combination with a verification code, a sliding block and the like to prevent brute force cracking. The expected authorization duration is a secondary verification validity period (unit: seconds) set by the user for this operation, which is collected by the front end pop-up window. The value cannot exceed the preset maximum authorization duration. The maximum authorization duration is a security threshold (such as 300 seconds) configured for each target universal interface, which forcibly limits the maximum validity period of single authorization to avoid the risk of long-term permission retention. If the expected authorization duration input by the user exceeds the maximum authorization duration, an error prompt message is output by the front end to prompt the user to re-input.
[0049] In the optional mode described above, the individual needs of the user for the authorization duration are met while effectively preventing security risks caused by the user setting an excessively long authorization duration, thereby improving security and user experience.
[0050] In an optional mode, the method further comprises: When the secondary password verification information fails to pass verification, an error prompt message of the secondary password verification is output by the front end.
[0051] The front end outputs an error prompt message of the secondary password verification, and then jumps to a pop-up window interface to prompt the user to re-input the secondary verification password and the expected authorization duration.
[0052] It should be noted that the back end adds a security protection mechanism, such as limiting the maximum number of retries and preventing concurrent brute force cracking. When the user continuously inputs the wrong password within a limited number of times, the back end will automatically lock the user, log out the current session, or forcibly log out to ensure that the password security is not threatened by attacks.
[0053] In the optional mode described above, the user can further learn the reason for the failed verification in a timely manner and perform corresponding operations, thereby improving user experience.
[0054] In an optional mode, the request verification module is an AOP interceptor or an API gateway.
[0055] The AOP interceptor is a request interception module based on aspect-oriented programming (AOP), which filters interface call requests uniformly before the execution of business logic to achieve zero-code-invasive security verification. The API gateway is a request proxy layer deployed at the entrance of a service cluster, which centrally processes the routing, authentication and traffic control of interface call requests.
[0056] In the optional mode described above, the non-invasive integration mode of AOP or API gateway interception can quickly add secondary password protection to existing systems without significantly reconstructing the original business logic, thereby greatly reducing development and operation costs.
[0057] Figure 2 A structure diagram of an embodiment of a general interface security authentication system 200 based on secondary password verification provided by the application is shown. As shown, the system 200 includes a front end 210 and a back end 220; the back end 220 is configured to: when receiving an interface call request of a target general interface by a user, determine whether the target general interface is a general interface to be subjected to secondary password verification by using a request verification module, and send a response status code generated according to a determination result to the front end 210; Figure 2 when the response status code is a secondary verification status code, receive secondary password verification information obtained by the front end 210 initiating a secondary password information acquisition request according to the secondary verification status code; when the secondary password verification information is verified successfully, generate a unique authorization identifier and associate the unique authorization identifier to a target Cookie of the user, and determine that the secondary password verification is successful.
[0058] In an optional manner, the back end 220 is specifically configured to: determine whether the target general interface is a general interface to be subjected to secondary password verification by using the request verification module, to obtain a first determination result; when the first determination result is yes, parse the interface call request by using the request verification module, to obtain the target Cookie, and determine whether an authorization code exists in the target Cookie, to obtain a second determination result; when the second determination result is yes, determine whether the authorization code in the target Cookie exists in Redis by using the request verification module, to obtain a third determination result; when the third determination result is no, generate the secondary verification status code by using the request verification module and send the secondary verification status code to the front end 210.
[0059] In an optional manner, the back end 220 is specifically configured to: when the second determination result is no, generate the secondary verification status code by using the request verification module and send the secondary verification status code to the front end 210.
[0060] In an optional manner, the back end 220 is specifically configured to: configure the target general interface as a general interface to be subjected to secondary password verification, and set a maximum authorization duration of the target general interface.
[0061] In an optional manner, the secondary password verification information includes a secondary verification password and an expected authorization duration; the expected authorization duration is not greater than the maximum authorization duration.
[0062] In an alternative mode, the backend 220 is further configured to: When the secondary password verification information fails to pass the verification, the front end outputs prompt information of secondary password verification error.
[0063] In an alternative mode, the request verification module is an AOP interceptor or an API gateway.
[0064] The technical solution of the embodiment can effectively avoid intrusion into business logic and generation of redundant codes, improve development efficiency and maintenance convenience, and realize a flexible authentication strategy by using the association of the status code and the unique authorization identifier, adapt to complex and changeable business scenarios, and enhance the reliability and flexibility of the security authentication of the backend interface.
[0065] It should be noted that the beneficial effects of the general interface security authentication system 200 based on secondary password verification provided by the above embodiments are the same as those of the general interface security authentication method based on secondary password verification, and will not be repeated here.
[0066] In the specification provided herein, a large number of specific details are described. However, it can be understood that the embodiments of the application can be practiced without these specific details. Similarly, in order to simplify the application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the application, various features of the embodiments of the application are sometimes grouped together into a single embodiment, figure, or description thereof. Among them, the claims following the detailed description are hereby expressly incorporated into the detailed description, wherein each claim itself is a separate embodiment of the application.
[0067] It should be noted that the above embodiments illustrate the application rather than limit the application, and those skilled in the art can design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs located between parentheses shall not constitute a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The application can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, the several means can be embodied by one and the same item of hardware. The use of the words first, second and third, etc. does not imply any order. These words can be understood as names. The steps of the above-described embodiments, unless otherwise specified, should not be understood as limited to the order in which they are presented.
Claims
1. A general interface security authentication method based on two-factor authentication, applied to the backend, characterized in that, include: When a user's API call request for a target general interface is received, the request verification module is used to determine whether the target general interface is a general interface that requires secondary password verification, and the response status code generated based on the determination result is sent to the front end. When the response status code is a secondary verification status code, the secondary password verification information obtained by the front end initiating a secondary password information acquisition request based on the secondary verification status code is received. When the secondary password verification information is successfully verified, a unique authorization identifier is generated and associated with the user's target cookie, and the secondary password verification is determined to be successful.
2. The general interface security authentication method based on two-factor cryptographic verification according to claim 1, characterized in that, The steps of using the request verification module to determine whether the target general interface is a general interface requiring secondary password verification, and sending the response status code generated based on the determination result to the front end, include: Using the request verification module, it is determined whether the target general interface is a general interface requiring secondary password verification, and a first judgment result is obtained; When the first judgment result is yes, the request verification module is used to parse the interface call request to obtain the target Cookie, and it is determined whether there is an authorization code in the target Cookie to obtain the second judgment result; When the second judgment result is yes, the request verification module is used to determine whether the authorization code in the target cookie exists in Redis, and a third judgment result is obtained; When the third judgment result is negative, the request verification module is used to generate the secondary verification status code and send it to the front end.
3. The general interface security authentication method based on two-factor cryptographic verification according to claim 2, characterized in that, The step of using the request verification module to determine whether the target general interface is a general interface requiring secondary password verification, and sending the response status code generated based on the determination result to the front end, further includes: When the second judgment result is negative, the request verification module is used to generate the secondary verification status code and send it to the front end.
4. The general interface security authentication method based on two-factor cryptographic verification according to claim 1, characterized in that, Also includes: Configure the target general interface as a general interface to be subject to secondary password verification, and set the maximum authorization duration of the target general interface.
5. The general interface security authentication method based on two-factor cryptographic verification according to claim 4, characterized in that, The secondary password verification information includes: the secondary verification password and the expected authorization duration; the expected authorization duration is not greater than the maximum authorization duration.
6. The general interface security authentication method based on two-factor cryptographic verification according to claim 1, characterized in that, Also includes: When the secondary password verification fails, the front end outputs a message indicating a secondary password verification error.
7. The general interface security authentication method based on two-factor cryptographic verification according to any one of claims 1 to 6, characterized in that, The request verification module is either an AOP interceptor or an API gateway.
8. A universal interface security authentication system based on two-factor authentication, characterized in that, include: Front-end and back-end; the back-end is used for: When a user's API call request for a target general interface is received, the request verification module is used to determine whether the target general interface is a general interface that requires secondary password verification, and the response status code generated based on the determination result is sent to the front end. When the response status code is a secondary verification status code, the secondary password verification information obtained by the front end initiating a secondary password information acquisition request based on the secondary verification status code is received. When the secondary password verification information is successfully verified, a unique authorization identifier is generated and associated with the user's target cookie, and the secondary password verification is determined to be successful.
9. The universal interface security authentication system based on two-factor cryptographic verification according to claim 8, characterized in that, The backend is specifically used for: Using the request verification module, it is determined whether the target general interface is a general interface requiring secondary password verification, and a first judgment result is obtained; When the first judgment result is yes, the request verification module is used to parse the interface call request to obtain the target Cookie, and it is determined whether there is an authorization code in the target Cookie to obtain the second judgment result; When the second judgment result is yes, the request verification module is used to determine whether the authorization code in the target cookie exists in Redis, and a third judgment result is obtained; When the third judgment result is negative, the request verification module is used to generate the secondary verification status code and send it to the front end.
10. The universal interface security authentication system based on two-factor cryptographic verification according to claim 9, characterized in that, The backend is also specifically used for: When the second judgment result is negative, the secondary verification status code is generated and sent to the front end.