Verification information generation method and device, verification method and device, equipment, medium and product

Abstract

The invention provides a verification information generation method, which is applied to the field of big data, and comprises the following steps: in response to user login, generating a session token according to an initial key, a time window and a device fingerprint, the time window being determined by a current time point; in response to the occurrence of a service request corresponding to the session token, generating a tamper-proof identifier according to the session token and the service; generating a target signature according to the tamper-proof identifier, the time window and the equipment fingerprint; generating a target verification parameter according to the target signature and the session token; and taking a set of the tamper-proof identifier, the target signature, the target verification parameter and the service information as verification information. The invention further provides a verification method, and a device, equipment, a medium and a product for executing the method.

Description

Technical Field

[0001] This application relates to the field of big data, and more specifically, to a method for generating verification information, a verification method, an apparatus, a device, a medium, and a product. Background Technology

[0002] In network applications and information systems, ensuring secure interaction between clients and servers is a core requirement. Existing technologies typically employ token authentication and message integrity verification. However, these solutions have significant drawbacks. First, token-based authentication mechanisms, once their credentials are leaked within their validity period, can be reused infinitely by attackers, and the credentials themselves are usually not strongly cryptographically bound to the client device or business context. Even if some solutions use dynamic keys, their updates often rely on fixed periods, lacking dynamic correlation with real-time states, resulting in insufficient security. Furthermore, the security verification logic of existing technologies is generally isolated, performing separate verifications of key security elements such as timestamps, device fingerprints, and message integrity. This decoupled verification method allows attackers to breach individual links, for example, by forging timestamps or tampering with message content to bypass some verifications, causing the overall defense system to fail. Summary of the Invention

[0003] In view of this, this application provides a method for generating verification information, a verification method, an apparatus, a device, a medium, and a product.

[0004] One aspect of this application provides a method for generating verification information, comprising: in response to user login, generating a session token based on an initial key, a time window, and a device fingerprint, wherein the time window is determined by the current time; in response to a business request corresponding to the session token, generating an anti-tamper identifier based on the session token and the business request; generating a target signature based on the anti-tamper identifier, the time window, and the device fingerprint; generating target verification parameters based on the target signature and the session token; and using the set of the anti-tamper identifier, the target signature, the target verification parameters, and the business information as verification information.

[0005] According to an embodiment of this application, generating a session token based on an initial key, a time window, and a device fingerprint includes: processing the time window using a hash encryption algorithm to obtain first information; processing the device fingerprint using a hash encryption algorithm to obtain second information; and generating a session token using the first information, the second information, the initial key, and the user's user information using a symmetric key encryption algorithm.

[0006] According to an embodiment of this application, in response to a business request corresponding to a session token, an anti-tampering identifier is generated based on the session token and the business information of the business, including: processing the business information based on a hash encryption algorithm to obtain third information; and processing the target business information and the session token based on a hash encryption algorithm to obtain the anti-tampering identifier.

[0007] According to an embodiment of this application, generating a target signature based on an anti-tampering identifier, a time window, and a device fingerprint includes: processing the time window, device fingerprint, and anti-tampering identifier using a hash encryption algorithm to obtain fourth information; and processing the session token and the fourth information using a symmetric key encryption algorithm to obtain the target signature.

[0008] According to an embodiment of this application, generating target verification parameters based on the target signature and session token includes: processing the session token and anti-tampering identifier based on a hash encryption algorithm to obtain fifth information; and processing the fifth information and target signature based on a symmetric key encryption algorithm to obtain target verification parameters.

[0009] Another aspect of this application provides a verification method, comprising: obtaining a session token and verification information, wherein the verification information includes at least one of an anti-tampering identifier, a target signature, and a target verification parameter, wherein the anti-tampering identifier, the target signature, and the target verification parameter are all generated through a time window, the time window being determined based on the user's login time; verifying the session token, the anti-tampering identifier, the target signature, and the target verification parameter; and, in response to any failure of verification of the anti-tampering identifier, the target signature, and the target verification parameter, stopping the business process and issuing an alarm message; wherein the anti-tampering identifier is generated based on the session token and the business request corresponding to the session token; wherein the target signature is generated based on the anti-tampering identifier, the time window, and the device fingerprint; and wherein the target verification parameter is generated based on the target signature and the session token.

[0010] According to embodiments of this application, the verification of the session token, anti-tampering identifier, target signature, and target verification parameters includes: verifying whether the current time point is within the time window corresponding to the session token; and / or, reconstructing the session token based on the time window and verification information to obtain a reconstructed token; and verifying the anti-tampering identifier, target signature, and target verification parameters based on the reconstructed token.

[0011] According to an embodiment of this application, based on a reconstruction token, verifying the anti-tampering identifier, the target signature, and the target verification parameters includes: generating a reconstruction identifier based on the reconstruction token and a hash encryption algorithm; and verifying the anti-tampering identifier, the target signature, and the target verification parameters based on the reconstruction identifier.

[0012] Another aspect of this application provides a verification information generation apparatus, comprising: a first generation module, configured to generate a session token in response to user login, based on an initial key, a time window, and a device fingerprint, wherein the time window is determined by the current time point; a second generation module, configured to generate an anti-tampering identifier in response to a business request corresponding to the session token, based on the session token and the business request; a third generation module, configured to generate a target signature based on the anti-tampering identifier, the time window, and the device fingerprint; a fourth generation module, configured to generate target verification parameters based on the target signature and the session token; and an integration module, configured to combine the anti-tampering identifier, the target signature, the target verification parameters, and the business information as verification information.

[0013] Another aspect of this application provides a verification device, comprising: an acquisition module for acquiring a session token and verification information, wherein the verification information includes at least one of an anti-tampering identifier, a target signature, and a target verification parameter, wherein the anti-tampering identifier, the target signature, and the target verification parameter are all generated through a time window, the time window being determined based on the user's login time; a verification module for verifying the session token, the anti-tampering identifier, the target signature, and the target verification parameter; and an alarm module for stopping the business process and issuing an alarm message in response to any failure of verification of the anti-tampering identifier, the target signature, and the target verification parameter; wherein the anti-tampering identifier is generated based on the session token and the business request corresponding to the session token; wherein the target signature is generated based on the anti-tampering identifier, the time window, and the device fingerprint; and wherein the target verification parameter is generated based on the target signature and the session token.

[0014] Another aspect of this application provides an electronic device, including: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the verification information generation method and / or verification method of any of the foregoing embodiments.

[0015] Another aspect of this application provides a computer-readable storage medium storing computer instructions, wherein the computer instructions are configured to cause a computer to perform a verification information generation method and / or a verification method according to any of the foregoing embodiments.

[0016] Another aspect of this application provides a computer program product, including a computer program / instructions, characterized in that when the computer program / instructions are executed by a processor, they implement the operation of the verification information generation method and / or verification method of any of the foregoing embodiments. Attached Figure Description

[0017] The above and other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0018] Figure 1 The illustration shows a method for generating verification information according to an embodiment of this application, as well as an application scenario diagram of the verification method;

[0019] Figure 2 A flowchart illustrating a verification information generation method according to an embodiment of this application is shown schematically.

[0020] Figure 3 This illustration schematically shows a flowchart of the method for generating a session token in accordance with an embodiment of this application;

[0021] Figure 4 This illustration schematically shows a flowchart of the method for generating an anti-tampering identifier in the verification information generation method according to an embodiment of this application;

[0022] Figure 5 This illustration schematically shows a flowchart of the method for generating a target signature in the verification information generation method according to an embodiment of this application;

[0023] Figure 6 This illustration schematically shows a flowchart of the method for generating target verification parameters according to an embodiment of the present application;

[0024] Figure 7 A flowchart illustrating a verification method according to an embodiment of this application is shown schematically.

[0025] Figure 8 The flowchart illustrating the verification process according to an embodiment of this application is shown in the illustration.

[0026] Figure 9 The flowchart illustrating the verification process according to an embodiment of this application is shown in the diagram.

[0027] Figure 10 A block diagram of a verification information generation apparatus according to an embodiment of this application is shown schematically;

[0028] Figure 11 A block diagram of a verification apparatus according to an embodiment of this application is schematically shown; and

[0029] Figure 12 A block diagram of an electronic device suitable for implementing the methods described above, according to an embodiment of this application, is illustrated schematically. Detailed Implementation

[0030] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0031] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0032] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0033] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0034] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0035] Embodiments of this application provide a method for generating verification information, including: in response to user login, generating a session token based on an initial key, a time window, and a device fingerprint, wherein the time window is determined by the current time point; in response to a service request corresponding to the session token, generating an anti-tampering identifier based on the session token and the service; generating a target signature based on the anti-tampering identifier, the time window, and the device fingerprint; generating target verification parameters based on the target signature and the session token; and using the set of the anti-tampering identifier, the target signature, the target verification parameters, and the service information as verification information.

[0036] Figure 1 The illustration shows a verification information generation method according to an embodiment of this application, as well as an application scenario diagram of the verification method.

[0037] like Figure 1 As shown, application scenario 100 includes network interaction between multiple terminal devices and a server. Network 104 serves as the medium for the communication link, connecting the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 can employ various connection methods, such as wired connections, wireless communication links, or fiber optic cables, to ensure the stability and security of data transmission.

[0038] Users can interact with server 105 through first terminal device 101, second terminal device 102, and third terminal device 103 to initiate business requests containing business information. These terminal devices can be equipped with client applications that require secure communication with the server, such as online banking applications, e-commerce platform applications, enterprise resource planning (ERP) system clients, and instant messaging tools (for example only).

[0039] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be different types of electronic devices with data processing and network communication capabilities, such as, but not limited to, smartphones (e.g., 101), tablet computers (e.g., 102), laptop computers (e.g., 103), and desktop computers.

[0040] Server 105 is responsible for providing business processing services, such as a financial transaction processing server or a back-end management server. Server 105 verifies and processes business requests received from terminal devices and sends the processing results back to the terminal devices.

[0041] It should be noted that the verification information generation method and verification method provided in this application typically have their verification information generation steps performed by the first terminal device 101, the second terminal device 102, or the third terminal device 103; and their verification steps typically performed by the server 105. Accordingly, the device for generating verification information is generally located in the terminal device, while the device for verifying verification information is generally located in the server 105. Furthermore, the verification steps can also be performed by an independent verification server or server cluster, different from the server 105, which can communicate with the terminal device and / or the server 105.

[0042] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is for illustrative purposes only. Depending on the specific implementation needs, there can be any number of terminal devices, networks, and servers to meet different business requirements and application scenarios.

[0043] Figure 2 A flowchart illustrating a verification information generation method according to an embodiment of this application is shown.

[0044] like Figure 2 As shown, the verification information generation method may include at least operations S210 to S250.

[0045] In operation S210, in response to user login, a session token is generated based on the initial key, time window, and device fingerprint. The time window is determined by the current time. The initial key can be a root key preset in the server or security hardware module, which has a high security level and is not directly transmitted, serving as the root of trust for all subsequent encryption operations. The time window can refer to a valid time interval centered on the current time. For example, if the current time is T, the valid time window can be defined as [T-Δt, T+Δt], where Δt is a preset time offset. The device fingerprint can be a string of characteristic data used to uniquely identify the client's physical device or software environment. The session token can be a temporary credential valid within a specific session period, used to identify the user's login status and session context.

[0046] Specifically, after a user successfully authenticates, the client initiates a request to generate a session token. The client device collects its device fingerprint and obtains the current system time to determine a time window. Subsequently, the client sends this information to a trusted entity (such as a server or a dedicated authentication server), which uses an internally stored initial key to encrypt the received time window and device fingerprint, thereby generating a session token strongly associated with the current time and device, and returns the session token to the client.

[0047] For example, the initial key could be a 256-bit key stored in the hardware security module. The device fingerprint could be a combination of the client device's International Mobile Equipment Identity (IMIO) and Media Access Control (MAC) address. The time window could be a 60-second interval centered on the current server timestamp, extending 30 seconds before and after it. The final generated session token could be a 128-bit hexadecimal string.

[0048] In operation S220, in response to a business request corresponding to the session token, an tamper-proof identifier is generated based on the session token and the business request. The business request can refer to a specific operation request initiated by the user through the client, such as a transfer, query, or order placement. It typically contains specific business parameter information, also known as business information or request message. The tamper-proof identifier can be a data digest generated through a one-way cryptographic function that reflects the integrity of the session token and business information.

[0049] Specifically, when a user performs an operation on the client side, the client application binds the corresponding business information (e.g., a JSON object containing data such as counterparty, amount, and product ID) to the session token obtained in operation S210. This ensures that the output tamper-proof identifier has a unique and irreversible correspondence with both the input session token and the business information. Any minor modification to the original business information will result in the generation of a completely different tamper-proof identifier. For example, the business information for a transfer transaction could be {"transfer to":"userB","amount":100}. The client concatenates this string with the currently held session token (such as the aforementioned 128-bit hexadecimal string) and then calculates a fixed-length tamper-proof identifier string using a one-way processing function.

[0050] In operation S230, a target signature is generated based on the tamper-proof identifier, time window, and device fingerprint. The target signature can be a digital signature, its function being to prove that the entity generating the signature possesses specific credentials (such as a session token) and to verify the reliability and integrity of a set of data (e.g., a combination of the tamper-proof identifier, time window, and device fingerprint). Specifically, the tamper-proof identifier, representing the integrity of the business content, is aggregated with the time window and device fingerprint, representing the session context. Then, a preset signature algorithm is used to sign this aggregated information, thereby generating the target signature. For example, the tamper-proof identifier generated in operation S220, the time window used in operation S210 (e.g., [T-Δt, T+Δt]), and the device fingerprint are concatenated into a new data block. Then, a signature function is called to process this data block to generate the target signature.

[0051] In operation S240, a target verification parameter is generated based on the target signature and session token. The target verification parameter can be a final, dynamically generated parameter used for closed-loop verification. The generation of this parameter depends on the correct output of all preceding steps. Specifically, a cryptographic transformation method is used, taking the target signature generated in operation S230 and the session token generated in operation S210 as inputs. After processing by this transformation method, a result is output as the target verification parameter. Since the generation of the target signature depends on the tamper-proof identifier, time window, and device fingerprint, and the tamper-proof identifier depends on the session token and business information, this target verification parameter is actually the final result of all key security elements (key, time, device, business) throughout the entire request lifecycle.

[0052] In operation S250, the set of anti-tampering identifier, target signature, target verification parameters, and business information is used as verification information. Verification information can refer to the complete set of data that the client ultimately constructs and sends to the server for the server to verify the legitimacy of the request.

[0053] According to the embodiments of this application, a cryptographic dependency chain is constructed by linking the time window, device fingerprint, session token, business information, anti-tampering identifier, target signature, and target verification parameters. The correctness of the final generated target verification parameter depends on the correctness of all previous links. Even if an attacker intercepts all the information of a single request, they cannot independently generate a legitimate target verification parameter for a new time window or tampered business information, because the generation process of this parameter is an irreversible cryptographic transformation, and its input (target signature) is deeply bound to the original time window. This means that an attacker cannot forge a request valid within a future time window through simple time shifting or deception, because they cannot predict the correct target verification parameter derived from a legitimate future time window. Any tampering with the time parameter will cause a mismatch when the server reconstructs the verification chain, thus causing the verification chain to break.

[0054] Figure 3 The flowchart illustrating the generation of a session token in the verification information generation method according to an embodiment of this application is shown in the illustration.

[0055] like Figure 3 As shown, based on the aforementioned embodiments, operation S210 may include operations S310 to S330.

[0056] When operating the S310, the time window is processed based on a hash encryption algorithm to obtain the first information.

[0057] When operating the S320, the device fingerprint is processed based on a hash encryption algorithm to obtain secondary information.

[0058] When operating the S330, a session token is generated based on the symmetric key encryption algorithm, using the first information, the second information, the initial key, and the user's information.

[0059] Hash encryption algorithms can be one-way cryptographic functions, such as the SM3 algorithm, which can map input data of arbitrary length to a fixed-length output digest and is collision-resistant and irreversible. Symmetric-key encryption algorithms can be algorithms that use the same key for both encryption and decryption, such as the SM4 algorithm. The first and second information can be digest values ​​obtained by hashing the time window and device fingerprint, respectively. User information can be an identifier that uniquely identifies the currently logged-in user, such as a user ID.

[0060] Specifically, firstly, a preset hash encryption algorithm is used to independently process the time window data and device fingerprint data. This process converts the original, potentially regular time information and sensitive device characteristic information into irreversible, fixed-length hash values, namely, the first information and the second information. Then, a preset bitwise operation (e.g., XOR operation) is performed on the first and second information to achieve deep fusion. The fused result is then concatenated with the user's information to form a plaintext data block to be encrypted. Finally, a symmetric key encryption algorithm is invoked to encrypt the plaintext data block using the initial key. The resulting ciphertext is the final session token.

[0061] For example, the hash encryption algorithm could be SM3, and the symmetric key encryption algorithm could be SM4. First, SM3 (time window) is executed to obtain 256 bits of first information, and SM3 (device fingerprint) is executed to obtain 256 bits of second information. Then, a bitwise XOR operation is performed on the first and second information to obtain a 256-bit intermediate result. Next, this intermediate result is concatenated with the user's UserID string. Finally, a preset initial key K is used. m The concatenated data is then encrypted using the SM4 algorithm to generate the final session token K. t

[0062] The specific formula can be: K t =SM4 加密 (K) m ,SM3(T w )⊕SM3(D f UserID)

[0063] Among them, K t K represents the session token. m T represents the initial key. w D represents the time window. fThis indicates the device fingerprint, UserID indicates user information, and SM4... 加密 () indicates the SM4 encryption algorithm.

[0064] According to the embodiments of this application, by first processing the time window and device fingerprint using a hash encryption algorithm during the generation of the session token, the original data can be transformed into irreversible digest information. This effectively hides the original device fingerprint, avoiding direct exposure of sensitive information; on the other hand, it also performs one-way processing on the time parameters, making it impossible for attackers to deduce the specific time window pattern even if they intercept the intermediate data before encryption. Furthermore, since the final session token is generated using a high-strength initial key encryption, even if an attacker obtains the token for the current session, they cannot decrypt or forge a valid token applicable to other time windows or different devices without obtaining the initial key. This ensures the session token's irreducibility in the time dimension and enhances the system's resistance to attacks.

[0065] Figure 4 The flowchart illustrating the generation of an anti-tampering identifier in the verification information generation method according to an embodiment of this application is shown in the illustration.

[0066] like Figure 4 As shown, based on the aforementioned embodiments, operation S220 may include operations S410~S420.

[0067] When operating the S410, business information is processed based on a hash encryption algorithm to obtain third-party information.

[0068] In operation S420, based on a hash encryption algorithm, the target business information and session token are processed to obtain an anti-tampering identifier. The process of generating the anti-tampering identifier is designed as a two-step hash operation. The third information can be a data digest obtained by hashing the original business information, which can serve as a compact and unique "fingerprint" of the business information. Specifically, firstly, in operation S410, the business information carrying the specific operation content in the business request is extracted, and a preset hash encryption algorithm is applied to it. The output of this step is the third information, representing the integrity digest of the original business information. Next, in operation S420, the third information generated in the previous step is combined with the currently valid session token in a preset way (for example, concatenating the two into a byte stream in a specific order), and then the hash encryption algorithm is applied again to this new combined data. The final hash value generated is the anti-tampering identifier.

[0069] For example, the hash encryption algorithm could be the SM3 algorithm. The business information for a transfer request could be a payment information field (e.g., {"Transfer to account":"622...","Amount":1000.00}). Operation S410 calculates "Third information = SM3 (payment information)". Operation S420 then uses the session token K generated in operation S210... t This is concatenated with the third piece of information and hashed again, resulting in "tamper-proof identifier = SM3(K)". t "Third information"

[0070] That is, the specific formula can be: σ m =SM3(K t ‖SM3(payload));

[0071] Where SM3() represents the SM3 algorithm, σ m This indicates a tamper-proof identifier, and the payload represents business information.

[0072] According to the embodiments of this application, a nested hash structure is constructed by performing an initial hashing process on the business information and then a secondary hashing process on the hash result and the session token. This structure not only ensures the integrity of the business information itself and prevents the content from being directly tampered with during transmission, but also strongly cryptographically binds a specific business request to a legitimate session token. Any attack attempting to use a legitimate session token for an unauthorized or tampered business request will be identified and blocked by the server because it cannot generate a matching, correct anti-tampering identifier. This effectively solves the security risk of message content being decoupled from session identity and significantly improves the system's anti-tampering capability.

[0073] Figure 5 The flowchart illustrating the generation of a target signature in the verification information generation method according to an embodiment of this application is shown in the illustration.

[0074] like Figure 5 As shown, based on the aforementioned embodiments, S230 may include operations S510~S520.

[0075] When operating the S510, based on the hash encryption algorithm, the time window, device fingerprint, and anti-tampering identifier are processed to obtain the fourth information.

[0076] When operating the S520, the session token and fourth information are processed based on a symmetric key encryption algorithm to obtain the target signature.

[0077] The fourth information can be a unified digest generated by aggregating multiple security elements. As a whole, it represents a contextual snapshot of a specific business operation that occurred at a specific time and on a specific device. The target signature can be a cryptographic authentication token generated using a symmetric key. Functionally similar to a message authentication code, it proves that the generator holds a session token that serves as the key and ensures the integrity and authenticity of the authenticated data (i.e., the fourth information).

[0078] Specifically, to generate the target signature, in operation S510, the time window representing the session context and the device fingerprint, along with the tamper-proof identifier representing the integrity of the business content, are concatenated in a preset order to form an aggregated data block. Then, a preset hash encryption algorithm is applied to this aggregated data block to generate a fixed-length hash digest, which is the fourth piece of information. Next, in operation S520, a symmetric-key encryption algorithm is invoked, using the session token of the current session as the encryption key, to encrypt the fourth piece of information generated in the previous step. The ciphertext generated by this encryption operation is defined as the target signature for this request.

[0079] For example, the hash encryption algorithm could be SM3, and the symmetric key encryption algorithm could be SM4. Operation S510 will set the time window T... w Device fingerprint D f and tamper-evident mark σ m Calculate the hash value after concatenation: Fourth information = SM3(T) w ||D f ‖σ m The S520 operation uses the session token Kt as the key to encrypt the fourth message using SM4. To balance security and transmission overhead, in some implementations, only the first 128 bits of the encrypted result can be extracted as the final target signature.

[0080] The specific formula can be: σ d =SM2 签名 (K t ,SM3(T w ||D f ‖σ m ))

[0081] Wherein, SM2 is represented. 签名 () signature algorithm, σ d Indicates the target signature.

[0082] According to an embodiment of this application, a target signature is generated by hashing and aggregating the time window, device fingerprint, and tamper-proof identifier, and then using the session token as the key for symmetric encryption. An inseparable cryptographic link is established between the business content (represented by the tamper-proof identifier) ​​and the session environment (represented by the time window and device fingerprint). Since the correctness of this link requires authentication through the secret information of the session token, only clients holding legitimate session tokens can generate valid target signatures for specific "time-device-business" combinations. This effectively prevents attackers from maliciously combining the tamper-proof identifier intercepted from a legitimate request with a different time window or device fingerprint, thereby ensuring the integrity and non-repudiation of the request context.

[0083] Figure 6 The flowchart illustrating the generation of target verification parameters in the verification information generation method according to an embodiment of this application is shown in the illustration.

[0084] like Figure 6 As shown, based on the aforementioned embodiments, S240 may include operations S610~S620.

[0085] When operating the S610, the session token and tamper-proof identifier are processed based on a hash encryption algorithm to obtain the fifth piece of information.

[0086] When operating the S620, based on the symmetric key encryption algorithm, the fifth information and the target signature are processed to obtain the target verification parameters.

[0087] The fifth piece of information can be an intermediate digest generated through hash operations, used to fuse session identity and business content integrity. Specifically, firstly, in operation S610, the session token of the current session and the tamper-proof identifier representing the integrity of the business content are combined in a preset manner (e.g., concatenated in byte order), and a hash encryption algorithm is applied to the combined data to generate the fifth piece of information. Next, in operation S620, a symmetric key encryption algorithm is invoked, using the target signature generated in operation S230, which represents the complete session context (time, device, business), as the encryption key to encrypt the fifth piece of information generated in the previous step. The output of this encryption operation is the target verification parameter.

[0088] For example, the hash encryption algorithm could be SM3, and the symmetric key encryption algorithm could be SM4. The process of operating S610 involves calculating "Fifth Information = SM3(Session Token K)". t ‖Anti-tampering mark σ m The process of operating the S620 involves using the target signature σ. dThe fifth message is encrypted using SM4 as the key. In some embodiments, to meet specific format requirements, a modulo operation (e.g., mod2) can be performed on the encrypted result. 32 A fixed-length integer is generated as the final target verification parameter.

[0089] The specific formula could be: T' w =SM4 加密 (σ d ,SM3(K t ‖σ m ))mod2 32 ;

[0090] Among them, T' w This represents the target validation parameters.

[0091] According to an embodiment of this application, the target verification parameter is generated by encrypting the fifth information, which integrates the session token and the tamper-proof identifier, using the target signature as the encryption key. The correctness of the target verification parameter depends not only on the correctness of its plaintext (the fifth information) but also, and more importantly, on the correctness of its encryption key (the target signature). The target signature itself is a comprehensive authentication of multiple dimensions, including time, device, and business content. Therefore, this target verification parameter becomes the final condensation of all security elements in the entire request, making the entire verification information an indivisible and organic whole. Any illegal tampering with any part of the request will prevent the generation or reconstruction of this final, correct verification parameter, thus providing the server with a single, efficient final verification point.

[0092] Figure 7 A flowchart illustrating a verification method according to an embodiment of this application is shown schematically.

[0093] like Figure 7 As shown, based on the foregoing embodiments, the verification method may include operations S710 to S730.

[0094] When operating the S710, a session token and verification information are obtained. The verification information includes at least one of the following: an anti-tampering identifier, a target signature, and a target verification parameter. The anti-tampering identifier, target signature, and target verification parameter are all generated using a time window, which is determined based on the user's login time. Specifically, the anti-tampering identifier is generated in response to a business request corresponding to the session token, based on the session token and the business request; the target signature is generated based on the anti-tampering identifier, the time window, and the device fingerprint; and the target verification parameter is generated based on the target signature and the session token.

[0095] When operating the S720, the session token, tamper-proof identifier, target signature, and target verification parameters are verified.

[0096] When operating the S730, if any of the following verifications fails: anti-tampering identifier, target signature, or target verification parameters, the business process is stopped and an alarm message is issued.

[0097] Verification can refer to the process by which the server recalculates and compares received data according to preset algorithms and procedures to confirm its legality, completeness, and authenticity. Stopping a business process can refer to refusing to execute the business logic requested by the client, such as suspending a transfer transaction or canceling an order query. Issuing an alert can refer to logging the failed verification attempt in the security log or triggering a real-time security monitoring alert.

[0098] Specifically, after receiving a business request from the client, the server parses out the business information, session token, and verification information including anti-tampering identifier, target signature, and target verification parameters. Based on the business information and session token submitted by the client, the server independently recalculates a set of expected verification parameters locally, following the same rules as when the client generated them. Then, the locally calculated parameters are compared one by one with the parameters submitted by the client.

[0099] For example, a backend server of a financial application receives a transfer request. The server first parses out business information such as the transfer amount and recipient, as well as the session token, tamper-proof identifier, target signature, and target verification parameters attached to the request. The server performs at least one of the following operations: based on the received business information and session token, it recalculates an expected tamper-proof identifier locally and compares it with the received tamper-proof identifier; based on the locally calculated tamper-proof identifier and the current session context (time window, device fingerprint), it recalculates an expected target signature locally and compares it with the received target signature; based on the locally calculated target signature and session token, it recalculates an expected target verification parameter locally and compares it with the received target verification parameter. In operation S730, if any of the above comparison results are inconsistent, the server immediately determines the request as an illegal request, returns an authentication failure error code to the client, and records the source IP address, user identifier, and request content of the request as a security event for subsequent auditing. Only when all comparisons are consistent will the server continue to execute the transfer business logic.

[0100] According to the embodiments of this application, due to the interconnected nature of the verification chain, any tampering with business messages, illegal reuse of session tokens, or forgery of time and device context will be exposed at some point in the chain verification, leading to verification failure. This "one anomaly, full chain alert" mechanism ensures that a request can only be accepted if the time, device, identity, and business content are completely matched and have not been tampered with. This not only effectively resists various known attacks but also provides a proactive defense against potential unknown attack patterns.

[0101] Figure 8 The flowchart illustrating the verification process according to an embodiment of this application is shown schematically.

[0102] like Figure 8 As shown, based on the aforementioned embodiments, operation S720 may include operations S810 and / or S820~S830.

[0103] When operating S810, verify whether the current time point is within the time window corresponding to the session token.

[0104] When operating the S820, the session token is reconstructed based on the time window and verification information to obtain the reconstruction token.

[0105] When operating the S830, the tamper-proof identifier, target signature, and target verification parameters are verified based on the reconstruction token.

[0106] A reconstructed token can refer to an expected session token that the server independently calculates locally on the server side, based on the initial key it possesses and context information (such as time window, device fingerprint, and user information) obtained from the client's request, following the exact same algorithm process as when the client generates a session token.

[0107] Specifically, upon receiving a request, the server executes operation S810, a preliminary quick verification. The server obtains its current system time and determines whether this time falls within the time window range declared in the client's request. If the time has expired or has not yet arrived, it is directly determined as an invalid request and rejected. This effectively filters out a large number of simple replay attacks. Preferably, operation S810 occurs before operations S820 and S830. If the verification of S810 fails, there is no need to execute operations S820 and S830.

[0108] In operation S820, the server extracts the time window, device fingerprint, and user information from the request, and uses its internally stored initial key to regenerate a reconstruction token locally. Subsequently, in operation S830, the server uses this reconstruction token as the root of trust for all subsequent verification steps, sequentially verifying the legitimacy of the tamper-proof identifier, target signature, and target verification parameters submitted by the client. Preferably, operation S830 is performed before operation S820; if the verification in S820 fails, then operation S830 does not need to be executed.

[0109] For example, after receiving a request, the server first checks whether its current time T_current satisfies Tw_start ≤ T_current ≤ Tw_end, where Tw_start and Tw_end define the time window in the request. If the verification passes, the server executes the reconstruction token K'. t =SM4 加密 (K) m ,SM3(T w )⊕SM3(D f UserID). Then, the server uses this K' t Combine the business information payload in the request to verify the received σ m σ d and T' w Whether a logically self-consistent cryptographic chain can be formed.

[0110] In another embodiment, message tampering can also be verified and resisted. Suppose an attacker intercepts a legitimate request and attempts to tamper with the business information payload (e.g., changing the transfer amount from 100 yuan to 10,000 yuan), while maintaining the original tamper-proof identifier σ. m Target signature σ d The parameters remain unchanged. When the tampered request arrives at the server, the time window verification (S810) and token reconstruction (S820) steps may succeed. However, in operation S830, when the server attempts to verify the tamper-proof identifier σ... m At that time, it will use the reconstruction token K' t The payload containing the tampered business information calculates an expected tamper-proof identifier σ locally. m Since payload' is not equal to the original payload, the calculated σ' m It is necessarily not equal to the original σ attached to the request. m The verification failed at the first step, and subsequent verification processes were not continued, resulting in an immediate halt to the business process.

[0111] According to the embodiments of this application, a highly efficient and robust defense system is constructed by combining a time window pre-verification (S810) with chain verification based on the reconstructed token (S820, S830). The time window verification, as the first line of defense, can quickly reject expired replay requests with extremely low computational cost, protecting the computing resources of the backend server. More importantly, the server does not directly trust any encrypted credentials submitted by the client, but instead rebuilds the entire trust chain locally using the reconstructed token. Because the correctness of all verification parameters must match the same token reconstructed authoritatively by the server, any tampering with a single link in the request will cause it to fail the chain verification based on the reconstructed token, thus ensuring the end-to-end integrity and authenticity of the request.

[0112] Figure 9 The flowchart illustrating the verification method according to an embodiment of this application is shown in the illustration.

[0113] like Figure 9 As shown, based on the aforementioned embodiments, operation S830 may include operations S910 to S920.

[0114] During S910 operation, a reconstruction identifier is generated based on the reconstruction token and hash encryption algorithm. The reconstruction identifier can be a tamper-proof identifier calculated locally by the server based on its authoritative reconstructed token and received business information. This reconstruction identifier will serve as the benchmark for all subsequent chain verifications.

[0115] When operating the S920, the anti-tampering identifier, target signature, and target verification parameters are verified based on the reconstruction identifier.

[0116] Specifically, the locally generated reconstruction identifier is precisely compared with the anti-tampering identifier attached to the client request. If they match, the reconstruction identifier (along with the reconstruction token, time window, device fingerprint, and other context information) is used to recalculate a new expected target signature locally, and this new signature is compared with the target signature attached to the client request. If they still match, the reconstruction identifier (along with the reconstruction token and the verified target signature) is used to recalculate a new expected target verification parameter locally, and this new parameter is compared with the target verification parameter attached to the client request. The verification process is considered complete only when all the comparison results from the above steps are completely consistent. Failure to compare at any step will immediately halt the verification process.

[0117] For example, the server first uses the received business information payload and the reconstruction token K' generated by operating S820. t Calculate the reconstructed identifier σ′ m .

[0118] The formula can be: σ′ m =SM3(K′ t ‖SM3(payload));

[0119] Subsequently, the server verifies whether the reconstruction identifier is equal to the received anti-tampering identifier, i.e., σ′. m Is it equal to σ? m If they are not equal, the verification fails.

[0120] If the previous verification passes, the server uses the reconstruction token K' t The received time window T w and device fingerprint D f and the verified reconstruction identifier σ' m Calculate the expected target signature σ′ d .

[0121] The formula can be: σ′ d =SM4 加密 (K′ t ,SM3(T w ||D f ||σ′ m ));

[0122] Subsequently, the server verifies whether the expected target signature is equal to the received target signature, i.e., σ′. d Is it equal to σ? d If they are not equal, the verification fails.

[0123] If the previous verification passes, the server uses the reconstruction token K' t 、Reconstructing the identifier σ' m and the verified target signature σ d As the key, calculate the expected target verification parameter T'' w .

[0124] The formula can be: T′′ w =SM4 加密 (σ d ,SM3(K′ t ||σ′ m ))(mod2 32 )

[0125] Finally, the server verifies whether the expected target verification parameter is equal to the received target verification parameter, i.e., T′′. w Is it equal to T′? w If they are not equal, the verification fails.

[0126] According to the embodiments of this application, the server does not trust any encrypted derived values ​​submitted by the client. Instead, it starts from the most original business information and gradually reconstructs and compares each verification parameter locally. This ensures that any minor alteration to the original information will be immediately detected at the first stage of the verification chain (reconstruction identifier comparison), creating a "snowball effect" that inevitably causes all subsequent verification steps to fail. This not only provides extremely high security but also provides precise fault location for security auditing, clarifying which stage the attack occurred at, thereby achieving comprehensive, in-depth, and fine-grained integrity verification of the request from content to context.

[0127] Figure 10 A block diagram of a verification information generation apparatus according to an embodiment of this application is shown schematically.

[0128] like Figure 10 As shown, the verification information generation device 1000 may include a first generation module 1010, a second generation module 1020, a third generation module 1030, a fourth generation module 1050, and an integration module 1050.

[0129] The first generation module 1010 is used to generate a session token in response to user login, based on the initial key, time window, and device fingerprint, wherein the time window is determined by the current time. In some embodiments, the first generation module 1010 can be used to perform operation S210 in the above-described verification information generation method, which will not be elaborated here.

[0130] The second generation module 1020 is used to generate an anti-tampering identifier in response to a service request corresponding to the session token, based on the session token and the service. In some embodiments, the second generation module 1020 can be used to perform operation S220 in the above verification information generation method, which will not be elaborated here.

[0131] The third generation module 1030 is used to generate a target signature based on the anti-tampering identifier, time window, and device fingerprint. In some embodiments, the third generation module 1030 can be used to perform operation S230 in the above verification information generation method, which will not be described in detail here.

[0132] The fourth generation module 1040 is used to generate target verification parameters based on the target signature and session token. In some embodiments, the fourth generation module 1040 can be used to perform operation S240 in the verification information generation method described above, which will not be elaborated here.

[0133] The integration module 1050 is used to combine the anti-tampering identifier, target signature, target verification parameters, and business information into verification information. In some embodiments, the preset module 1050 can be used to perform operation S250 in the above verification information generation method, which will not be described in detail here.

[0134] Figure 11 A block diagram of a verification apparatus according to an embodiment of this application is shown schematically.

[0135] like Figure 11 As shown, the verification information generation device 1100 may include an acquisition module 1110, a verification module 1120, and an alarm module 1130.

[0136] The acquisition module 1110 is used to acquire session tokens and verification information. The verification information includes at least one of an anti-tampering identifier, a target signature, and a target verification parameter. The anti-tampering identifier, target signature, and target verification parameter are all generated through a time window, which is determined based on the user's login time. In some embodiments, the acquisition module 1110 can be used to perform operation S710 in the above verification information generation method, which will not be elaborated here.

[0137] The verification module 1120 is used to verify the session token, tamper-proof identifier, target signature, and target verification parameters. In some embodiments, the verification module 1120 can be used to perform operation S720 in the verification information generation method described above, which will not be elaborated here.

[0138] The alarm module 1130 is used to stop the business process and issue an alarm message in response to any failure of verification of the anti-tampering identifier, target signature, and target verification parameters. In some embodiments, the alarm module 1130 can be used to perform operation S730 in the above verification information generation method, which will not be described in detail here.

[0139] Any one or more of the modules, submodules, units, and subunits according to the embodiments of this application, or at least part of the functions of any one or more of them, can be implemented in one module. Any one or more of the modules, submodules, units, and subunits according to the embodiments of this application can be implemented by dividing them into multiple modules. Any one or more of the modules, submodules, units, and subunits according to the embodiments of this application can be at least partially implemented as hardware circuits, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or implemented by hardware or firmware in any other reasonable manner by integrating or packaging circuits, or implemented in any one of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, one or more of the modules, submodules, units, and subunits according to the embodiments of this application can be at least partially implemented as computer program modules, which, when run, can perform corresponding functions.

[0140] For example, any and more of the first generation module 1010, the second generation module 1020, the third generation module 1030, the fourth generation module 1050, and the integration module 1050 can be combined into one module / unit / subunit, or any one of these modules / units / subunits can be split into multiple modules / units / subunits. Alternatively, at least some of the functions of one or more of these modules / units / subunits can be combined with at least some of the functions of other modules / units / subunits and implemented in one module / unit / subunit. According to embodiments of this application, at least one of the first generation module 1010, the second generation module 1020, the third generation module 1030, the fourth generation module 1050, and the integration module 1050 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable method of integrating or packaging the circuit, or implemented in hardware or firmware, or in any one of software, hardware, and firmware implementations, or in a suitable combination of any of these. Alternatively, at least one of the first generation module 1010, the second generation module 1020, the third generation module 1030, the fourth generation module 1050, and the integration module 1050 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0141] It should be noted that the data processing system part in the embodiments of this application corresponds to the data processing method part in the embodiments of this application. The specific description of the data processing system part is referred to in the data processing method part, and will not be repeated here.

[0142] Figure 12 A block diagram of an electronic device suitable for implementing the methods described above, according to an embodiment of this application, is illustrated schematically. Figure 12 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0143] like Figure 12As shown, an electronic device 1200 according to an embodiment of this application includes a processor 1201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1202 or a program loaded from a storage portion 1208 into a random access memory (RAM) 1203. The processor 1201 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1201 may also include onboard memory for caching purposes. The processor 1201 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0144] RAM 1203 stores various programs and data required for the operation of electronic device 1200. Processor 1201, ROM 1202, and RAM 1203 are interconnected via bus 1204. Processor 1201 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 1202 and / or RAM 1203. It should be noted that the programs may also be stored in one or more memories other than ROM 1202 and RAM 1203. Processor 1201 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0145] According to embodiments of this application, the electronic device 1200 may further include an input / output (I / O) interface 1205, which is also connected to a bus 1204. The electronic device 1200 may also include one or more of the following components connected to the input / output (I / O) interface 1205: an input section 1206 including a keyboard, mouse, etc.; an output section 1207 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1208 including a hard disk, etc.; and a communication section 1209 including a network interface card such as a LAN card, modem, etc. The communication section 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the input / output (I / O) interface 1205 as needed. A removable medium 1211, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1210 as needed so that computer programs read from it can be installed into the storage section 1208 as needed.

[0146] According to embodiments of this application, the method flow according to embodiments of this application can be implemented as a computer software program. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1209, and / or installed from removable medium 1211. When the computer program is executed by processor 1201, it performs the functions defined in the system of embodiments of this application. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0147] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0148] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium. Examples include, but are not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0149] For example, according to embodiments of this application, a computer-readable storage medium may include the ROM 1202 and / or RAM 1203 described above and / or one or more memories other than ROM 1202 and RAM 1203.

[0150] Embodiments of this application also include a computer program product, which includes a computer program containing program code for performing the methods provided in the embodiments of this application. When the computer program product is run on an electronic device, the program code is used to enable the electronic device to implement the verification information generation method and / or verification method provided in the embodiments of this application.

[0151] When the computer program is executed by the processor 1201, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc. described above can be implemented by computer program modules.

[0152] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices or magnetic storage devices. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via communication section 1209, and / or installed from removable medium 1211. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof. According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code may be executed entirely on a user computing device, partially on a user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing devices can be connected to user computing devices via any type of network, including local area networks (LANs) or wide area networks (WANs), or they can be connected to external computing devices (e.g., via the Internet using an Internet service provider).

[0153] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions. Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations are not explicitly described in this application. In particular, without departing from the spirit and teachings of this application, the features described in the various embodiments of this application can be combined and / or combined in various ways. All such combinations and / or combinations fall within the scope of this application.

[0154] The embodiments of this application have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of this application. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of this application, those skilled in the art can make various substitutions and modifications, all of which should fall within the scope of this application.

Claims

1. A method for generating verification information, characterized in that, include: In response to user login, a session token is generated based on the initial key, time window, and device fingerprint, wherein the time window is determined by the current time. In response to a business request corresponding to a session token, an anti-tampering identifier is generated based on the session token and the business request. A target signature is generated based on the anti-tampering identifier, the time window, and the device fingerprint; Generate target verification parameters based on the target signature and session token; The set of the anti-tampering identifier, the target signature, the target verification parameters, and the business information is used as the verification information.

2. The method according to claim 1, characterized in that, The step of generating a session token based on the initial key, time window, and device fingerprint includes: Based on a hash encryption algorithm, the time window is processed to obtain the first information; The device fingerprint is processed based on a hash encryption algorithm to obtain second information; Based on a symmetric key encryption algorithm, a session token is generated from the first information, the second information, the initial key, and the user's user information.

3. The method according to claim 1, characterized in that, In response to a service request corresponding to the session token, an anti-tampering identifier is generated based on the session token and the service information, including: Based on the hash encryption algorithm, business information is processed to obtain third-party information; Based on a hash encryption algorithm, the target business information and the session token are processed to obtain an anti-tampering identifier.

4. The method according to claim 1, characterized in that, The step of generating a target signature based on the anti-tampering identifier, the time window, and the device fingerprint includes: Based on a hash encryption algorithm, the time window, device fingerprint, and anti-tampering identifier are processed to obtain the fourth information; The target signature is obtained by processing the session token and the fourth information based on a symmetric key encryption algorithm.

5. The method according to claim 1, characterized in that, The step of generating target verification parameters based on the target signature and session token includes: Based on a hash encryption algorithm, the session token and the tamper-proof identifier are processed to obtain the fifth piece of information; Based on a symmetric key encryption algorithm, the fifth piece of information and the target signature are processed to obtain the target verification parameters.

6. A verification method, characterized in that, include: Obtain session token and verification information, wherein the verification information includes at least one of anti-tampering identifier, target signature, and target verification parameter, wherein the anti-tampering identifier, target signature, and target verification parameter are all generated through a time window, and the time window is determined based on the user login time. The session token, the tamper-proof identifier, the target signature, and the target verification parameters are verified. If any one of the anti-tampering identifier, the target signature, and the target verification parameter fails verification, the business process is stopped and an alarm message is issued. The tamper-proof identifier is generated in response to a service request corresponding to the session token, based on the session token and the service request. The target signature is generated based on the anti-tampering identifier, the time window, and the device fingerprint. The target verification parameters are generated based on the target signature and the session token.

7. The method according to claim 6, characterized in that, The verification of the session token, the tamper-proof identifier, the target signature, and the target verification parameters includes: Verify whether the current time point is within the time window corresponding to the session token; And / or, Based on the time window and the verification information, the session token is reconstructed to obtain a reconstructed token; Based on the reconstructed token, verify the tamper-proof identifier, the target signature, and the target verification parameters.

8. The method according to claim 7, characterized in that, The step of verifying the tamper-proof identifier, the target signature, and the target verification parameters based on the reconstructed token includes: Based on the reconstruction token and hash encryption algorithm, a reconstruction identifier is generated; The anti-tampering identifier, the target signature, and the target verification parameters are verified based on the reconstructed identifier.

9. A verification information generation device, characterized in that, include: The first generation module is used to generate a session token in response to user login, based on the initial key, time window, and device fingerprint, wherein the time window is determined by the current time point; The second generation module is used to generate an anti-tampering identifier based on the session token and the service request in response to the occurrence of the service request corresponding to the session token. The third generation module is used to generate a target signature based on the anti-tampering identifier, the time window, and the device fingerprint. The fourth generation module is used to generate target verification parameters based on the target signature and session token; The integration module is used to use the set of the anti-tampering identifier, the target signature, the target verification parameters, and the business information as verification information.

10. A verification device, characterized in that, include: The acquisition module is used to acquire session tokens and verification information. The verification information includes at least one of anti-tampering identifier, target signature, and target verification parameters. The anti-tampering identifier, target signature, and target verification parameters are all generated through a time window, which is determined based on the user's login time. The verification module is used to verify the session token, the anti-tampering identifier, the target signature, and the target verification parameters; The alarm module is used to stop the business process and issue an alarm message in response to any failure of verification of the anti-tampering identifier, the target signature, and the target verification parameters. The tamper-proof identifier is generated in response to a service request corresponding to the session token, based on the session token and the service request. The target signature is generated based on the anti-tampering identifier, the time window, and the device fingerprint. The target verification parameters are generated based on the target signature and the session token.

11. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

12. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

13. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

Images