Authorization authentication method and device, equipment and storage medium

Abstract

The invention discloses an authorization authentication method, device and equipment and a storage medium, a distributed authorization mode is adopted, a Redis cache is taken as a core support, an authority strategy and bill metadata are uniformly stored in a Redis cluster, each node can directly read the Redis cache to independently complete authority verification and authorization decision, and dependence on concentrated nodes is not needed. And meanwhile, real-time synchronization and consistent updating of the authority data in the nodes of the whole network are ensured by relying on a master-slave synchronization and persistence mechanism of Redis. Even if part of the nodes fail or are attacked, other nodes can still obtain complete permission information through the Redis cache to operate normally, and the risk of system paralysis or permission out-of-control caused by a single-point problem is effectively reduced.

Description

Technical Field

[0001] This invention relates to data security technology, and more particularly to an authorization and authentication method, apparatus, device, and storage medium. Background Technology

[0002] As enterprises deepen their digital transformation, distributed system architecture has become mainstream. In this architecture, users often need to access sub-services of multiple independent subsystems, and the traditional "separate login for each system" approach clearly cannot meet user experience requirements. Single Sign-On (SSO) technology has emerged to address this need, allowing users to seamlessly access all authorized sub-services of all subsystems after logging in once.

[0003] However, most existing distributed authorization schemes rely on centralized authorization and authentication by authorization servers. If the authorization server fails or is attacked, there will be risks of being unable to authorize or losing control of permissions. Summary of the Invention

[0004] This invention provides an authorization and authentication method, apparatus, device, and storage medium to provide stability and security for the authorization and authentication system.

[0005] In a first aspect, the present invention provides an authorization and authentication method applied to a distributed system, comprising:

[0006] When a user successfully logs in for the first time, a JWT identity ticket for that user is generated.

[0007] Write the JWT identity ticket into the Redis cluster of the distributed system;

[0008] When a sub-service of the distributed system receives a service request from the user, the sub-service verifies the user's JWT identity ticket in the Redis cluster.

[0009] When the user's JWT identity ticket is valid, the user's access permissions are verified;

[0010] When the user has access rights, the service content corresponding to the service request is returned to the user.

[0011] Optionally, the JWT identity ticket includes a header, payload, and signature. When a user successfully logs in for the first time, a JWT identity ticket is generated for the user, including:

[0012] When a user successfully logs in for the first time, the user's identity identifier is obtained from the login request;

[0013] Determine the user's access permissions and map the access permissions to permission codes;

[0014] Determine the expiration timestamp of the access permission;

[0015] The user identity identifier, the permission code, and the expiration timestamp are encoded and calculated respectively to obtain the encoding of the user identity identifier, the encoding of the permission code, and the encoding of the expiration timestamp;

[0016] The document type and signature algorithm in the header are encoded and calculated respectively to obtain the encoding of the document type and the encoding of the signature algorithm;

[0017] The encoding of the user identity identifier, the encoding of the authorization code, and the encoding of the expiration timestamp are concatenated to form the payload of the JWT identity ticket;

[0018] By concatenating the code of the ticket type, the code of the signature algorithm, the code of the user identity identifier, the code of the authorization code, and the code of the expiration timestamp, a concatenated code is obtained;

[0019] The signature algorithm in the header is used to calculate the concatenated code to generate the first digest information of the concatenated code;

[0020] The first digest information is encrypted using the private key of the distributed system to generate a signature for the JWT identity ticket.

[0021] Optionally, after generating the user's JWT identity ticket, the method further includes:

[0022] The unique identifier for generating the JWT identity ticket;

[0023] The unique identifier of the JWT identity ticket is returned to the user.

[0024] Optionally, when a sub-service of the distributed system receives a service request from the user, the sub-service verifies the user's JWT identity ticket in the Redis cluster, including:

[0025] The unique identifier of the JWT identity ticket is parsed from the service request;

[0026] Using the unique identifier as an index, retrieve the JWT identity ticket from the Redis cluster;

[0027] The JWT identity ticket is verified.

[0028] Optionally, the JWT identity ticket is verified, including:

[0029] The signature algorithm in the header is used to calculate the concatenated code to generate the second digest information of the concatenated code;

[0030] The signature of the JWT identity ticket is decrypted using the public key of the sub-service to obtain the first digest information;

[0031] By comparing the first digest information and the second digest information, if the first digest information and the second digest information are the same, the user's JWT identity ticket is determined to be valid.

[0032] Optionally, the user's access permissions are verified, including:

[0033] Obtain the payload of the JWT identity ticket;

[0034] The payload of the JWT identity ticket is decoded to obtain the user identity identifier, the authorization code, and the expiration timestamp;

[0035] Verify the user's identity based on the user's identity identifier;

[0036] Verify the user's access rights to the sub-service based on the permission code;

[0037] The validity period of the user's access to the sub-service is verified based on the expiration timestamp.

[0038] Optionally, the authorization and authentication methods also include:

[0039] In response to the user's logout request, the JWT identity ticket is added to the cache blacklist of the Redis cluster.

[0040] Secondly, the present invention also provides an authorization and authentication device for use in a distributed system, comprising:

[0041] The ticket generation module is used to generate a JWT identity ticket for the user when the user successfully logs in for the first time.

[0042] The ticket writing module is used to write the JWT identity ticket into the Redis cluster of the distributed system;

[0043] The ticket verification module is used to verify the user's JWT identity ticket in the Redis cluster when the sub-service of the distributed system receives the user's service request;

[0044] The access control module is used to verify the user's access rights when the user's JWT identity ticket is valid;

[0045] The content return module is used to return the service content corresponding to the service request to the user when the user has access permissions.

[0046] Thirdly, the present invention also provides an electronic device, comprising:

[0047] One or more processors;

[0048] Storage device for storing one or more programs;

[0049] When the one or more programs are executed by the one or more processors, the one or more processors implement the authorization and authentication method provided in the first aspect of the present invention.

[0050] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the authorization and authentication method provided in the first aspect of the present invention.

[0051] The authorization and authentication method provided by this invention is applied to a distributed system. Upon successful initial login, a JWT identity ticket is generated and written to a Redis cluster within the distributed system. When a sub-service of the distributed system receives a service request from a user, it verifies the user's JWT identity ticket in the Redis cluster. If the user's JWT identity ticket is valid, the sub-service verifies the user's access permissions. If the user has the necessary permissions, the sub-service returns the service content corresponding to the service request. By employing a distributed authorization approach with Redis caching as the core support, permission policies and ticket metadata are uniformly stored in the Redis cluster. Each node can directly read the Redis cache to independently complete permission verification and authorization decisions without relying on a centralized node. Simultaneously, relying on Redis's master-slave synchronization and persistence mechanism ensures real-time synchronization and consistent updates of permission data across all nodes in the network. Even if some nodes fail or are attacked, other nodes can still obtain complete permission information from the Redis cache and operate normally, effectively reducing the risk of system paralysis or loss of permission control due to single points of failure.

[0052] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 A flowchart of an authorization and authentication method provided by the present invention;

[0055] Figure 2 A schematic diagram of the structure of an authorization and authentication device provided by the present invention;

[0056] Figure 3 This is a schematic diagram of the structure of an electronic device provided by the present invention.

[0057] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0058] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0059] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0060] Figure 1 This is a flowchart of an authorization and authentication method provided by the present invention. This embodiment is applicable to implementing distributed authorization and authentication in a distributed system. The method can be executed by the authorization and authentication device provided by the present invention. This device can be implemented in software and / or hardware, and is typically configured in an electronic device, such as... Figure 1 As shown, the authorization and authentication method includes the following steps:

[0061] S101. When a user successfully logs in for the first time, a JWT identity ticket for the user is generated.

[0062] A distributed system is a system composed of multiple computer nodes that are typically not isolated but interconnected and work collaboratively through a network. To the user, a distributed system appears as a single, unified service provider, but in reality, these services are provided by a system comprised of multiple servers working together. Distributed systems are characterized by high cohesion and transparency, enabling parallel task processing across multiple computing nodes, thereby improving computational efficiency and the system's reliability, availability, and scalability.

[0063] In this embodiment of the invention, a user's initial login can be performed on a sub-service of any subsystem within the distributed system. Upon the user's first login, the sub-service verifies the username and password entered by the user. If the verification is successful, it generates a JWT (JSON Web Token) identity ticket for the user. JWT is a lightweight authentication mechanism used to securely transmit information between multiple systems. After a user successfully logs in to a sub-service for the first time, the sub-service generates the user's JWT identity ticket, which is used to authenticate the user when sending subsequent requests.

[0064] For example, a JWT identity ticket includes a header, a payload, and a signature. The header specifies the signing algorithm and ticket type (i.e., JWT) required for subsequent signing, while the payload and signature are initially empty. The process of generating a JWT identity ticket is as follows:

[0065] 1. When a user successfully logs in for the first time, obtain the user's identity identifier from the login request.

[0066] When a user logs in for the first time, the sub-service verifies the username and password entered by the user. If the verification is successful, it retrieves the user's identity identifier from the login request. It should be noted that this user identity identifier is not the username, but a unique identifier generated when the user registers in the distributed system.

[0067] 2. Determine the user's access permissions and map the access permissions to permission codes.

[0068] For example, when a user registers in a distributed system, the system sets access permissions and expiration timestamps for those permissions. Access permissions represent the sub-services the user can access, as well as the content within those sub-services, while the expiration timestamp indicates the expiration time of those permissions. Upon successful initial login, after obtaining the user's identity identifier from the login request, the system determines the user's access permissions based on that identifier and maps them to permission codes. For example, different access permissions correspond to different permission codes.

[0069] 3. Determine the expiration timestamp of access permissions.

[0070] When a user successfully logs in for the first time, the system obtains the user's identity identifier from the login request and then determines the expiration timestamp of the user's access permissions based on the user's identity identifier.

[0071] 4. Calculate the encoding of the user identity identifier, permission code, and expiration timestamp respectively to obtain the encoding of the user identity identifier, the encoding of the permission code, and the encoding of the expiration timestamp.

[0072] For example, in this embodiment of the invention, Base64Url is used to encode the user identity identifier, permission code, and expiration timestamp respectively to obtain the encoding of the user identity identifier, the encoding of the permission code, and the encoding of the expiration timestamp.

[0073] 5. Calculate the encoding of the ticket type and signature algorithm in the header respectively to obtain the encoding of the ticket type and the encoding of the signature algorithm.

[0074] For example, in this embodiment of the invention, Base64Url is used to encode the ticket type and signature algorithm in the header to obtain the encoding of the ticket type and the encoding of the signature algorithm.

[0075] 6. Concatenate the user identity identifier, the authorization code, and the expiration timestamp as the payload of the JWT identity ticket.

[0076] In this embodiment of the invention, the encoding of the user identity identifier, the encoding of the authorization code, and the encoding of the expiration timestamp are concatenated as the payload of the JWT identity ticket.

[0077] 7. Combine the codes for the ticket type, signature algorithm, user identity, authorization code, and expiration timestamp to obtain the combined code.

[0078] In this embodiment of the invention, the concatenated code is obtained by concatenating the code of the ticket type, the code of the signature algorithm, the code of the user identity identifier, the code of the authorization code, and the code of the expiration timestamp.

[0079] 8. The signature algorithm in the header is used to calculate the concatenated code and generate the first digest information of the concatenated code.

[0080] In this embodiment of the invention, a signature algorithm (e.g., HMAC SHA256) in the header is used to calculate the concatenated code to generate a digest of the concatenated code, which is called the first digest.

[0081] 9. Use the private key of the distributed system to encrypt the first digest information and generate a signature for the JWT identity ticket.

[0082] In this embodiment of the invention, the first digest information is encrypted using the private key of a distributed system to generate a signature for the JWT identity ticket. The private key is typically generated and stored by the authentication server of the distributed system, and the corresponding public key is issued to each sub-service.

[0083] S102. Write the JWT identity ticket to the Redis cluster of the distributed system.

[0084] In this embodiment of the invention, the JWT identity ticket is written to a Redis cluster in a distributed system. Redis, short for Remote Dictionary Server, is an open-source, ANSI C-language, network-enabled, in-memory or persistent log-structured key-value database that provides APIs for multiple languages. Unlike MySQL, Redis data resides in memory. Its read / write speed is extremely fast, handling over 100,000 read / write operations per second. Therefore, Redis is widely used for caching and is also frequently used for distributed locks. Using Redis as the carrier of the JWT identity ticket leverages its high-performance read / write capabilities to achieve multi-node data sharing, ensuring the independence and stability of ticket processing. Furthermore, if a Redis node fails or the network is interrupted, the system triggers the Redis cluster's failover mechanism, switching to other available nodes for querying. If all Redis nodes are unavailable, the database query process proceeds directly, ensuring continuous data access.

[0085] After generating the user's JWT identity ticket, a unique identifier for the JWT identity ticket is generated and returned to the user. Whenever the user needs to send a service request, this unique identifier from the JWT identity ticket will be included in the service request.

[0086] S103. When a sub-service in the distributed system receives a service request from a user, the sub-service verifies the user's JWT identity ticket in the Redis cluster.

[0087] After a user logs in, when a sub-service in the distributed system receives a service request from the user, the sub-service verifies the user's JWT identity ticket in the Redis cluster to verify the user's legitimacy. It should be noted that this sub-service can be the same one used during the user's initial login, or it can be another sub-service in the distributed system; this invention does not limit the scope of the invention.

[0088] For example, when a sub-service of the distributed system receives a user's service request, it parses the unique identifier of the JWT identity ticket from the service request, uses the unique identifier of the JWT identity ticket as an index to look up the JWT identity ticket in the Redis cluster, and then verifies the JWT identity ticket.

[0089] For example, the verification process for a JWT identity ticket is as follows:

[0090] 1. The signature algorithm in the header is used to calculate the concatenated code, generating the second digest information of the concatenated code.

[0091] In this embodiment of the invention, the information in the header and payload of the received JWT identity ticket is first extracted. The ticket type and signature algorithm in the header are encoded and calculated to obtain the code of the ticket type and the code of the signature algorithm. These are then concatenated with the code in the payload to obtain the concatenated code. The signature algorithm recorded in the header of the JWT identity ticket is then used to calculate the concatenated code to generate the second digest information of the concatenated code.

[0092] 2. Use the public key of the sub-service to decrypt the signature of the JWT identity ticket to obtain the first digest information.

[0093] The signature of the JWT identity ticket is decrypted using the public key held by the sub-service to obtain the first digest information.

[0094] 3. Compare the first digest information with the second digest information. If the first digest information and the second digest information are the same, the user's JWT identity ticket is deemed valid.

[0095] The first digest information and the second digest information are compared. If the first digest information and the second digest information are the same, the user's JWT identity ticket is deemed valid.

[0096] S104. When the user's JWT identity ticket is valid, verify the user's access permissions.

[0097] If the user's JWT identity ticket is valid, further verification of the user's access permissions is performed.

[0098] For example, the payload of the JWT identity ticket is obtained, the payload of the JWT identity ticket is decoded to obtain the user identity identifier, permission code and expiration timestamp, the user's identity is verified based on the user identity identifier, the user's access rights to the sub-service are verified based on the permission code, and the validity period of the user's access to the sub-service is verified based on the expiration timestamp. When all three are verified, it is determined that the user has access rights.

[0099] S105. When the user has access rights, return the service content corresponding to the service request to the user.

[0100] When the user has access permissions, return the service content corresponding to the service request to the user.

[0101] In some embodiments of the present invention, when a user logs out of any sub-service, in response to the user's logout request, the JWT identity ticket is added to the cache blacklist of the Redis cluster to achieve real-time synchronization of ticket status across multiple nodes.

[0102] The authorization and authentication method provided by this invention is applied to a distributed system. Upon successful initial login, a JWT identity ticket is generated and written to a Redis cluster within the distributed system. When a sub-service of the distributed system receives a service request from a user, it verifies the user's JWT identity ticket in the Redis cluster. If the user's JWT identity ticket is valid, the sub-service verifies the user's access permissions. If the user has the necessary permissions, the sub-service returns the service content corresponding to the service request. By employing a distributed authorization approach with Redis caching as the core support, permission policies and ticket metadata are uniformly stored in the Redis cluster. Each node can directly read the Redis cache to independently complete permission verification and authorization decisions without relying on a centralized node. Simultaneously, relying on Redis's master-slave synchronization and persistence mechanism ensures real-time synchronization and consistent updates of permission data across all nodes in the network. Even if some nodes fail or are attacked, other nodes can still obtain complete permission information from the Redis cache and operate normally, effectively reducing the risk of system paralysis or loss of permission control due to single points of failure.

[0103] Figure 2 A schematic diagram of the structure of an authorization and authentication device provided by the present invention is shown below. Figure 2 As shown, the authorization and authentication device includes:

[0104] The ticket generation module 201 is used to generate a JWT identity ticket for the user when the user successfully logs in for the first time.

[0105] The ticket writing module 202 is used to write the JWT identity ticket into the Redis cluster of the distributed system;

[0106] Ticket verification module 203 is used to verify the user's JWT identity ticket in the Redis cluster when the sub-service of the distributed system receives the user's service request;

[0107] The permission verification module 204 is used to verify the user's access permissions when the user's JWT identity ticket is valid;

[0108] The content return module 205 is used to return the service content corresponding to the service request to the user when the user has access permissions.

[0109] In some embodiments of the present invention, the JWT identity ticket includes a header, a payload, and a signature, and the ticket generation module 201 includes:

[0110] The identity identifier acquisition submodule is used to obtain the user identity identifier in the login request when the user successfully logs in for the first time;

[0111] The permission code determination submodule is used to determine the user's access permissions and map the access permissions to permission codes;

[0112] The expiration timestamp determination submodule is used to determine the expiration timestamp of the access permission.

[0113] The first encoding submodule is used to perform encoding calculations on the user identity identifier, the permission code, and the expiration timestamp respectively to obtain the encoding of the user identity identifier, the encoding of the permission code, and the encoding of the expiration timestamp;

[0114] The second encoding submodule is used to perform encoding calculations on the ticket type and signature algorithm in the header respectively, to obtain the encoding of the ticket type and the encoding of the signature algorithm;

[0115] The first splicing submodule is used to splice the encoding of the user identity identifier, the encoding of the permission code, and the encoding of the expiration timestamp as the payload of the JWT identity ticket;

[0116] The second splicing submodule is used to splice the code of the ticket type, the code of the signature algorithm, the code of the user identity identifier, the code of the authorization code and the code of the expiration timestamp to obtain the spliced ​​code;

[0117] The first digest generation submodule is used to calculate the concatenated code using the signature algorithm in the header, and generate the first digest information of the concatenated code;

[0118] The signature submodule is used to encrypt the first digest information using the private key of the distributed system to generate a signature for the JWT identity ticket.

[0119] In some embodiments of the present invention, the authorization and authentication device further includes:

[0120] The ticket identifier generation module is used to generate a unique identifier for the JWT identity ticket after the user's JWT identity ticket is generated;

[0121] The ticket identifier return module is used to return the unique identifier of the JWT identity ticket to the user.

[0122] In some embodiments of the present invention, the invoice verification module 203 includes:

[0123] The identifier parsing submodule is used to parse the unique identifier of the JWT identity ticket from the service request;

[0124] The ticket lookup submodule is used to look up the JWT identity ticket from the Redis cluster using the unique identifier as an index;

[0125] The ticket verification submodule is used to verify the JWT identity ticket.

[0126] In some embodiments of the present invention, the ticket verification submodule includes:

[0127] The second digest generation unit is used to calculate the concatenated code using the signature algorithm in the header, and generate the second digest information of the concatenated code;

[0128] The signature decryption unit is used to decrypt the signature of the JWT identity ticket using the public key of the sub-service to obtain the first digest information;

[0129] The digest comparison unit is used to compare the first digest information and the second digest information. When the first digest information and the second digest information are the same, the user's JWT identity ticket is determined to be valid.

[0130] In some embodiments of the present invention, the permission verification module 204 includes:

[0131] The load acquisition submodule is used to acquire the load of the JWT identity ticket;

[0132] The payload decoding submodule is used to decode the payload of the JWT identity ticket to obtain the user identity identifier, the permission code, and the expiration timestamp;

[0133] An identity verification submodule is used to verify the user's identity based on the user's identity identifier;

[0134] The access permission verification submodule is used to verify the user's access permissions to the sub-service based on the permission code.

[0135] The validity period verification submodule is used to verify the validity period of the user's access to the sub-service based on the expiration timestamp.

[0136] In some embodiments of the present invention, the authorization and authentication device further includes:

[0137] The blacklist setting module is used to add the JWT identity ticket to the cache blacklist of the Redis cluster in response to the user's logout request.

[0138] The aforementioned authorization and authentication device can execute the authorization and authentication method provided in the foregoing embodiments of the present invention, and has the corresponding functional modules and beneficial effects for executing the authorization and authentication method.

[0139] Figure 3 This is a schematic diagram of an electronic device provided by the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0140] like Figure 3 As shown, the electronic device includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer programs stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0141] Multiple components in the electronic device are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, optical disk, etc.; and a communication unit 19, such as a network card, modem, wireless transceiver, etc. The communication unit 19 allows the electronic device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0142] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as authorization and authentication methods.

[0143] In some embodiments, the authorization and authentication method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the authorization and authentication method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the authorization and authentication method by any other suitable means (e.g., by means of firmware).

[0144] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0145] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0146] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0147] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0148] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0149] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0150] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the authorization and authentication method provided in any embodiment of this application.

[0151] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0152] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0153] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An authorization and authentication method, characterized in that, Applied to distributed systems, including: When a user successfully logs in for the first time, a JWT identity ticket for that user is generated. Write the JWT identity ticket into the Redis cluster of the distributed system; When a sub-service of the distributed system receives a service request from the user, the sub-service verifies the user's JWT identity ticket in the Redis cluster. When the user's JWT identity ticket is valid, the user's access permissions are verified; When the user has access rights, the service content corresponding to the service request is returned to the user.

2. The authorization and authentication method according to claim 1, characterized in that, The JWT identity ticket includes a header, payload, and signature. It is generated when a user successfully logs in for the first time, and includes: When a user successfully logs in for the first time, the user's identity identifier is obtained from the login request; Determine the user's access permissions and map the access permissions to permission codes; Determine the expiration timestamp of the access permission; The user identity identifier, the permission code, and the expiration timestamp are encoded and calculated respectively to obtain the encoding of the user identity identifier, the encoding of the permission code, and the encoding of the expiration timestamp; The document type and signature algorithm in the header are encoded and calculated respectively to obtain the encoding of the document type and the encoding of the signature algorithm; The encoding of the user identity identifier, the encoding of the authorization code, and the encoding of the expiration timestamp are concatenated to form the payload of the JWT identity ticket; By concatenating the code of the ticket type, the code of the signature algorithm, the code of the user identity identifier, the code of the authorization code, and the code of the expiration timestamp, a concatenated code is obtained; The signature algorithm in the header is used to calculate the concatenated code to generate the first digest information of the concatenated code; The first digest information is encrypted using the private key of the distributed system to generate a signature for the JWT identity ticket.

3. The authorization and authentication method according to claim 2, characterized in that, After generating the user's JWT identity ticket, the process also includes: The unique identifier for generating the JWT identity ticket; The unique identifier of the JWT identity ticket is returned to the user.

4. The authorization and authentication method according to claim 3, characterized in that, When a sub-service of the distributed system receives a service request from the user, the sub-service verifies the user's JWT identity ticket in the Redis cluster, including: The unique identifier of the JWT identity ticket is parsed from the service request; Using the unique identifier as an index, retrieve the JWT identity ticket from the Redis cluster; The JWT identity ticket is verified.

5. The authorization and authentication method according to claim 4, characterized in that, Verification of the JWT identity ticket includes: The signature algorithm in the header is used to calculate the concatenated code to generate the second digest information of the concatenated code; The signature of the JWT identity ticket is decrypted using the public key of the sub-service to obtain the first digest information; By comparing the first digest information and the second digest information, if the first digest information and the second digest information are the same, the user's JWT identity ticket is determined to be valid.

6. The authorization and authentication method according to claim 2, characterized in that, Verifying the user's access permissions includes: Obtain the payload of the JWT identity ticket; The payload of the JWT identity ticket is decoded to obtain the user identity identifier, the authorization code, and the expiration timestamp; Verify the user's identity based on the user's identity identifier; Verify the user's access rights to the sub-service based on the permission code; The validity period of the user's access to the sub-service is verified based on the expiration timestamp.

7. The authorization and authentication method according to claim 1, characterized in that, Also includes: In response to the user's logout request, the JWT identity ticket is added to the cache blacklist of the Redis cluster.

8. An authorization and authentication device, characterized in that, Applied to distributed systems, including: The ticket generation module is used to generate a JWT identity ticket for the user when the user successfully logs in for the first time. The ticket writing module is used to write the JWT identity ticket into the Redis cluster of the distributed system; The ticket verification module is used to verify the user's JWT identity ticket in the Redis cluster when the sub-service of the distributed system receives the user's service request; The access control module is used to verify the user's access rights when the user's JWT identity ticket is valid; The content return module is used to return the service content corresponding to the service request to the user when the user has access permissions.

9. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the authorization and authentication method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the authorization and authentication method as described in any one of claims 1-7.

Images