Interface security authentication method and device, computer equipment, readable storage medium and program product
By using a multi-factor authentication mechanism that generates dynamic tokens and interface signature information, the problem of insufficient authentication factors in interface security authentication is solved, achieving effective defense against DDoS attacks and improving interface security.
Patent Information
- Application Number
- CN202511729281.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-24
- Publication Date
- 2026-02-10
AI Technical Summary
Existing interface security authentication methods suffer from insufficient authentication factors and simplistic verification mechanisms when dealing with DDoS attacks, resulting in low interface authentication security and difficulty in distinguishing between legitimate requests and malicious attack requests.
By obtaining the identity information and timestamp of the user to be authenticated, a dynamic token is generated. Combined with the resource location information, an interface signature information is generated using a hash message authentication code algorithm. A data packet is generated for interface security authentication. Multi-factor authentication is performed by combining the identity information, timestamp, dynamic token, and interface signature information.
It effectively prevents authentication information from being cracked and forged, accurately identifies and filters malicious attack traffic, improves interface authentication security, reduces security risks during data interaction, and ensures the normal operation of the interface.
Smart Images
Figure CN121508997A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of information security, in particular to an interface security authentication method and device, computer equipment, computer readable storage medium and computer program product. BACKGROUND
[0002] With the rapid development of information technology, interfaces play a key role in data interaction between different systems and applications. However, interfaces face many security threats, such as direct access without security authentication, which has a negative impact on the security and confidentiality of interaction data.
[0003] Current interface security authentication methods have many shortcomings in dealing with DDoS attacks. For example, traditional authentication methods based on username and password are vulnerable to brute force attacks, and attackers can obtain interface access rights by constantly trying different username and password combinations; some authentication methods based on simple tokens have relatively simple token generation and verification mechanisms, which are easy to be forged or stolen by attackers; in addition, some interface security authentication methods lack effective verification of request sources, making it difficult to distinguish between legitimate requests and malicious attack requests, thus failing to effectively resist DDoS attacks, resulting in low interface authentication security. SUMMARY
[0004] Therefore, it is necessary to provide an interface security authentication method, device, computer equipment, computer readable storage medium and computer program product to solve the above technical problems.
[0005] In a first aspect, the present application provides an interface security authentication method, comprising:
[0006] In response to a user access request instruction, obtaining the identity information of a user to be authenticated and the timestamp of receiving the user access request instruction; the identity information is provided by a response end offline to a request end;
[0007] According to the identity information, the timestamp and the encryption key, a dynamic token is generated, and according to the resource location information contained in the user access request instruction, an interface signature information is generated by encryption based on a hash-based message authentication code algorithm;
[0008] Based on the identity information, the timestamp, the dynamic token and the interface signature information, a corresponding data packet is generated, and the data packet is sent to the response end for interface security authentication;
[0009] In the case that the user to be authenticated passes the interface security authentication, receiving the target resource information returned by the response end.
[0010] In one of the embodiments, the interface signature information is generated by encrypting the resource location information contained in the user access request instruction through a hash-based message authentication code algorithm, including:
[0011] The request parameter part is intercepted from the resource location information and formatted into an initial string, and the initial string is encrypted through the hash-based message authentication code algorithm to convert the initial string into a target string; and the interface signature information is generated according to a key-value pair containing the target string.
[0012] In a second aspect, the application provides an interface security authentication method, including:
[0013] In response to an interface request initiated by a request end, a data packet sent by the request end is received; the data packet is generated by the request end according to identity information, a timestamp, a dynamic token and interface signature information; the dynamic token is generated by the request end according to the identity information, the timestamp and an encryption key; the interface signature information is generated by the request end by encrypting resource location information contained in a user access request instruction through a hash-based message authentication code algorithm; interface security authentication is performed according to the identity information, the timestamp, the dynamic token and the interface signature information in the data packet; in the case that a user to be authenticated passes the interface security authentication, target resource information is obtained according to the resource location information, and the target resource information is encrypted and returned to the request end.
[0014] In one of the embodiments, the interface security authentication performed according to the identity information, the timestamp, the dynamic token and the interface signature information in the data packet, includes:
[0015] The identity information is used to verify the authenticity of the user to be authenticated, the timestamp is used to verify the request time range, the dynamic token is used to verify the request consistency, and the interface signature information is used to verify the interface signature; if the authenticity verification, the request time range verification, the request consistency verification and the interface signature verification all pass, it is confirmed that the user to be authenticated passes the interface security authentication; otherwise, it is confirmed that the user to be authenticated does not pass the interface security authentication, and an error information is returned.
[0016] In one of the embodiments, the request consistency verification of the dynamic token includes: generating an authorization value according to the identity information, the timestamp and a decryption key, and verifying the request consistency of the dynamic token according to the authorization value.
[0017] The interface signature verification according to the interface signature information comprises: intercepting a request parameter part from the resource location information, and formatting the request parameter part into an initial string; encrypting the initial string by using the hash-based message authentication code algorithm to convert the initial string into a target string; and obtaining an interface signature parameter from the interface signature information, and comparing the interface signature parameter with the target string.
[0018] In a third aspect, the present application further provides an interface security authentication device, comprising:
[0019] An information obtaining module is configured to obtain identity information of a user to be authenticated and a time stamp of a user access request instruction in response to the user access request instruction, wherein the identity information is provided by a response end offline to a request end.
[0020] A token generating module is configured to generate a dynamic token according to the identity information, the time stamp and an encryption key, and generate interface signature information by encrypting resource location information contained in the user access request instruction by using a hash-based message authentication code algorithm.
[0021] A data sending module is configured to generate a corresponding data packet based on the identity information, the time stamp, the dynamic token and the interface signature information, and send the data packet to the response end for interface security authentication.
[0022] An information receiving module is configured to receive target resource information returned by the response end in a case that the user to be authenticated passes the interface security authentication.
[0023] In a fourth aspect, the present application further provides an interface security authentication device, comprising:
[0024] A request response module is configured to receive a data packet sent by a request end in response to an interface request initiated by the request end, wherein the data packet is generated by the request end based on identity information, a time stamp, a dynamic token and interface signature information, the dynamic token is generated by the request end based on the identity information, the time stamp and an encryption key, and the interface signature information is generated by the request end by encrypting resource location information contained in a user access request instruction by using a hash-based message authentication code algorithm.
[0025] A security authentication module is configured to perform interface security authentication according to the identity information, the time stamp, the dynamic token and the interface signature information in the data packet.
[0026] The information sending module is configured to, in a case where the user to be authenticated passes the interface security authentication, acquire target resource information according to the resource location information, and return the target resource information to the request end after encryption.
[0027] In a fifth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the following steps when executing the computer program:
[0028] In response to a user access request instruction, identity information of a user to be authenticated and a time stamp of receiving the user access request instruction are acquired; the identity information is provided by a response end to a request end offline; a dynamic token is generated according to the identity information, the time stamp and an encryption key, and interface signature information is generated by encryption based on a hash-based message authentication code algorithm according to resource location information contained in the user access request instruction; a corresponding data packet is generated based on the identity information, the time stamp, the dynamic token and the interface signature information, and the data packet is sent to the response end for interface security authentication; in a case where the user to be authenticated passes the interface security authentication, target resource information returned by the response end after encryption is received.
[0029] In a sixth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the following steps when executing the computer program:
[0030] In response to an interface request initiated by a request end, a data packet sent by the request end is received; the data packet is generated by the request end according to identity information, a time stamp, a dynamic token and interface signature information; the dynamic token is generated by the request end according to the identity information, the time stamp and an encryption key; the interface signature information is generated by the request end by encryption based on a hash-based message authentication code algorithm according to resource location information contained in a user access request instruction; interface security authentication is performed according to the identity information, the time stamp, the dynamic token and the interface signature information in the data packet; in a case where a user to be authenticated passes the interface security authentication, target resource information is acquired according to the resource location information, and the target resource information is returned to the request end after encryption.
[0031] In a seventh aspect, the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the following steps:
[0032] In response to a user access request instruction, identity information of a user to be authenticated and a timestamp of receiving the user access request instruction are acquired; the identity information is provided offline by a response end to a request end; a dynamic token is generated according to the identity information, the timestamp and an encryption key, and interface signature information is generated by encryption based on a hash-based message authentication code algorithm according to resource location information contained in the user access request instruction; a corresponding data packet is generated based on the identity information, the timestamp, the dynamic token and the interface signature information, and the data packet is sent to the response end for interface security authentication; in a case where the user to be authenticated passes the interface security authentication, target resource information returned by the response end is received.
[0033] In the eighth aspect, the application further provides a computer readable storage medium, which has a computer program stored thereon, and the computer program is executed by a processor to implement the following steps:
[0034] In response to an interface request initiated by a request end, a data packet sent by the request end is received; the data packet is generated by the request end according to identity information, a timestamp, a dynamic token and interface signature information; the dynamic token is generated by the request end according to the identity information, the timestamp and an encryption key; the interface signature information is generated by the request end by encryption based on a hash-based message authentication code algorithm according to resource location information contained in a user access request instruction; interface security authentication is performed according to the identity information, the timestamp, the dynamic token and the interface signature information in the data packet; in a case where a user to be authenticated passes the interface security authentication, target resource information is acquired according to the resource location information, and the target resource information is returned to the request end after being encrypted.
[0035] In the ninth aspect, the application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the following steps:
[0036] In response to a user access request instruction, identity information of a user to be authenticated and a timestamp of receiving the user access request instruction are acquired; the identity information is provided offline by a response end to a request end; a dynamic token is generated according to the identity information, the timestamp and an encryption key, and interface signature information is generated by encryption based on a hash-based message authentication code algorithm according to resource location information contained in the user access request instruction; a corresponding data packet is generated based on the identity information, the timestamp, the dynamic token and the interface signature information, and the data packet is sent to the response end for interface security authentication; in a case where the user to be authenticated passes the interface security authentication, target resource information returned by the response end is received.
[0037] In a tenth aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:
[0038] In response to an interface request initiated by the requesting end, the system receives a data packet sent by the requesting end. The data packet is generated by the requesting end based on identity information, a timestamp, a dynamic token, and interface signature information. The dynamic token is generated by the requesting end based on the identity information, the timestamp, and an encryption key. The interface signature information is generated by the requesting end using a hash-based message authentication code algorithm, based on resource location information contained in the user access request instruction. Interface security authentication is performed based on the identity information, the timestamp, the dynamic token, and the interface signature information in the data packet. If the user to be authenticated passes the interface security authentication, the system obtains the target resource information based on the resource location information and returns the encrypted target resource information to the requesting end.
[0039] The aforementioned interface security authentication method, apparatus, computer equipment, computer-readable storage medium, and computer program product acquire the identity information of the user to be authenticated and the timestamp of the received user access request instruction; generate a dynamic token based on the identity information, timestamp, and encryption key; encrypt the resource location information contained in the user access request instruction using a hash-based message authentication code algorithm to generate interface signature information; then generate a corresponding data packet based on the identity information, timestamp, dynamic token, and interface signature information, and send the data packet to the responding end for interface security authentication; if the user to be authenticated passes the interface security authentication, receive the encrypted target resource information returned by the responding end. This application, when performing interface security authentication, verifies the user to be authenticated by combining multiple authentication factors such as identity information, timestamp, dynamic token, and interface signature information, making the authentication information difficult to crack and forge, effectively preventing attackers from using stolen authentication information to launch DDoS attacks, and ensuring the normal operation of the interface. Furthermore, this application overcomes the shortcomings of traditional technologies, such as insufficient authentication factors and simple verification mechanisms, and can accurately identify and filter malicious attack traffic, thereby improving the security of interface authentication and reducing security risks during data interaction. Attached Figure Description
[0040] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0041] Figure 1 This is a diagram illustrating the application environment of an interface security authentication method in one embodiment.
[0042] Figure 2 This is a flowchart illustrating an interface security authentication method in one embodiment;
[0043] Figure 3 This is a flowchart illustrating the encryption steps of an algorithm in one embodiment;
[0044] Figure 4 This is a flowchart illustrating the interface security authentication method in another embodiment;
[0045] Figure 5 This is a flowchart illustrating an interface security authentication method in an application embodiment.
[0046] Figure 6 This is a structural block diagram of an interface security authentication device in one embodiment;
[0047] Figure 7 This is a structural block diagram of an interface security authentication device in one embodiment;
[0048] Figure 8 This is an internal structural diagram of a computer device in one embodiment;
[0049] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation
[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0051] The interface security authentication method provided in this application embodiment can be applied to, for example, Figure 1 The application environment shown illustrates this. The requesting end can communicate with the responding end via a network. The data storage system stores the data that the server needs to process. The data storage system can be integrated onto the server, or it can be located in the cloud or on other network servers.
[0052] Specifically, the interface security authentication method provided in this application embodiment can be executed by the requesting end.
[0053] For example, in response to a user access request, the requesting end obtains the identity information of the user to be authenticated and the timestamp of receiving the user access request; the identity information is provided offline to the requesting end by the responding end; the requesting end generates a dynamic token based on the identity information, timestamp, and encryption key, and encrypts the resource location information contained in the user access request using a hash-based message authentication code algorithm to generate interface signature information; the requesting end generates a corresponding data packet based on the identity information, timestamp, dynamic token, and interface signature information, and sends the data packet to the responding end for interface security authentication; if the user to be authenticated passes the interface security authentication, the requesting end receives the encrypted target resource information returned by the responding end.
[0054] In such Figure 1 In the application environment shown, the requesting end can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. The responding end can be implemented using a standalone server or a server cluster consisting of multiple servers.
[0055] In one embodiment, such as Figure 2 As shown, an interface security authentication method is provided, which can be applied to... Figure 1 In the requesting end of the process, the method may include the following steps:
[0056] Step S201: In response to the user access request instruction, obtain the identity information of the user to be authenticated and the timestamp of receiving the user access request instruction.
[0057] Among them, the user to be authenticated can be a user who has access to the interface and initiates a user access request command.
[0058] Among them, identity information refers to various information used to uniquely identify and verify users. It can be biometric features, digital account information, and authentication information, etc. Identity information can be randomly generated by the responding end and provided offline to the requesting end.
[0059] Specifically, in response to a user access request instruction, the requesting end obtains the identity information of the user to be authenticated and determines the timestamp of receiving the user access request instruction.
[0060] Step S202: Generate a dynamic token based on the identity information, timestamp, and encryption key, and encrypt it using a hash-based message authentication code algorithm based on the resource location information contained in the user access request instruction to generate interface signature information.
[0061] Dynamic tokens are a security technology used for authentication and authorization, unlike traditional static passwords. The main feature of dynamic tokens is that their value changes constantly, making them more secure than traditional passwords and effectively preventing security threats such as DDoS attacks and phishing attacks.
[0062] Resource location information, such as Uniform Resource Locators (URLs), can be used to locate the address of a resource on the Internet or a local area network.
[0063] Specifically, the requesting end generates a dynamic token based on the identity information, timestamp, and encryption key, and encrypts it using a hash-based message authentication code algorithm based on the Uniform Resource Locator (URL) contained in the user access request instruction to generate interface signature information.
[0064] Step S203: Generate a corresponding data packet based on the identity information, timestamp, dynamic token and interface signature information, and send the data packet to the responding end for interface security authentication.
[0065] Specifically, the requesting end performs fusion processing based on identity information, timestamp, dynamic token, and interface signature information to generate a corresponding data packet, and then sends the data packet to the responding end for interface security authentication via the network.
[0066] Step S204: If the user to be authenticated passes the interface security authentication, receive the target resource information returned by the encrypted response end.
[0067] The target resource information can be data that needs to be interacted with, such as files, videos, or images.
[0068] Specifically, when the user to be authenticated passes the interface security authentication, the requesting end receives the target resource information returned by the responding end in encrypted form.
[0069] In this embodiment, the identity information of the user to be authenticated and the timestamp of the received user access request instruction are obtained. A dynamic token is generated based on the identity information, timestamp, and encryption key. This token is then encrypted using a hash-based message authentication code algorithm based on the resource location information contained in the user access request instruction to generate interface signature information. A corresponding data packet is then generated based on the identity information, timestamp, dynamic token, and interface signature information, and sent to the response end for interface security authentication. If the user to be authenticated passes the interface security authentication, the encrypted target resource information returned by the response end is received. This application, when performing interface security authentication, verifies the user by combining multiple authentication factors such as identity information, timestamp, dynamic token, and interface signature information. This makes the authentication information difficult to crack and forge, effectively preventing attackers from using stolen authentication information to launch DDoS attacks and ensuring the normal operation of the interface. Furthermore, this application overcomes the shortcomings of traditional technologies, such as insufficient authentication factors and simple verification mechanisms. It can accurately identify and filter malicious attack traffic, thereby improving the security of interface authentication and reducing security risks during data interaction.
[0070] In one embodiment, such as Figure 3 As shown, in step S202 above, the interface signature information is generated by encrypting the resource location information contained in the user access request instruction using a hash-based message authentication code algorithm. This may include the following steps:
[0071] Step S301: Extract the request parameter portion from the resource location information and format the request parameter portion into an initial string.
[0072] Step S302: The initial string is encrypted using a hash-based message authentication code algorithm to transform the initial string into the target string.
[0073] Step S303: Generate interface signature information based on key-value pairs containing the target string.
[0074] Specifically, the requesting end obtains the Uniform Resource Locator (URL), extracts the request parameter portion from the URL after sorting the request parameters, formats it into an initial string, encrypts it using a hash-based message authentication code algorithm, converts it into a hexadecimal string, adds the hexadecimal string to the original request as key-value pairs, and finally generates the interface signature information based on the key-value pairs.
[0075] In one embodiment, such as Figure 4 As shown, this application also provides an interface security authentication method, which can be applied to... Figure 1 In the response end of the method, the method may include the following steps:
[0076] Step S401: In response to the interface request initiated by the requesting end, receive the data packet sent by the requesting end; the data packet is generated by the requesting end based on the identity information, timestamp, dynamic token and interface signature information; the dynamic token is generated by the requesting end based on the identity information, timestamp and encryption key; the interface signature information is generated by the requesting end based on the resource location information contained in the user access request instruction, and encrypted by a hash-based message authentication code algorithm.
[0077] Step S402: Perform interface security authentication based on the identity information, timestamp, dynamic token, and interface signature information in the data packet.
[0078] Step S403: If the user to be authenticated passes the interface security authentication, obtain the target resource information based on the resource location information, and encrypt the target resource information and return it to the requesting end.
[0079] Specifically, the responding end responds to the interface request initiated by the requesting end by receiving the data packet sent by the requesting end; performs interface security authentication based on the identity information, timestamp, dynamic token, and interface signature information in the data packet; if the user to be authenticated passes the interface security authentication, obtains the target resource information based on the resource location information, and encrypts the target resource information and returns it to the requesting end.
[0080] In this embodiment, interface security authentication is performed based on identity information, timestamps, dynamic tokens, and interface signature information in the data packet. If the user to be authenticated passes the interface security authentication, the target resource information is obtained based on resource location information and then encrypted and returned to the requesting end. This application, when performing interface security authentication, verifies the user to be authenticated by combining multiple authentication factors such as identity information, timestamps, dynamic tokens, and interface signature information. This makes the authentication information difficult to crack and forge, effectively preventing attackers from using stolen authentication information to launch DDoS attacks and ensuring the normal operation of the interface. Furthermore, this application overcomes the shortcomings of traditional technologies, such as insufficient authentication factors and simple verification mechanisms. It can accurately identify and filter malicious attack traffic, thereby improving the security of interface authentication and reducing security risks during data interaction.
[0081] In one embodiment, step S402 above, which involves performing interface security authentication based on the identity information, timestamp, dynamic token, and interface signature information in the data packet, specifically includes the following steps:
[0082] The system verifies the authenticity of the user to be authenticated based on the identity information, verifies the request time range based on the timestamp, verifies the request consistency based on the dynamic token, and verifies the interface signature based on the interface signature information. If the user authenticity verification, request time range verification, request consistency verification, and interface signature verification all pass, the user to be authenticated is confirmed to have passed the interface security authentication; otherwise, the user to be authenticated is confirmed to have failed the interface security authentication, and an error message is returned.
[0083] Specifically, upon receiving an API request, the responding end performs API security authentication in the filter: verifying the user's authenticity based on the identity information, verifying the request time range based on the timestamp, verifying the request consistency based on the dynamic token, and verifying the API signature based on the API signature information; if the user authenticity verification, request time range verification, request consistency verification, and API signature verification all pass, the user is confirmed to have passed API security authentication; if at least one of the user authenticity verification, request time range verification, request consistency verification, and API signature verification fails, the user is confirmed to have failed API security authentication, and an error message is returned based on the failed verification item.
[0084] In one embodiment, as described above, the process of verifying the consistency of a request for a dynamic token specifically includes the following steps:
[0085] An authorization value is generated based on the identity information, timestamp, and decryption key. The dynamic token is then used to verify the consistency of the request based on the authorization value.
[0086] In the above embodiments, interface signature verification based on interface signature information specifically includes the following steps:
[0087] Extract the request parameters from the resource location information and format them into an initial string; encrypt the initial string using a hash-based message authentication code algorithm to transform it into the target string; obtain the interface signature parameters from the interface signature information and compare them with the target string.
[0088] Specifically, the responding end generates an authorization value based on the identity information, timestamp, and decryption key, and verifies the consistency of the dynamic token based on the authorization value. The responding end extracts the request parameters from the resource location information and formats them into an initial string; it then encrypts the initial string using a hash-based message authentication code algorithm to transform it into the target string; finally, it retrieves the interface signature parameters from the interface signature information and compares them with the target string to verify the authenticity of the interface request.
[0089] To more clearly illustrate the interface security authentication method provided in the embodiments of this application, the following describes the interface security authentication method in detail with a specific embodiment. In one embodiment, as follows... Figure 5 As shown, this application also provides another interface security authentication method, which specifically includes the following steps:
[0090] Step 1: The responding end randomly generates the user's identity information (which generally does not change) and provides it to the requesting end offline.
[0091] Step 2: The requesting end responds to the user's access request instruction by obtaining the identity information of the user to be authenticated and the timestamp of receiving the user's access request instruction, and generates a dynamic token based on the identity information, timestamp and encryption key.
[0092] Step 3: The requesting end extracts the request parameters from the resource location information and formats the request parameters into an initial string; it encrypts the initial string using a hash-based message authentication code algorithm to transform the initial string into the target string; and it generates interface signature information based on the key-value pairs containing the target string.
[0093] Step 4: The requesting end generates a corresponding data packet based on the identity information, timestamp, dynamic token, and interface signature information, and sends the data packet to the responding end for interface security authentication.
[0094] Step 5: After receiving the interface request, the responding end performs interface security authentication in the filter: It verifies the user's authenticity based on the identity information, verifies the request time range based on the timestamp, verifies the request consistency based on the dynamic token, and verifies the interface signature based on the interface signature information. If the user authenticity verification, request time range verification, request consistency verification, and interface signature verification all pass, the user is confirmed to have passed interface security authentication. If at least one of these verifications fails, the user is confirmed to have failed interface security authentication, and an error message is returned based on the failed verification item.
[0095] Step 6: After confirming that the user to be authenticated has passed the interface security authentication, the responding end obtains the target resource information based on the resource location information and returns the target resource information to the requesting end in encryption.
[0096] The beneficial effects of the above embodiments are as follows:
[0097] 1. Improved authentication security: This application adopts a dynamic token generation and distribution mechanism, combined with multi-factor authentication, which makes authentication information difficult to crack and forge, effectively preventing attackers from launching interface attacks by stealing authentication information.
[0098] 2. Effectively resist DDoS attacks: Through methods such as request preprocessing, frequency monitoring, behavior analysis, and anomaly detection, it can accurately identify and filter malicious attack traffic, reduce the impact of DDoS attacks on the interface, and ensure the normal operation of the interface.
[0099] 3. High flexibility and scalability: This application can flexibly adjust authentication strategies and security levels according to different application scenarios and security requirements. For example, simple dynamic token authentication can be used for interfaces with lower security requirements, while multi-factor authentication can be used for interfaces with higher security requirements. Furthermore, this application can be easily integrated with other security technologies and systems to improve overall security protection capabilities.
[0100] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.
[0101] Based on the same inventive concept, this application also provides an interface security authentication device for implementing the interface security authentication method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more interface security authentication device embodiments provided below can be found in the limitations of the interface security authentication method described above, and will not be repeated here.
[0102] In one exemplary embodiment, such as Figure 6 As shown, an interface security authentication device is provided, which may include:
[0103] Information acquisition module 601 is used to acquire the identity information of the user to be authenticated and the timestamp of receiving the user access request instruction in response to the user access request instruction; the identity information is provided offline by the responding end to the requesting end;
[0104] The token generation module 602 is used to generate a dynamic token based on the identity information, the timestamp, and the encryption key, and to encrypt the resource location information contained in the user access request instruction using a hash-based message authentication code algorithm to generate interface signature information.
[0105] Data sending module 603 is used to generate a corresponding data packet based on the identity information, the timestamp, the dynamic token and the interface signature information, and send the data packet to the response end for interface security authentication;
[0106] The information receiving module 604 is used to receive the target resource information encrypted and returned by the response end when the user to be authenticated passes the interface security authentication.
[0107] In one embodiment, the token generation module 602 is further configured to extract a request parameter portion from the resource location information and format the request parameter portion into an initial string; encrypt the initial string using the hash-based message authentication code algorithm to convert the initial string into a target string; and generate the interface signature information based on key-value pairs containing the target string.
[0108] In one exemplary embodiment, such as Figure 7 As shown, an interface security authentication device is provided, which may include:
[0109] The request-response module 701 is used to respond to an interface request initiated by the requesting end and receive a data packet sent by the requesting end; the data packet is generated by the requesting end based on identity information, timestamp, dynamic token, and interface signature information; the dynamic token is generated by the requesting end based on the identity information, the timestamp, and an encryption key; the interface signature information is generated by the requesting end through encryption using a hash-based message authentication code algorithm based on the resource location information contained in the user access request instruction;
[0110] Security authentication module 702 is used to perform interface security authentication based on the identity information, timestamp, dynamic token and interface signature information in the data packet;
[0111] The information sending module 703 is used to obtain target resource information based on the resource location information when the user to be authenticated passes the interface security authentication, and to encrypt and return the target resource information to the requesting end.
[0112] In one embodiment, the security authentication module 702 is further configured to verify the authenticity of the user to be authenticated based on the identity information, verify the request time range based on the timestamp, verify the request consistency based on the dynamic token, and verify the interface signature based on the interface signature information; if the user authenticity verification, the request time range verification, the request consistency verification, and the interface signature verification all pass, then the user to be authenticated is confirmed to have passed the interface security authentication; otherwise, the user to be authenticated is confirmed to have failed the interface security authentication, and an error message is returned.
[0113] In one embodiment, the security authentication module 702 is further configured to: generate an authorization value based on the identity information, the timestamp, and the decryption key; perform request consistency verification on the dynamic token based on the authorization value; extract a request parameter portion from the resource location information and format the request parameter portion into an initial string; encrypt the initial string using the hash-based message authentication code algorithm to convert the initial string into a target string; obtain interface signature parameters from the interface signature information and compare the interface signature parameters with the target string.
[0114] Each module in the aforementioned interface security authentication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.
[0115] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements an interface security authentication method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.
[0116] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements an interface security authentication method.
[0117] Those skilled in the art will understand that Figure 8 and Figure 9The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0118] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.
[0119] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.
[0120] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.
[0121] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.
[0122] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.
[0123] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.
[0124] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. An interface security authentication method, characterized in that, Applied to the requesting end, the method includes: In response to a user access request instruction, the system obtains the identity information of the user to be authenticated and the timestamp of receiving the user access request instruction; the identity information is provided offline by the responding end to the requesting end. A dynamic token is generated based on the identity information, the timestamp, and the encryption key. The token is then encrypted using a hash-based message authentication code algorithm based on the resource location information contained in the user access request instruction to generate interface signature information. Based on the identity information, the timestamp, the dynamic token, and the interface signature information, a corresponding data packet is generated, and the data packet is sent to the response end for interface security authentication; If the user to be authenticated passes the security authentication through the interface, the target resource information is received by the encrypted response from the responding end.
2. The method according to claim 1, characterized in that, The step of encrypting the resource location information contained in the user access request instruction using a hash-based message authentication code algorithm to generate interface signature information includes: Extract the request parameter portion from the resource location information and format the request parameter portion into an initial string; The initial string is encrypted using the hash-based message authentication code algorithm to transform it into the target string. The interface signature information is generated based on the key-value pairs containing the target string.
3. An interface security authentication method, characterized in that, Applied to the response end, the method includes: In response to an interface request initiated by the requesting end, the system receives a data packet sent by the requesting end; the data packet is generated by the requesting end based on identity information, timestamp, dynamic token, and interface signature information; the dynamic token is generated by the requesting end based on the identity information, the timestamp, and an encryption key; the interface signature information is generated by the requesting end through encryption using a hash-based message authentication code algorithm based on the resource location information contained in the user access request instruction. Interface security authentication is performed based on the identity information, timestamp, dynamic token, and interface signature information in the data packet; If the user to be authenticated passes the security authentication through the interface, the target resource information is obtained based on the resource location information, and the target resource information is encrypted and returned to the requesting end.
4. The method according to claim 3, characterized in that, The interface security authentication based on the identity information, timestamp, dynamic token, and interface signature information in the data packet includes: The user to be authenticated is verified based on the identity information, the request time range is verified based on the timestamp, the request consistency is verified based on the dynamic token, and the interface signature is verified based on the interface signature information. If the user authenticity verification, the request time range verification, the request consistency verification, and the interface signature verification all pass, then the user to be authenticated is confirmed to have passed the interface security authentication. Otherwise, it is confirmed that the user to be authenticated has failed the security authentication of the interface, and an error message is returned.
5. The method according to claim 4, characterized in that, The request for consistency verification of the dynamic token includes: An authorization value is generated based on the identity information, the timestamp, and the decryption key; and the dynamic token is used to verify the consistency of the request based on the authorization value. The step of verifying the interface signature based on the interface signature information includes: Extract the request parameter portion from the resource location information and format the request parameter portion into an initial string; The initial string is encrypted using the hash-based message authentication code algorithm to transform it into the target string. The interface signature parameters are obtained from the interface signature information, and the interface signature parameters are compared with the target string.
6. An interface security authentication device, characterized in that, Applied to the requesting end, the device includes: The information acquisition module is used to respond to a user access request instruction by acquiring the identity information of the user to be authenticated and the timestamp of receiving the user access request instruction; the identity information is provided offline by the responding end to the requesting end. The token generation module is used to generate a dynamic token based on the identity information, the timestamp, and the encryption key, and to encrypt the resource location information contained in the user access request instruction using a hash-based message authentication code algorithm to generate interface signature information. The data sending module is used to generate a corresponding data packet based on the identity information, the timestamp, the dynamic token and the interface signature information, and send the data packet to the response end for interface security authentication; The information receiving module is used to receive the encrypted target resource information returned by the response end when the user to be authenticated passes the interface security authentication.
7. An interface security authentication device, characterized in that, Applied to the response end, the device includes: The request-response module is used to respond to an interface request initiated by the requesting end and receive a data packet sent by the requesting end. The data packet is generated by the requesting end based on identity information, timestamp, dynamic token, and interface signature information. The dynamic token is generated by the requesting end based on the identity information, the timestamp, and an encryption key. The interface signature information is generated by the requesting end by encrypting the resource location information contained in the user access request instruction using a hash-based message authentication code algorithm. The security authentication module is used to perform interface security authentication based on the identity information, timestamp, dynamic token, and interface signature information in the data packet; The information sending module is used to obtain target resource information based on the resource location information when the user to be authenticated passes the interface security authentication, and to encrypt and return the target resource information to the requesting end.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.