User identity verification method and device, equipment and storage medium

Abstract

The invention relates to the technical field of identity verification, in particular to a user identity verification method and device, equipment and a storage medium, and the method comprises the steps: generating an original key value pair based on an obtained first login credential and recent access time; wherein the first login voucher is a login voucher obtained when the business system responds to a login request intercepted by an interceptor; in response to a second login voucher carried in the acquired service request, verifying whether a first login voucher consistent with the second login voucher exists in the original key value pair; and responding to a first login voucher consistent with the second login voucher in the original key value pair, and forwarding the service request to a third-party service. According to the invention, the security of the business system in butt joint with the third-party service can be improved.

Description

Technical Field

[0001] This application relates to the field of identity verification technology, and in particular to a user identity verification method, apparatus, device and storage medium. Background Technology

[0002] As usage requirements continue to evolve, business systems often encounter scenarios where they need to integrate with third-party services to fulfill certain needs.

[0003] Users need to authenticate their identity when logging into the business system, but they often do not need to verify their identity when using third-party services connected to the business system. Some external users may use third-party services that do not require identity verification to attack the business system. Therefore, the security of business systems that connect to third-party services is currently poor. Summary of the Invention

[0004] To improve the security of business systems that connect to third-party services, this application provides a user identity verification method, apparatus, device, and storage medium.

[0005] Firstly, this application provides a user identity verification method, including:

[0006] Based on the first login credential and the most recent access time, an original key-value pair is generated; wherein, the first login credential is the login credential obtained by the business system in response to the login request intercepted by the interceptor;

[0007] In response to the second login credential carried in the obtained business request, verify whether there is a first login credential that is consistent with the second login credential in the original key-value pair;

[0008] In response to the existence of a first login credential that matches the second login credential in the original key-value pair, the business request is forwarded to a third-party service.

[0009] Secondly, this application also provides a user identity verification method, including:

[0010] In response to the interception of a login request, the login request is forwarded to the business system;

[0011] In response to receiving the first login credential generated by the business system in response to the login request, the first login credential is forwarded to the gateway, so that the gateway generates an original key-value pair based on the obtained first login credential and the most recent access time; in response to the obtained business request carrying a second login credential, the gateway verifies whether there is a first login credential in the original key-value pair that matches the second login credential; in response to the existence of a first login credential in the original key-value pair that matches the second login credential, the business request is forwarded to a third-party service.

[0012] Thirdly, this application provides a user identity verification device, comprising:

[0013] The key-value pair generation module is used to generate original key-value pairs based on the obtained first login credential and the most recent access time; wherein, the first login credential is the login credential obtained by the business system in response to the login request intercepted by the interceptor;

[0014] The credential verification module is used to verify whether a first login credential that matches the second login credential exists in the original key-value pair in response to a second login credential carried in the obtained business request.

[0015] The request forwarding module is used to forward the business request to a third-party service in response to the existence of a first login credential that matches the second login credential in the original key-value pair.

[0016] Fourthly, this application provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the method described above.

[0017] Fifthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-described method.

[0018] Sixthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0019] The aforementioned user identity verification method, apparatus, device, and storage medium generate an original key-value pair based on an acquired first login credential and the most recent access time. The first login credential is obtained by the business system in response to a login request intercepted by an interceptor. In response to the acquisition of a second login credential carried in the business request, the system verifies whether a first login credential matching the second login credential exists in the original key-value pair. If a first login credential matching the second login credential exists in the original key-value pair, the business request is forwarded to a third-party service. Through this implementation, if a user wants to use a third-party service connected to the business system, they must first verify whether their sent business request contains a login credential allowing the customer to log in to the business system, and secondly, verify whether the login credential included in their business request matches the login credential allowing the customer to log in to the business system. By verifying at least these two methods, the security of the business request is verified, thereby achieving user identity verification. After successful verification, the user's business request is forwarded to the third-party service for processing. This prevents users from launching attacks on the business system through third-party services, thus improving the security of the business system connected to third-party services.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a user identity verification method provided in the embodiments of this application;

[0023] Figure 2 This is a schematic diagram illustrating the connection relationship between a business system, an interceptor, a gateway, and a third-party service, provided in an embodiment of this application.

[0024] Figure 3 This application provides a flowchart of another user identity verification method in its embodiments;

[0025] Figure 4 This is a schematic diagram of the structure of a user identity verification device provided in the embodiments of this application;

[0026] Figure 5This is a schematic diagram of the structure of a computer device provided in an embodiment of this application;

[0027] Figure 6 This is an internal structural diagram of a computer-readable storage medium provided in an embodiment of this application. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this disclosure.

[0029] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings herein are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0030] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0031] Example 1

[0032] Figure 1 This is a flowchart of a user identity verification method provided in Embodiment 1 of this application, for reference. Figure 1 The method can be executed by a device that performs the method, which can be implemented in software and / or hardware, and the method includes:

[0033] S110. Based on the obtained first login credential and the most recent access time, generate an original key-value pair; wherein, the first login credential is the login credential obtained by the business system in response to the login request intercepted by the interceptor.

[0034] Reference Figure 2This embodiment pre-defines a business system for users to log in and execute corresponding functions to meet user needs. For example, this business system could be an office system, an online shopping system, etc., without specific limitations. The business system interfaces with third-party services. For example, the third-party service could be an AI query service accessed by the office system, or an online payment service for the online shopping system, without specific limitations. The existing system can receive multiple requests initiated by users, such as login requests and business requests. To filter the requests to be processed from the received requests, this embodiment also interfaces the business system with an interceptor. For example, this interceptor could be an embedded interceptor or a proxy interceptor, without specific limitations. This interceptor can filter the requests sent to the business system to intercept the requests that the business system needs to process. For example, the request that the business system needs to process is a login request issued by the user.

[0035] To prevent users from directly calling third-party services after logging into the business system, or even without logging into the business system, this embodiment also includes a gateway that interfaces with the interceptor. This gateway is used to verify the business requests made by users who wish to call third-party services, thereby verifying the user's identity. The gateway also interfaces with the third-party services.

[0036] It should be noted that the interceptor may receive multiple requests in a short period of time. If the request that the business system wants to process is a login request, the interceptor needs to filter out the login request from multiple requests. To facilitate the interceptor's filtering of login requests from multiple requests, this implementation pre-configures a login request in the interceptor. This login request is specifically a login URL, such as "http: / / XXX / login". The interceptor compares the intercepted request with the configured login request. If they match, the intercepted request is determined to be a login request. Then, the intercepted login request is further sent to the business system. The business system responds to the login request. If the response indicates successful login, it sends the login credentials in the response back to the interceptor. The interceptor then forwards the login credentials to the gateway for storage and records the login credentials as the first login credentials. It should be noted that the first login credentials stored in the gateway are subsequently used to verify the legitimacy of business requests received by the gateway to determine whether the user identity corresponding to the business request is secure.

[0037] After logging into the business system, users will further access the business system, such as clicking function buttons. In this embodiment, the time when the user performs the first access operation after logging into the business system is recorded and recorded as the most recent access time. This most recent access time is subsequently used to verify whether the login credentials stored in the gateway are valid. It should be noted that if a user logs into the business system but does not perform any operation for a long time, the login credentials corresponding to the login request will become invalid.

[0038] For the first login credential forwarded by the storage interceptor, specifically, the gateway receives the first login credential and the most recent access time corresponding to the first login credential, and then stores the first login credential and the corresponding most recent access time as a key-value pair. For example, the key-value pair is "first login credential, most recent access time", and the key-value pair is recorded as the original key-value pair.

[0039] S120. In response to the second login credential carried in the obtained business request, verify whether there is a first login credential that is consistent with the second login credential in the original key-value pair.

[0040] It should be noted that after a user successfully logs into the business system, the business system will provide the corresponding first login credential. In order to help the business system determine whether the business requests made by the user to the business system are legitimate, the business requests made by the user will generally carry the corresponding login credential, and the login credential carried in the business request will be recorded as the second login credential.

[0041] Specifically, after receiving a service request, the gateway will first determine whether the service request carries a second login credential. If it does not, it means that the corresponding service request is invalid and cannot be further processed by the third-party service. In this case, the gateway will directly reject the service request. If the service request carries the aforementioned second login credential, it needs to further determine whether the service request is a request that the gateway allows to be forwarded to the third-party service.

[0042] Specifically, after determining that the business request carries a second login credential, it further determines whether there is a first login credential in the original key-value pair that is consistent with the second login credential. If it exists, it means that the business request is a request that the gateway allows to be forwarded to a third-party service; otherwise, it means that the business request is not a request that the gateway allows to be forwarded to a third-party service.

[0043] S130. In response to the existence of a first login credential that matches the second login credential in the original key-value pair, the business request is forwarded to a third-party service.

[0044] If it is determined that there is a first login credential that is consistent with the second login credential in the original key-value pair, it means that the business request corresponding to the second login credential is a request that the gateway allows to be forwarded to a third-party service. This means that the business request is a reasonable and secure request, and indirectly indicates that the user identity corresponding to the business request is secure. At this time, the gateway forwards the above business request to the third-party service to call the third-party service to meet the requirements corresponding to the business request.

[0045] It should be noted that this embodiment generates an original key-value pair based on the acquired first login credential and the most recent access time. The first login credential is obtained by the business system in response to a login request intercepted by the interceptor. In response to the acquired business request carrying a second login credential, the system verifies whether a first login credential matching the second login credential exists in the original key-value pair. If a first login credential matching the second login credential exists in the original key-value pair, the business request is forwarded to a third-party service. Through this implementation, if a user wants to use a third-party service connected to the business system, they must first verify whether their sent business request contains a login credential allowing the customer to log in to the business system, and secondly, verify whether the login credential included in their business request matches the login credential allowing the customer to log in to the business system. By verifying at least these two methods, the security of the business request is verified, thereby verifying the user's identity. After successful verification, the user's business request is forwarded to the third-party service for processing. This prevents users from launching attacks on the business system through third-party services, thus improving the security of the business system connected to third-party services.

[0046] It should also be noted that this application non-intrusively integrates the newly introduced third-party services with the existing system's identity verification system. Using the existing system's identity verification system as data support, it provides non-intrusive identity verification functionality for the third-party services, ensuring that only users who have passed the identity verification can use the new third-party services. This also avoids requiring existing users to re-register to use the new services. Furthermore, this application employs various traffic interception methods to ensure high system adaptability and utilizes gateway interception functions to guarantee the healthy operation of the third-party services.

[0047] Example 2

[0048] This application provides a user identity verification method in Embodiment 2, which optimizes the "responding to the acquisition of a business request carrying a second login credential, verifying whether a first login credential consistent with the second login credential exists in the original key-value pair" in Embodiment 1. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0049] S210. Based on the obtained first login credential and the most recent access time, generate an original key-value pair; wherein, the first login credential is the login credential obtained by the business system in response to the login request intercepted by the interceptor.

[0050] S221. In response to the second login credential carried in the obtained business request, verify whether a token exists in the preset token bucket.

[0051] It should be noted that some individual users may require third-party services to respond to multiple (e.g., thousands) business requests in a short period of time, or there may be cases of malicious calls to third-party services. Therefore, if a user sends multiple business requests to a third-party service in a short period of time, in order to facilitate load balancing of the third-party service in terms of request response to users who send business requests to it, it is necessary to limit the number of business requests that a third-party service can process from a single user in a short period of time.

[0052] Specifically, in this embodiment, a token bucket is set up for each user's second login credential, and tokens are put into the token bucket at a certain rate. Taking a user's business request as an example, after the gateway obtains the business request, it further determines whether there is a token in the corresponding token bucket. If there is, a token will be taken out. At this time, it is initially indicated that the business request is qualified to be processed by a third-party service.

[0053] S222. If so, verify whether there is a first login credential that matches the second login credential in the original key-value pair.

[0054] If a token is found in the token bucket, it only preliminarily indicates that the corresponding business request is qualified to be processed by a third-party service. The legality of the business request still needs to be verified, that is, whether there is a first login credential that is consistent with the second login credential in the original key-value pairs stored in the gateway.

[0055] It should be noted that since the rate at which tokens are sent to the token bucket is limited, the number of business requests that the gateway can process in a short period of time is also limited, thus enabling rate limiting of business requests. In this way, on the one hand, it is easier to prevent a large number of malicious business requests generated in a short period of time from impacting third-party services, thereby improving the security of business systems and third-party services. On the other hand, it can ensure that third-party services can achieve load balancing of business requests from different users, thereby ensuring the user experience of different users.

[0056] S230. In response to the existence of a first login credential that matches the second login credential in the original key-value pair, the business request is forwarded to a third-party service.

[0057] Example 3

[0058] This application provides a user identity verification method in Embodiment 3, which optimizes the "forwarding of the business request to a third-party service in response to the existence of a first login credential consistent with the second login credential in the original key-value pair" in Embodiment 1. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0059] S310. Based on the obtained first login credential and the most recent access time, generate an original key-value pair; wherein, the first login credential is the login credential obtained by the business system in response to the login request intercepted by the interceptor.

[0060] S320. In response to the second login credential carried in the obtained business request, verify whether there is a first login credential that is consistent with the second login credential in the original key-value pair.

[0061] S331. In response to the existence of a first login credential that matches the second login credential in the original key-value pair, verify whether the first login credential has expired based on the original key-value pair, the obtained current time, and the preset stay duration threshold.

[0062] It should be noted that if a first login credential that matches the second login credential is found in the original key-value pair, it means that the business request containing the second login credential is a secure request. However, the first login credential stored as a key-value pair in the gateway has a time limit. If the first login credential expires, it is not qualified to be compared with the second login credential, which also means that the business request corresponding to the second login credential is not qualified to be forwarded to a third-party service for processing.

[0063] For example, after a user logs into a business system, the system responds with a corresponding login credential. Subsequent business requests from the user to operate the system will carry this login credential (second login credential), and this login credential (first login credential) will be stored in the gateway as a key-value pair (original key-value pair) along with the most recent access time. Each time the user performs an operation on the business system, the most recent access time in the key-value pair will be updated to the time when the user completed the operation. If the user completes an operation and then does not perform any subsequent operations for a long period of time, the business system will consider that the user has completed the access and will disqualify the user from accessing the business system. Specifically, the system determines the duration of the user's inactivity on the business system based on the original key-value pair and the current time obtained, and then judges whether the duration is too long based on a preset dwell time threshold. If it is too long, the first login credential in the corresponding key-value pair is deemed invalid; otherwise, the first login credential in the corresponding key-value pair is deemed valid.

[0064] S332. If not, forward the business request to a third-party service.

[0065] Example 4

[0066] This application provides a user identity verification method in Embodiment 4, which optimizes the "verification of whether the first login credential has expired based on the original key-value pair, the obtained current time, and the preset dwell time threshold" in Embodiment 3. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0067] S410. Based on the obtained first login credential and the most recent access time, generate an original key-value pair; wherein, the first login credential is the login credential obtained by the business system in response to the login request intercepted by the interceptor.

[0068] S420. In response to the second login credential carried in the obtained business request, verify whether there is a first login credential that is consistent with the second login credential in the original key-value pair.

[0069] S431A: In response to the existence of a first login credential that matches the second login credential in the original key-value pair, the most recent access time in the original key-value pair is parsed out.

[0070] The gateway stores the original key-value pairs corresponding to the user's login request. These key-value pairs include the first login credential and the most recent access time. Taking a raw key-value pair as an example, the most recent access time can be determined by parsing the key-value pair. .

[0071] S431B. Determine the dwell time based on the most recent access time and the current time obtained.

[0072] Among them, the above-mentioned most recent access time This reflects the time when a user last interacted with the business system before the current moment, and is used to calculate the most recent access time. To determine the duration between the current time and the present time, we also need to obtain the current time and record it as the current time. Also includes the most recent visit time. The duration between the present moment and the present moment is recorded as the dwell time. ,in, = - .

[0073] S431C. Determine whether the dwell time exceeds a preset dwell time threshold to verify whether the first login credential has expired.

[0074] Among them, to determine the duration of stay Whether the time is too long, that is, whether the user has not operated the business system for a long time, this embodiment has a preset function for determining whether the dwell time is too long. Comparison of dwell time thresholds .

[0075] Specifically, regarding the length of stay Greater than the threshold for the duration of stay If the user has not performed any operations on the business system for an extended period of time, then the first login credential is deemed to have expired; otherwise, the first login credential is deemed not to have expired.

[0076] S432. If not, forward the business request to a third-party service.

[0077] Example 5

[0078] This application provides a user identity verification method in Embodiment 5, which supplements the steps following "generating original key-value pairs based on the obtained first login credential and the most recent access time" in Embodiment 1. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0079] S510. Based on the obtained first login credential and the most recent access time, generate an original key-value pair; wherein, the first login credential is the login credential obtained by the business system in response to the login request intercepted by the interceptor.

[0080] S520. In response to the second login credential carried in the obtained business request, verify whether there is a first login credential that is consistent with the second login credential in the original key-value pair.

[0081] S530. In response to the existence of a first login credential that matches the second login credential in the original key-value pair, the business request is forwarded to a third-party service.

[0082] S540. Randomly access each of the original key-value pairs to determine the target key-value pair.

[0083] It should be noted that after different users log in to the business system, they can generate and store corresponding original key-value pairs in the gateway. As can be seen from the analysis of Embodiments 3 and 4 above, the first login credential in the original key-value pair may expire. If the first login credential expires, in order to prevent the expired first login credential from being used for meaningless consistency comparison with the corresponding second login credential carried in the business request, this embodiment also promptly invalidates the expired first login credential in the gateway.

[0084] It should also be noted that while the gateway is efficient at retrieving the most recent access time from a single raw key-value pair, it is less efficient at retrieving the most recent access time from all stored raw key-value pairs due to the storage structure of the raw key-value pairs, and this process wastes significant computing resources. Therefore, in this embodiment, a random access method is performed periodically on all stored raw key-value pairs to first randomly select a certain number of raw key-value pairs, and then the first login credential in the selected raw key-value pairs is analyzed for expiration.

[0085] Specifically, the gateway periodically selects a small subset (10 pairs) of raw key-value pairs from all (assuming 100 pairs) of raw key-value pairs stored, and records the selected raw key-value pairs as target key-value pairs.

[0086] S550. Based on the most recent access time in the target key-value pair and the current time obtained, determine the no-operation duration.

[0087] Taking a target key-value pair as an example, the most recent access time in the target key-value pair is determined by parsing the target key-value pair. It also gets the current time. Then the current time With the most recent visit time The duration between these periods is used as the inactivity period. No operation time It is used to reflect the time elapsed since the user last performed an operation on the business system until the current time, and also to determine whether the user has not performed any operation on the business system for too long.

[0088] S560. In response to the inactivity duration exceeding a preset inactivity duration threshold, invalidate the first login credential in the target key-value pair.

[0089] Among them, it is through the no-operation time To determine whether there has been an extended period of inactivity with the business system, this embodiment includes a preset function to determine the duration of inactivity. Threshold for no-operation duration for comparison If there is no operation time Greater than the threshold for inactivity duration If this is the case, it means that the user has not operated the business system for too long, which means that the first login credential corresponding to the login request issued by the user has expired. In this case, the first login credential needs to be invalidated.

[0090] It should be noted that, on the one hand, by periodically and randomly accessing and selecting the original key-value pairs that need to be analyzed for expiration, the efficiency of performing expiration analysis on the first login credentials among all original key-value pairs can be effectively improved, and the resource consumption level caused by expiration analysis can be reduced. On the other hand, by promptly cleaning up the expired first login credentials stored in the gateway, meaningless consistency comparisons between expired first login credentials and the corresponding second login credentials in business requests can be prevented, thereby facilitating the improvement of user identity verification efficiency.

[0091] Example 6

[0092] This application provides a user identity verification method in Embodiment Six, which supplements the method shown in Embodiment One. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments. The method includes:

[0093] S610. Based on the obtained first login credential and the most recent access time, generate an original key-value pair; wherein, the first login credential is the login credential obtained by the business system in response to the login request intercepted by the interceptor.

[0094] S620. In response to the second login credential carried in the obtained business request, verify whether there is a first login credential that is consistent with the second login credential in the original key-value pair.

[0095] S630. In response to the existence of a first login credential that matches the second login credential in the original key-value pair, the business request is forwarded to a third-party service.

[0096] S640. In response to receiving a logout request, invalidate the first login credential in the original key-value pair corresponding to the logout request.

[0097] After a user completes access to the business system, they will generally send a logout request. The logout request of the same user has a corresponding login request. The login request stores the corresponding first login credential in the gateway, which is also the corresponding login credential of the aforementioned logout request.

[0098] It should be noted that if the gateway receives a logout request from a user, it means that the user no longer needs to access the business system. The first login credential corresponding to the user's previous login request may not have expired yet. To prevent the first login credential from being maliciously used by other users, the corresponding first login credential must be invalidated in a timely manner after the user issues a logout request.

[0099] Specifically, once the gateway receives a logout request from a user, it first determines the original key-value pair corresponding to the login request, and then invalidates the first login credential in that original key-value pair.

[0100] It should be noted that using the first login credential corresponding to the logout request in a timely manner helps prevent malicious attacks on business systems or third-party services, thereby improving the security of business systems or third-party services.

[0101] Example 7

[0102] Figure 3 A flowchart of a user identity verification method is also provided for Embodiment Seven of this application, see reference. Figure 3 The method can be executed by a device that performs the method, which can be implemented in software and / or hardware, and the method includes:

[0103] S710. In response to intercepting a login request, the login request is forwarded to the business system.

[0104] Among them, reference Figure 2 The interceptor is used to intercept login requests sent by users, and forwards the login request to the business system when the login request matches the pre-configured login request.

[0105] It should be noted that the interceptor used in this embodiment can be an embedded interceptor built into the business system, or a proxy interceptor that interfaces with the business system. While embedded interceptors are simple to deploy, they require code modifications to the business system to achieve embedding. Proxy interceptors require virtually no code modifications to the business system, but their deployment is slightly more complex. Neither embedded nor proxy interceptors require extensive code modifications to the business system, effectively reducing the intrusion of the interceptor into the business system's code.

[0106] Among them, proxy-type interceptors can specify the requests that need to be intercepted according to blacklists or whitelists, so as to avoid gateway credential delays or errors caused by incorrect interception.

[0107] S720. In response to receiving the first login credential generated by the business system in response to the login request, the first login credential is forwarded to the gateway so that the gateway generates an original key-value pair based on the obtained first login credential and the most recent access time; in response to the obtained business request carrying a second login credential, the gateway verifies whether there is a first login credential consistent with the second login credential in the original key-value pair; in response to the existence of a first login credential consistent with the second login credential in the original key-value pair, the business request is forwarded to a third-party service.

[0108] If the business system responds to the login request as a successful login, it will send a login credential to the interceptor and record the login credential as the first login credential. The interceptor will then send the first login credential to the gateway so that the gateway can determine whether to forward the received business request to the third-party service based on the first gateway. The specific implementation steps of the gateway determining whether to forward the received business request to the third-party service based on the first gateway can be found in Embodiment 1, and will not be repeated here.

[0109] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0110] Example 8

[0111] Based on the same inventive concept, this embodiment also provides a user identity verification device for implementing the user identity verification method described above. The solution provided by this device is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more user identity verification device embodiments provided below can be found in the limitations of the user identity verification method described above, and will not be repeated here.

[0112] In this embodiment, as Figure 4 As shown, a user identity verification device is provided, comprising:

[0113] The key-value pair generation module is used to generate original key-value pairs based on the obtained first login credential and the most recent access time; wherein, the first login credential is the login credential obtained by the business system in response to the login request intercepted by the interceptor;

[0114] The credential verification module is used to verify whether a first login credential that matches the second login credential exists in the original key-value pair in response to a second login credential carried in the obtained business request.

[0115] The request forwarding module is used to forward the business request to a third-party service in response to the existence of a first login credential that matches the second login credential in the original key-value pair.

[0116] Each module in the aforementioned user identity verification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0117] It should be noted that this embodiment generates an original key-value pair based on the acquired first login credential and the most recent access time. The first login credential is obtained by the business system in response to a login request intercepted by the interceptor. In response to the acquired business request carrying a second login credential, the system verifies whether a first login credential matching the second login credential exists in the original key-value pair. If a first login credential matching the second login credential exists in the original key-value pair, the business request is forwarded to a third-party service. Through this implementation, if a user wants to use a third-party service connected to the business system, they must first verify whether their sent business request contains a login credential allowing the customer to log in to the business system, and secondly, verify whether the login credential included in their business request matches the login credential allowing the customer to log in to the business system. By verifying at least these two methods, the security of the business request is verified, thereby verifying the user's identity. After successful verification, the user's business request is forwarded to the third-party service for processing. This prevents users from launching attacks on the business system through third-party services, thus improving the security of the business system connected to third-party services.

[0118] It should also be noted that this application non-intrusively integrates the newly introduced third-party services with the existing system's identity verification system. Using the existing system's identity verification system as data support, it provides non-intrusive identity verification functionality for the third-party services, ensuring that only users who have passed the identity verification can use the new third-party services. This also avoids requiring existing users to re-register to use the new services. Furthermore, this application employs various traffic interception methods to ensure high system adaptability and utilizes gateway interception functions to guarantee the healthy operation of the third-party services.

[0119] In an optional embodiment, the step of verifying whether a first login credential consistent with the second login credential exists in the original key-value pair in response to the obtained service request carrying a second login credential includes:

[0120] In response to the second login credential carried in the obtained business request, verify whether a token exists in the preset token bucket;

[0121] If so, verify whether the original key-value pair contains a first login credential that matches the second login credential.

[0122] In an optional embodiment, the step of forwarding the business request to a third-party service in response to the existence of a first login credential consistent with the second login credential in the original key-value pair includes:

[0123] In response to the presence of a first login credential that matches the second login credential in the original key-value pair, the system verifies whether the first login credential has expired based on the original key-value pair, the current time obtained, and the preset dwell time threshold.

[0124] If not, forward the business request to a third-party service.

[0125] In an optional embodiment, verifying whether the first login credential has expired based on the original key-value pair, the obtained current time, and a preset dwell time threshold includes:

[0126] Parse the most recent access time from the original key-value pairs;

[0127] The duration of stay is determined based on the most recent access time and the current time obtained.

[0128] Determine whether the dwell time exceeds a preset dwell time threshold to verify whether the first login credential has expired.

[0129] In an optional embodiment, the user identity verification device further includes:

[0130] The key-value pair generation module is used to randomly access each of the original key-value pairs to determine the target key-value pair;

[0131] The duration determination module is used to determine the no-operation duration based on the most recent access time in the target key-value pair and the current time obtained;

[0132] The credential invalidation module is used to invalidate the first login credential in the target key-value pair in response to the inactivity duration exceeding a preset inactivity duration threshold.

[0133] In an optional embodiment, the user identity verification device further includes:

[0134] The credential invalidation module is used to invalidate the first login credential in the original key-value pair corresponding to the logout request in response to receiving a logout request.

[0135] In an optional embodiment, the user identity verification device includes:

[0136] The login request forwarding module is used to forward the login request to the business system in response to the interception of the login request;

[0137] The login credential forwarding module is used to, in response to receiving a first login credential generated by the business system in response to the login request, forward the first login credential to the gateway so that the gateway generates an original key-value pair based on the obtained first login credential and the most recent access time; in response to receiving a business request carrying a second login credential, verify whether there is a first login credential in the original key-value pair that matches the second login credential; and in response to the existence of a first login credential in the original key-value pair that matches the second login credential, forward the business request to a third-party service.

[0138] Example 9

[0139] In this embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows. Figure 5 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a user authentication method.

[0140] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the computer device to which the present disclosure is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0141] Example 10

[0142] In this embodiment, a computer-readable storage medium is provided, such as... Figure 6 As shown, a computer program is stored thereon, and when the computer program is executed by the processor, it implements the steps in the above-described method embodiments.

[0143] Example 11

[0144] In this embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0145] It should be noted that the information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and it does not violate public order and good morals. Corresponding operation portals are provided for users to choose to authorize or refuse.

[0146] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this disclosure can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this disclosure may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this disclosure may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0147] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0148] The embodiments described above are merely illustrative of several implementations of this disclosure, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent disclosure. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this disclosure, and these all fall within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the appended claims.

Claims

1. A method of user identity verification, the method comprising: The method comprises: generating an original key-value pair based on the obtained first login credential and the latest access time, wherein the first login credential is obtained by the business system in response to the login request intercepted by the interceptor; in response to the second login credential carried in the obtained business request, verifying whether the first login credential consistent with the second login credential exists in the original key-value pair; in response to the first login credential consistent with the second login credential existing in the original key-value pair, forwarding the business request to the third-party service.

2. The method of claim 1, wherein, The method comprises: in response to the second login credential carried in the obtained business request, verifying whether the token exists in the preset token bucket; if yes, verifying whether the first login credential consistent with the second login credential exists in the original key-value pair.

3. The method of claim 1, wherein, The method comprises: in response to the first login credential consistent with the second login credential existing in the original key-value pair, verifying whether the first login credential is expired based on the original key-value pair, the obtained current time, and the preset stay duration threshold; if no, forwarding the business request to the third-party service.

4. The method of claim 3, wherein, The method comprises: parsing the latest access time in the original key-value pair; determining the stay duration based on the latest access time and the obtained current time; judging whether the stay duration exceeds the preset stay duration threshold to verify whether the first login credential is expired.

5. The method of claim 1, wherein, The method further comprises: randomly accessing each of the original key-value pairs to determine a target key-value pair; determining an inaction duration based on the latest access time in the target key-value pair and the obtained current time; in response to the inaction duration being greater than the preset inaction duration threshold, invalidating the first login credential in the target key-value pair.

6. The method of claim 1, wherein, The method further comprises: in response to receiving a logout request, invalidating the first login credential in the original key-value pair corresponding to the logout request.

7. A method of verifying a user identity, the method comprising: The method comprises: forwarding the login request to the business system in response to intercepting the login request; forwarding the first login credential generated by the business system in response to the login request to the gateway, so that the gateway generates an original key-value pair based on the obtained first login credential and the latest access time, verifies whether the first login credential consistent with the second login credential exists in the original key-value pair in response to the second login credential carried in the obtained business request, and forwards the business request to the third-party service in response to the first login credential consistent with the second login credential existing in the original key-value pair.

8. A user identity verification apparatus, characterized by comprising: The apparatus comprises: The key-value pair generation module is configured to generate an original key-value pair based on the obtained first login credential and the latest access time, wherein the first login credential is obtained by the business system in response to a login request intercepted by the interceptor. The credential verification module is configured to verify, in response to the second login credential being carried in the obtained business request, whether the original key-value pair contains the first login credential consistent with the second login credential. The request forwarding module is configured to forward the business request to the third-party service in response to the original key-value pair containing the first login credential consistent with the second login credential. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 6 or claim 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 6 or claim 7.

Images