Request processing method and device, storage medium and electronic equipment
By dynamically embedding a two-factor authentication layer in the inter-application call chain and automatically carrying the application identity token using aspect instrumentation technology, the problem of identity impersonation between applications is solved, achieving secure and low-cost inter-application authentication.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-03
- Publication Date
- 2026-04-14
AI Technical Summary
Existing identity authentication mechanisms have failed to effectively prevent identity theft between applications, necessitating the implementation of non-intrusive two-factor authentication (MFA) between applications to improve security.
A two-factor authentication layer is dynamically embedded in the inter-application call chain. The application identity token is automatically carried through aspect instrumentation. After the target application authenticates, the request is allowed, keeping the original application architecture unchanged.
It effectively prevents application-layer identity impersonation, ensuring security while significantly reducing transformation costs.
Smart Images
Figure CN121864362A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to computer technology, and more particularly to a method, apparatus, storage medium, and electronic device for processing requests. Background Technology
[0002] Existing authentication mechanisms are mostly limited to user login authentication, failing to completely prevent security issues caused by identity theft between applications. To prevent identity theft between applications, effective authentication measures must be added to inter-application requests, namely application-to-application (APPA) two-factor authentication. How to implement inter-application MFA (Multi-Factor Authentication) non-intrusively is a problem that urgently needs to be solved. Summary of the Invention
[0003] The purpose of the embodiments in this specification is to provide a method, apparatus, storage medium, and electronic device for processing requests.
[0004] This specification provides a method for processing requests, proposing an aspect-based, non-intrusive inter-application MFA. A two-factor authentication layer is dynamically embedded in the inter-application call chain to achieve dual authentication of "caller identity + dynamic token." When an application initiates a request, token information is automatically carried through aspect instrumentation. After the target application receives the request, it authenticates the token information in the request before allowing the request to continue, thereby effectively preventing identity impersonation at the application layer. Furthermore, by using aspect technology, the original application architecture remains unchanged, balancing security with significantly reduced modification costs. The method includes: In response to a first application sending a target request to a second application, the target request is intercepted through a first aspect corresponding to the first application, and the target request carries the application identity token corresponding to the first application, so that the first application sends the target request to the second application. In response to the second application receiving the target request, the first application intercepts the target request through the second aspect corresponding to the second application, performs caller authentication on the first application, and performs two-factor authentication based on the application's identity token if the caller authentication is successful. If the two-factor authentication is successful, the target request is allowed; if the two-factor authentication is unsuccessful, the target request is rejected.
[0005] Furthermore, the two-factor authentication based on the application identity token includes: Determine whether the target request requires two-factor authentication; If so, perform two-factor authentication based on the application identity token.
[0006] Further, determining whether the target request requires two-factor authentication includes: Obtain the target operation associated with the target request; Determine whether the target request requires two-factor authentication based on the target operation.
[0007] Further, determining whether the target request requires two-factor authentication based on the target operation includes: Whether the target request needs two-factor authentication is determined based on the operational sensitivity of the target operation.
[0008] Further, determining whether the target request requires two-factor authentication includes: Based on whether the target request meets the preset behavioral criteria, determine whether the target request needs to undergo two-factor authentication.
[0009] Further, determining whether the target request requires two-factor authentication includes: Based on the first device region corresponding to the first application and the second device region corresponding to the second application, determine whether the target request needs to undergo two-factor authentication.
[0010] Further, determining whether the target request requires two-factor authentication based on the first device region corresponding to the first application and the second device region corresponding to the second application includes: Whether the target request needs to undergo two-factor authentication is determined based on whether the first device region corresponding to the first application and the second device region corresponding to the second application are the same device region.
[0011] Furthermore, the method also includes: If it is determined that the target request does not require two-factor authentication, the target request is allowed.
[0012] Furthermore, the method also includes: If a target authorization token is generated through two-factor authentication, the target authorization token is bound to the session information of the first application in the second application, and the target authorization token is provided to the first application, wherein the validity period of the target authorization token is less than or equal to a preset threshold.
[0013] Furthermore, the step of performing two-factor authentication based on the application identity token to allow the target request includes: Determine whether the target request contains the target authorization token; if so, determine whether the target authorization token is bound to the session information of the first application at the second application; if so, allow the target request. If the target request does not contain the target authorization token, or if the target authorization token is not bound to the session information of the first application at the second application, two-factor authentication is performed based on the application identity token.
[0014] This specification also provides an embodiment for processing a request, comprising: The request initiation module is used to respond to a target request initiated by a first application to a second application, intercept the target request through a first aspect corresponding to the first application, and carry the application identity token corresponding to the first application in the target request, so that the first application sends the target request to the second application; The request receiving module is configured to, in response to the second application receiving the target request, intercept the target request through the second aspect corresponding to the second application, perform caller authentication on the first application, and if the caller authentication is successful, perform two-factor authentication based on the application's identity token. If the two-factor authentication is successful, allow the target request; if the two-factor authentication is unsuccessful, reject the target request.
[0015] This specification also provides a storage medium storing a computer program adapted to be loaded by a processor and to execute the steps of the method described above.
[0016] This specification also provides an electronic device, including a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method described above.
[0017] This specification also provides a computer program product that stores at least one instruction, characterized in that the at least one instruction, when executed by a processor, implements the steps of the above-described method.
[0018] According to the embodiments of this specification, a non-intrusive inter-application MFA based on aspects is proposed. A two-factor authentication layer is dynamically embedded in the inter-application call chain to achieve dual authentication of "caller identity + dynamic token". When an application initiates a request, token information is automatically carried through aspect instrumentation. After the target application receives the request, it authenticates the token information in the request before allowing the request to continue, thereby effectively preventing identity impersonation at the application layer. Moreover, by implementing aspect technology, the original application architecture can remain unchanged, which can both ensure security and significantly reduce the transformation cost. Attached Figure Description
[0019] Figure 1 A flowchart illustrating a method for processing requests provided in an embodiment of this specification; Figure 2A flowchart illustrating a method for processing requests provided in an embodiment of this specification; Figure 3 A schematic diagram of a device for processing requests provided in an embodiment of this specification; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. Detailed Implementation
[0020] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.
[0021] Please see Figure 1 This is a flowchart illustrating a method for processing requests provided in an embodiment of this specification. In this embodiment, the method for processing requests is applied to a request processing apparatus (hereinafter referred to as a "request processing apparatus") or an electronic device equipped with a request processing apparatus. The following will focus on... Figure 1 The process shown will be described in detail. The method for processing requests may specifically include the following steps: S102, in response to the first application initiating a target request to the second application, the target request is intercepted through the first aspect corresponding to the first application, and the application identity token corresponding to the first application is carried in the target request, so that the first application sends the target request to the second application.
[0022] In some embodiments, the application types of the first application and the second application include, but are not limited to, applications, hosted programs (e.g., mini-programs), web pages, etc., and this example embodiment does not impose any special limitations on them. In some embodiments, the first application and the second application correspond to the same application type, or the first application and the second application may correspond to two different application types. In some embodiments, the first application and the second application reside on the same request processing device or an electronic device configured with a request processing device, or the first application and the second application may reside on two different request processing devices or electronic devices configured with request processing devices.
[0023] In some embodiments, an aspect refers to a technology that integrates into the system without interfering with business logic, providing insider and intervention capabilities. The aspect proxy layer is an intermediate layer automatically generated by the AOP (Aspect-Oriented Programming) framework to implement aspect-oriented programming. This layer "wraps" around the target object. When external code calls a method of the target object, it actually calls this proxy layer, which determines when and how to execute the aspect logic you define and whether to call the real target method. In AOP, the pointcut of an aspect is used to define the execution location of the aspect code, to specify which methods or join points to insert aspect logic, and to determine when the aspect takes effect.
[0024] In some embodiments, the entry point of the first aspect is located in the first application. The proxy layer of the first aspect listens for target requests initiated by the first application to the second application, intercepts the target requests, and carries an application identity token corresponding to the first application in the target request. This application identity token is used to identify the application identity of the first application. Then, the target request is allowed, enabling the first application to send the target request to the second application. If the first application and the second application are located on the same request processing device or an electronic device configured with a request processing device, the first application sends the target request to the second application via a local connection. If the first application and the second application are located on two different request processing devices or electronic devices configured with request processing devices, the first application sends the target request to the second application via a network connection. In some embodiments, the application identity token can be a signed token generated based on OTP (One-Time Password) or JWT (JSON Web Token). This example embodiment does not specifically limit the specific generation method of the application identity token. In some embodiments, the application identity token has an expiration period, and the validity period is less than or equal to a preset duration threshold.
[0025] S104, in response to the second application receiving the target request, the first application intercepts the target request through the second aspect corresponding to the second application, performs caller authentication on the first application, if the caller authentication is successful, performs two-factor authentication based on the application identity token, if the two-factor authentication is successful, the target request is allowed, if the two-factor authentication is unsuccessful, the target request is rejected.
[0026] In some embodiments, the entry point of the second aspect is located at the application entry point of the second application (e.g., API gateway, login interface, etc.). In response to the second application receiving a target request, the second aspect listens for the target request sent by the first application to the second application through the proxy layer, intercepts the target request, and first performs caller authentication on the first application. The caller authentication is used to authenticate the caller of the target request, i.e., the first application or the current user of the first application. The authentication methods include, but are not limited to, traditional authentication methods such as password authentication, authentication code authentication, fingerprint authentication, and face authentication. This example embodiment does not make any special limitations on this.
[0027] In some embodiments, if the caller's identity authentication fails, the target request is directly rejected. If the caller's identity authentication succeeds, two-factor authentication is performed based on the application identity token carried in the target request. Two-factor authentication refers to an additional authentication process (i.e., secondary authentication) beyond traditional caller identity authentication, specifically authenticating the application identity token carried in the target request. In some embodiments, before authenticating the application identity token, it is determined whether the application identity token is valid (i.e., not expired). Authentication is only performed if the application identity token is valid (i.e., not expired). If the application identity token is invalid (i.e., expired), the target request is rejected. In some embodiments, an authentication method bound to the application identity token's generation method is used to authenticate the application identity token. The authentication method and generation method of the application identity token are bound together; application identity tokens generated in different ways correspond to different authentication methods.
[0028] In some embodiments, if two-factor authentication is successful, i.e., if the application identity token is authenticated, the target request will be allowed; if two-factor authentication is not successful, i.e., if the application identity token is not authenticated, the target request will be rejected.
[0029] According to the embodiments of this specification, a non-intrusive inter-application MFA based on aspects is proposed. A two-factor authentication layer is dynamically embedded in the inter-application call chain to achieve dual authentication of "caller identity + dynamic token". When an application initiates a request, token information is automatically carried through aspect instrumentation. After the target application receives the request, it authenticates the token information in the request before allowing the request to continue, thereby effectively preventing identity impersonation at the application layer. Moreover, by using aspect technology, the original application architecture can be kept unchanged, which can both ensure security and significantly reduce the transformation cost.
[0030] In some embodiments, performing two-factor authentication based on the application identity token includes: determining whether the target request requires two-factor authentication; if so, performing two-factor authentication based on the application identity token. In some embodiments, after the caller's identity is authenticated, it is first determined whether the target request requires two-factor authentication. Two-factor authentication is only performed based on the application identity token if required; otherwise, the target request is allowed. For example, a risk engine can be used to perform a dynamic risk assessment of the target request, and the assessment result can be used to determine whether the target request requires two-factor authentication. For example, if the assessment result indicates that the target request involves a high-risk scenario, it is determined that the target request requires two-factor authentication; if the assessment result indicates that the target request involves a low-risk scenario, it is determined that the target request does not require two-factor authentication.
[0031] In some embodiments, determining whether the target request requires two-factor authentication includes: obtaining a target operation associated with the target request; and determining whether the target request requires two-factor authentication based on the target operation. In some embodiments, the target operation associated with the target request can be obtained based on the request information of the target request, wherein the request information includes, but is not limited to, request type, request content, request identifier, and request object. This example embodiment does not impose any special limitations on this. For example, the request information of the target request can be matched with preset operation rules, and the target operation associated with the target request can be determined based on the matching result. Alternatively, a preset mapping relationship can be used to map the operation mapped by the request information of the target request as the target operation associated with the target request. In some embodiments, whether the target request requires two-factor authentication can be determined based on the operation information of the target operation, wherein the operation information includes, but is not limited to, operation type, operation content, operation identifier, and operation object. This example embodiment does not impose any special limitations on this. For example, whether the target request requires two-factor authentication can be determined based on whether the operation information of the target operation contains preset keywords or text similar to preset keywords. Alternatively, semantic analysis of the operation information of the target operation can be used to determine whether the target request requires two-factor authentication.
[0032] In some embodiments, determining whether the target request requires two-factor authentication based on the target operation includes: determining whether the target request requires two-factor authentication based on the operation sensitivity of the target operation. In some embodiments, the operation sensitivity of the target operation can be in numerical form, in which case the operation sensitivity can be compared with a preset threshold or a preset numerical range, and the determination of whether the target request requires two-factor authentication is based on the comparison result. In some embodiments, the operation sensitivity of the target operation can be in text form (e.g., a string), in which case the determination of whether the target request requires two-factor authentication can be based on the similarity between the operation sensitivity and at least one preset text; alternatively, the determination of whether the target request requires two-factor authentication can be based on whether the operation sensitivity is one of at least one preset string; or alternatively, the determination of whether the target request requires two-factor authentication can be based on the model output by inputting the operation sensitivity into a trained model.
[0033] In some embodiments, determining whether the target request requires two-factor authentication includes: determining whether the target request requires two-factor authentication based on whether the target request conforms to preset behavioral standards. In some embodiments, the target request's conformity to preset behavioral standards can be determined based on its request information, including but not limited to request type, request content, request identifier, request object, and request time. This example embodiment does not impose any special limitations on this. In some embodiments, the target request's conformity to preset behavioral standards can be determined based on whether its request information contains preset keywords or text similar to preset keywords. For example, semantic analysis of the target request's request information can also be used to determine whether the target request conforms to preset behavioral standards. In some embodiments, the target request's conformity to preset behavioral standards can be determined based on its request information and the request information of a preset number of other requests sent by the first application to the second application before the target request. Alternatively, the target request's conformity to preset behavioral standards can be determined based on its request information and the request information of other requests sent by the first application to the second application within a preset time range before the target request.
[0034] In some embodiments, determining whether the target request requires two-factor authentication includes: determining whether the target request requires two-factor authentication based on the first device zone corresponding to the first application and the second device zone corresponding to the second application. In some embodiments, a device zone refers to a method of dividing and managing the physical space of a hard disk in partitioned storage technology. By dividing the physical space of the hard disk into multiple independent zones, each zone can be independently configured with different performance or data management strategies. In some embodiments, the determination of whether the target request requires two-factor authentication can be based on the first device zone where the first application is located and the second device zone where the second application is located. For example, it can be determined whether the first device zone has permission to send a request to the second device zone according to a first preset rule. If it has permission, the target request does not need two-factor authentication; if it does not have permission, the target request needs two-factor authentication. Another example is to determine whether the request call level of the first device zone is greater than or equal to the request call level of the second device zone according to a second preset rule. If it is, the target request does not need two-factor authentication; if not, the target request needs two-factor authentication.
[0035] In some embodiments, determining whether the target request needs two-factor authentication based on the first device region corresponding to the first application and the second device region corresponding to the second application includes: determining whether the target request needs two-factor authentication based on whether the first device region corresponding to the first application and the second device region corresponding to the second application are the same device region. In some embodiments, if the first device region where the first application is located and the second device region where the second application is located are the same device region, it is determined that the target request does not need two-factor authentication; if they are not the same device region, it is determined that the target request needs two-factor authentication.
[0036] In some embodiments, the method further includes: if it is determined that the target request does not require two-factor authentication, allowing the target request to proceed. In some embodiments, if it is determined that the target request does not require two-factor authentication, the target request is directly allowed to proceed.
[0037] In some embodiments, the method further includes: if two-factor authentication is successful, generating a target authorization token, binding the target authorization token to the session information of the first application in the second application, and providing the target authorization token to the first application, wherein the validity period of the target authorization token is less than or equal to a preset threshold. In some embodiments, if two-factor authentication is successful, a short-term valid target authorization token is generated (i.e., the validity period of the target authorization token is less than or equal to a preset threshold), the target authorization token is bound to the session information of the first application in the second application, and then the target authorization token is provided to the first application. The purpose is to allow the first application to send subsequent requests to the second application within the validity period of the target authorization token without needing to perform two-factor authentication based on the application identity token in the request, so that frequent authentication is not required within the validity period, reducing the performance overhead caused by two-factor authentication. However, for security purposes, an expiration period is required, and two-factor authentication needs to be performed again based on the application identity token in the request after the expiration period.
[0038] In some embodiments, the step of performing two-factor authentication based on the application identity token to allow the target request includes: determining whether the target request contains the target authorization token; if so, determining whether the target authorization token is bound to the session information of the first application at the second application; if so, allowing the target request; if the target request does not contain the target authorization token, or if the target authorization token is not bound to the session information of the first application at the second application, performing two-factor authentication based on the application identity token. In some embodiments, when intercepting the target request through the first aspect, in addition to carrying the application identity token corresponding to the first application in the target request, if the second application provides the target authorization token to the first application, the target authorization token will also be carried in the target request; or, the validity of the target authorization token will be determined first, and the target authorization token will only be carried in the target request if it is valid. In some embodiments, after intercepting the target request through the second aspect and performing caller authentication on the first application, if the caller authentication is successful, it is determined whether the target request contains a target authorization token. If it does not contain one, two-factor authentication is performed based on the application identity token in the target request. Otherwise, it is determined whether the application identity token is bound to the session information of the first application in the second application. If it is, the target request is allowed to pass directly. If it is not bound, two-factor authentication is performed based on the application identity token.
[0039] Figure 2 This is a flowchart illustrating a method for processing requests, provided as an embodiment of this specification.
[0040] like Figure 2As shown, application A initiates a request. The corresponding aspect of application A intercepts the request, generates a token, and carries the token in the request. Application A then transmits the request to application B over the network. Application B receives the request, and its corresponding aspect intercepts the request, performing caller authentication on the first application. If authentication is successful, it determines whether two-factor authentication is required. If not, the request is allowed normally. If so, a two-factor authentication process is performed based on the token in the request. If authentication is successful, the request is allowed normally; if authentication fails, the request is rejected.
[0041] Figure 3 This is a schematic diagram of a device for processing requests provided in an embodiment of this specification. This device (hereinafter referred to as "request processing device 1") can be implemented as all or part of an electronic device through software, hardware, or a combination of both. According to some embodiments, the request processing device 1 includes a request initiation module 11 and a request receiving module 12.
[0042] The request initiation module 11 is used to intercept the target request through a first aspect corresponding to the first application in response to the first application initiating a target request to the second application, and to carry the application identity token corresponding to the first application in the target request, so that the first application sends the target request to the second application. The request receiving module 12 is used to respond to the second application receiving the target request, intercept the target request through the second aspect corresponding to the second application, perform caller authentication on the first application, and if the caller authentication is successful, perform two-factor authentication based on the application identity token. If the two-factor authentication is successful, the target request is allowed; if the two-factor authentication is unsuccessful, the target request is rejected.
[0043] In some embodiments, performing two-factor authentication based on the application identity token includes: determining whether the target request requires two-factor authentication; if so, performing two-factor authentication based on the application identity token.
[0044] In some embodiments, determining whether the target request requires two-factor authentication includes: obtaining a target operation associated with the target request; and determining whether the target request requires two-factor authentication based on the target operation.
[0045] In some embodiments, determining whether the target request needs two-factor authentication based on the target operation includes: determining whether the target request needs two-factor authentication based on the operation sensitivity of the target operation.
[0046] In some embodiments, determining whether the target request needs to undergo two-factor authentication includes: determining whether the target request needs to undergo two-factor authentication based on whether the target request meets preset behavioral standards.
[0047] In some embodiments, determining whether the target request needs to undergo two-factor authentication includes: determining whether the target request needs to undergo two-factor authentication based on the first device region corresponding to the first application and the second device region corresponding to the second application.
[0048] In some embodiments, determining whether the target request needs to undergo two-factor authentication based on the first device region corresponding to the first application and the second device region corresponding to the second application includes: determining whether the target request needs to undergo two-factor authentication based on whether the first device region corresponding to the first application and the second device region corresponding to the second application are the same device region.
[0049] In some embodiments, the request processing device 1 is further configured to: if it is determined that the target request does not require two-factor authentication, allow the target request.
[0050] In some embodiments, the request processing device 1 is further configured to: generate a target authorization token if two-factor authentication is passed, bind the target authorization token to the session information of the first application at the second application, and provide the target authorization token to the first application, wherein the validity period of the target authorization token is less than or equal to a preset threshold.
[0051] In some embodiments, performing two-factor authentication based on the application identity token and allowing the target request includes: determining whether the target request contains the target authorization token; if so, determining whether the target authorization token is bound to the session information of the first application in the second application; if so, allowing the target request; if the target request does not contain the target authorization token, or if the target authorization token is not bound to the session information of the first application in the second application, performing two-factor authentication based on the application identity token.
[0052] The above-described apparatus embodiments correspond to the aforementioned method embodiments. For detailed descriptions, please refer to the description in the method embodiments section; further details will not be repeated here. The apparatus embodiments are derived from the corresponding method embodiments and have the same technical effects. For detailed descriptions, please refer to the corresponding method embodiments.
[0053] This specification also provides a computer storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in this specification.
[0054] This specification also provides a computer program product that stores at least one instruction, which is loaded by the processor and executes the method described in this specification embodiment.
[0055] This specification also provides an electronic device, including a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and execute the method described in the embodiments of this specification.
[0056] The embodiments in this specification also provide Figure 4 The diagram shows the structure of the electronic device. Figure 4 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement the above method.
[0057] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.
[0058] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0059] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0060] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0061] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0062] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0063] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.
[0064] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.
[0065] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.
Claims
1. A method for processing a request, comprising: In response to a first application sending a target request to a second application, the target request is intercepted through a first aspect corresponding to the first application, and the target request carries the application identity token corresponding to the first application, so that the first application sends the target request to the second application. In response to the second application receiving the target request, the first application intercepts the target request through the second aspect corresponding to the second application, performs caller authentication on the first application, and performs two-factor authentication based on the application's identity token if the caller authentication is successful. If the two-factor authentication is successful, the target request is allowed; if the two-factor authentication is unsuccessful, the target request is rejected.
2. The method according to claim 1, wherein the two-factor authentication based on the application identity token includes: Determine whether the target request requires two-factor authentication; If so, perform two-factor authentication based on the application identity token.
3. The method according to claim 2, wherein determining whether the target request requires two-factor authentication includes: Obtain the target operation associated with the target request; Determine whether the target request requires two-factor authentication based on the target operation.
4. The method according to claim 3, wherein determining whether the target request requires two-factor authentication based on the target operation includes: Whether the target request needs two-factor authentication is determined based on the operational sensitivity of the target operation.
5. The method according to claim 3, wherein determining whether the target request requires two-factor authentication includes: Based on whether the target request meets the preset behavioral criteria, determine whether the target request needs to undergo two-factor authentication.
6. The method according to claim 3, wherein determining whether the target request requires two-factor authentication includes: Based on the first device region corresponding to the first application and the second device region corresponding to the second application, determine whether the target request needs to undergo two-factor authentication.
7. The method according to claim 6, wherein determining whether the target request needs two-factor authentication based on the first device region corresponding to the first application and the second device region corresponding to the second application includes: Whether the target request needs to undergo two-factor authentication is determined based on whether the first device region corresponding to the first application and the second device region corresponding to the second application are the same device region.
8. The method according to claim 4, further comprising: If it is determined that the target request does not require two-factor authentication, the target request is allowed.
9. The method according to claim 1, further comprising: If a target authorization token is generated through two-factor authentication, the target authorization token is bound to the session information of the first application in the second application, and the target authorization token is provided to the first application, wherein the validity period of the target authorization token is less than or equal to a preset threshold.
10. The method according to claim 9, wherein performing two-factor authentication based on the application identity token and allowing the target request comprises: Determine whether the target request contains the target authorization token; If so, determine whether the target authorization token is bound to the session information of the first application at the second application; If so, grant the requested target; If the target request does not contain the target authorization token, or if the target authorization token is not bound to the session information of the first application at the second application, two-factor authentication is performed based on the application identity token.
11. An apparatus for processing a request, comprising: The request initiation module is used to respond to a target request initiated by a first application to a second application, intercept the target request through a first aspect corresponding to the first application, and carry the application identity token corresponding to the first application in the target request, so that the first application sends the target request to the second application; The request receiving module is configured to, in response to the second application receiving the target request, intercept the target request through the second aspect corresponding to the second application, perform caller authentication on the first application, and if the caller authentication is successful, perform two-factor authentication based on the application's identity token. If the two-factor authentication is successful, allow the target request; if the two-factor authentication is unsuccessful, reject the target request.
12. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 10.
13. An electronic device, characterized in that, include: A processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method as claimed in any one of claims 1 to 10.
14. A computer program product having at least one instruction stored thereon, characterized in that, When the at least one instruction is executed by the processor, it implements the steps of the method according to any one of claims 1 to 10.