Data access verification method, storage medium and program product

Abstract

The embodiment of the invention provides a data access verification method, a storage medium and a program product. According to the method, first timestamp information is included in a generation basis of a first signature verification and temporary identity verification voucher, the timeliness of a timestamp enables an intercepted data packet to be invalid along with time lapse, and the temporary identity verification voucher is an exclusive voucher generated by combining a first identity identifier, a first data identifier, the first timestamp information and a first signature. The replication and reuse are difficult, so that the replay attack is resisted; the first signature covers authenticity and integrity verification of data access core key information and cooperates with a double verification process of a subsequent temporary identity verification certificate, so that the risk that data is tampered and stolen is greatly reduced; and meanwhile, the temporary identity verification certificate is generated based on the specific user and the corresponding data, and is only effective for the current authorized access behavior, so that accurate authorization is realized, the data exposure range is reduced, and the security of data access is comprehensively improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data access verification method, storage medium, and program product. Background Technology

[0002] In the field of internet services, the security of data access interfaces is a core requirement for ensuring user privacy and system stability.

[0003] In existing technologies, the security verification of data access interfaces mostly adopts a single signature mechanism: the client signs the identity identifier and sends it to the server, and the server only verifies the validity of the signature to confirm that the request has not been tampered with.

[0004] However, attackers can intercept request packets containing legitimate signatures and resend the request at any time. Since the server only verifies the validity of the signature, it cannot identify expired requests, resulting in the data being illegally accessed repeatedly. Summary of the Invention

[0005] This application provides a data access verification method, storage medium, and program product to improve the security of data access.

[0006] In a first aspect, embodiments of this application provide a data access verification method, comprising:

[0007] Obtain the user's first identity identifier, first data identifier, first timestamp information, and first signature. The first signature is used to verify the authenticity and integrity of the first identity identifier, first data identifier, and first timestamp information.

[0008] Based on the first identity identifier, the first data identifier, the first timestamp information, and the first signature, determine the user's temporary identity verification credential and send the temporary identity verification credential to the client;

[0009] Obtain the first request information sent by the client. The first request information is used to request data corresponding to the first data identifier in the server. The first request information includes temporary authentication credentials.

[0010] The temporary authentication credential in the first request information is verified. When the temporary authentication credential is verified, the data corresponding to the first data identifier is sent to the client.

[0011] In one possible implementation, second request information sent by the client is obtained, the second request information including the user's first identity identifier, first data identifier and first timestamp information;

[0012] Based on a preset encryption algorithm, the first identity identifier, the first data identifier, the first timestamp information, and the user's preset key are encrypted and calculated to obtain the first signature.

[0013] In one possible implementation, a second identity identifier, a second data identifier, a second timestamp information, and a first signature are extracted from the temporary authentication credentials in the first request information;

[0014] Get the current third timestamp information;

[0015] Determine the timestamp difference between the third timestamp information and the second timestamp information;

[0016] The second signature is determined based on the second identity identifier, the second data identifier, and the second timestamp information;

[0017] Determine the first threshold;

[0018] If the second signature is the same as the first signature and the timestamp difference is less than the first threshold, then the temporary authentication credential is deemed to have been successfully verified.

[0019] In one possible implementation, a first validity parameter of the client is obtained, wherein the first validity parameter is the effective duration of the temporary authentication credential preset by the client;

[0020] Obtain the user's historical request frequency information;

[0021] The second timeliness parameter is determined based on historical request frequency information;

[0022] The first threshold is determined based on the first timeliness parameter and the second timeliness parameter.

[0023] In one possible implementation, the first identity identifier, the first data identifier, the first timestamp information and the first signature are combined according to a preset format to obtain a first combined identifier;

[0024] Obtain the first identifier, which identifies the number of times the temporary authentication credential can be used;

[0025] Based on the first combined identifier and the first identifier, a temporary authentication credential for the user is generated.

[0026] In one possible implementation, the client's device identifier is obtained;

[0027] The equipment identifier is attached to the end of the first combined identifier to obtain the second combined identifier;

[0028] Insert the first identifier into the preset position of the second identifier combination to obtain the user's temporary authentication credentials.

[0029] Secondly, embodiments of this application provide a data access verification device, comprising:

[0030] The acquisition module is used to acquire the user's first identity identifier, first data identifier, first timestamp information and first signature. The first signature is used to verify the authenticity and integrity of the first identity identifier, first data identifier and first timestamp information.

[0031] The determination module is used to determine the user's temporary authentication credentials based on the first identity identifier, the first data identifier, the first timestamp information, and the first signature, and send the temporary authentication credentials to the client.

[0032] The acquisition module is also used to acquire the first request information sent by the client. The first request information is used to request data corresponding to the first data identifier in the server. The first request information includes temporary authentication credentials.

[0033] The verification module is used to verify the temporary authentication credential in the first request information. When the temporary authentication credential is verified, it sends the data corresponding to the first data identifier to the client.

[0034] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0035] The memory stores instructions that the computer executes;

[0036] The processor executes computer execution instructions stored in memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0037] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0038] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0039] The data access verification method, storage medium, and program product provided in this application specifically address the problem that attackers can intercept legitimate signature request data packets and repeatedly send them under the existing single signature mechanism, leading to unauthorized data access. This effectively improves the security of data access. Specifically, the method incorporates first timestamp information into the generation basis of first signature verification and temporary authentication credentials. The timeliness of the timestamp causes intercepted data packets to become invalid over time. Furthermore, the temporary authentication credentials are exclusive credentials generated by combining the first identity identifier, first data identifier, first timestamp information, and first signature, making them difficult to copy and reuse, thus resisting replay attacks. The first signature covers the authenticity and integrity verification of the core key information of data access. Combined with the dual verification process of the subsequent temporary authentication credentials, a security barrier is formed, significantly reducing the risk of data tampering and theft. At the same time, the temporary authentication credentials are generated based on specific users and corresponding data, and are only valid for the current authorized access behavior, achieving precise authorization and reducing the scope of data exposure. Through multi-dimensional collaborative protection, the security of data access is comprehensively improved. Attached Figure Description

[0040] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0041] Figure 1 Flowchart of the data access verification method provided in the embodiments of this application Figure 1 ;

[0042] Figure 2 Flowchart of the data access verification method provided in the embodiments of this application Figure 2 ;

[0043] Figure 3 A schematic diagram of the structure of the data access verification device provided in the embodiments of this application;

[0044] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0045] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0046] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0047] To address the technical problem of attackers intercepting legitimate signature request packets and repeatedly sending them under the existing single-signature mechanism, leading to unauthorized data access, the following technical concept is proposed: First, breaking through the limitation of only verifying identity signatures, the system binds user identity, target data identifier, and timestamp information, and verifies their integrity and authenticity through a first signature. This ensures that core access elements are not tampered with and introduces a time dimension to give the request a "time-sensitive" attribute, eliminating the possibility of unauthorized tampering and unlimited reuse from the source. Second, a temporary identity verification credential is generated based on the above-mentioned bound information. This one-time, personalized verification information serves as the core basis for subsequent data access, replacing the fixed signature. This strongly associates the verification information with the specific access scenario (specific user, specific data, specific time), preventing the credential from being abused across scenarios. Finally, a layered verification process is designed: "Signature verification generates credential → Credential verification opens data." The first layer of verification filters legitimate requests and generates a unique credential, while the second layer of verification accurately matches access permissions, forming a dual security barrier. Ultimately, this achieves comprehensive prevention and control of risks such as replay attacks, data tampering, and unauthorized access, improving the security of data access.

[0048] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0049] Figure 1 Flowchart of the data access verification method provided in the embodiments of this application Figure 1 The methods described above in the embodiments of this application can be applied to any electronic device. For example... Figure 1 As shown, the method includes:

[0050] S101. Obtain the user's first identity identifier, first data identifier, first timestamp information and first signature. The first signature is used to verify the authenticity and integrity of the first identity identifier, first data identifier and first timestamp information.

[0051] The first identity identifier is a unique piece of information used to identify a user, serving as the core basis for distinguishing different access subjects. Common forms include user accounts, ID card numbers, mobile phone numbers, and unique device codes. Its core characteristics are "uniqueness" and "stability," ensuring the system can accurately locate the initiator of the access request. The first data identifier is used to uniquely identify a specific data resource on the server, equivalent to the data's "exclusive address." This can be the primary key ID in the database, file storage path, data resource code, etc. This identifier allows for quick location of the specific data the user needs to access, avoiding data confusion. The first timestamp information records the precise time (usually accurate to seconds or milliseconds) when the user initiates the authentication request, typically in timestamp or time format. Its core function is to add a "time attribute" to the verification information, preventing expired information from being maliciously reused and improving the timeliness of verification.

[0052] Specifically, before initiating a data access request, a user (through the client) must first integrate their own identity information (first identity identifier), target data information (first data identifier), and current request time (first timestamp), and generate a first signature through an encryption algorithm. Then, these four types of information are sent to the server together.

[0053] S102. Based on the first identity identifier, the first data identifier, the first timestamp information, and the first signature, determine the user's temporary authentication credential and send the temporary authentication credential to the client.

[0054] Temporary authentication credentials are temporary access credentials generated by the server and have a limited validity period. They serve as a "temporary pass" for users to request data subsequently. They typically exist in the form of random strings or tokens and contain information such as user identity digests, data access permissions, and validity periods. Their validity period is much shorter than that of long-term authentication credentials, which reduces the risk of credential leakage.

[0055] Specifically, the system first verifies the legitimacy and completeness of the information through "signature verification." Then, based on pre-defined system rules (such as user permission level, data sensitivity, and current system load), a temporary authentication credential is generated. The core design logic of the temporary authentication credential is "least privilege + short validity": on the one hand, the credential only contains the minimum permissions required to access the target data, avoiding excessive authorization; on the other hand, the credential has a short validity period (such as 5 minutes or 30 minutes), so even if the credential is leaked, the time window available to attackers is extremely short. After generating the credential, the server sends it to the client, providing the basis for the user's subsequent data requests.

[0056] S103. Obtain the first request information sent by the client. The first request information is used to request data corresponding to the first data identifier in the server. The first request information includes a temporary authentication credential.

[0057] The first request information is the data packet submitted by the user when initiating a data access request to the server. Its core content is a temporary authentication credential, and it may also contain auxiliary information such as the request method and data processing requirements to clarify the user's access intent and permission basis.

[0058] Specifically, after obtaining a temporary authentication credential, the client must submit a first request containing that credential to the server within the credential's validity period, explicitly informing the server that it "needs to access the specific data corresponding to the first data identifier." The core function of this step is "permission carrying"—users do not need to submit complete identity and data information again; they can prove their access rights solely through the temporary credential. This simplifies the request process, reduces the number of times core sensitive information is transmitted, and balances efficiency and security.

[0059] S104. Verify the temporary authentication credential in the first request information. When the temporary authentication credential is verified, send the data corresponding to the first data identifier to the client.

[0060] Specifically, after receiving the first request, the server will focus on performing multi-dimensional verification on the temporary authentication credentials. The verification typically includes: credential validity: confirming that the credential was generated by the server and not forged; credential validity: confirming that the credential is still valid and has not expired; permission matching: confirming that the access permissions corresponding to the credential match the first data identifier to prevent unauthorized access; and identity consistency: confirming that the user identity associated with the credential matches the first identity identifier in step 1 to prevent the credential from being stolen. When all verification items pass, it indicates that the user's access request is legitimate and secure. The server will then locate the specific data corresponding to the first data identifier and send it to the client. If the verification fails (e.g., expired credential, permission mismatch), the server will directly reject the request and return the corresponding error message (e.g., "invalid credential" or "insufficient permissions") to ensure that the data is not accessed illegally.

[0061] The data access verification method provided in this application specifically addresses the problem that attackers can intercept legitimate signature request data packets and repeatedly send them under the existing single signature mechanism, leading to unauthorized data access. This effectively improves data access security. Specifically, the method incorporates first timestamp information into the generation basis of first signature verification and temporary authentication credentials. The timeliness of the timestamp causes intercepted data packets to become invalid over time. Furthermore, the temporary authentication credential is a unique credential generated by combining the first identity identifier, first data identifier, first timestamp information, and first signature, making it difficult to copy and reuse, thus resisting replay attacks. The first signature covers the authenticity and integrity verification of core data access information, forming a security barrier in conjunction with the subsequent dual verification process of the temporary authentication credential, significantly reducing the risk of data tampering and theft. Simultaneously, the temporary authentication credential is generated based on a specific user and corresponding data, valid only for the current authorized access behavior, achieving precise authorization and reducing the scope of data exposure. Through multi-dimensional collaborative protection, the security of data access is comprehensively improved.

[0062] Figure 2 Flowchart of the data access verification method provided in the embodiments of this application Figure 2 .like Figure 2 As shown, the method includes:

[0063] S201. Obtain the second request information sent by the client. The second request information includes the user's first identity identifier, first data identifier, and first timestamp information.

[0064] Specifically, the client first integrates the user's primary identity identifier (such as employee ID), primary data identifier (such as target data code), and current primary timestamp information to form a secondary request message, which is then sent to the server. The message sent at this stage does not contain a signature, reducing the risk of exposing core encrypted information during transmission.

[0065] S202. Based on a preset encryption algorithm, the first identity identifier, the first data identifier, the first timestamp information, and the user's preset key are encrypted and calculated to obtain the first signature.

[0066] The preset encryption algorithm is a pre-agreed encryption rule between the server and the client, serving as a unified standard for generating and verifying signatures. Common examples include symmetric encryption algorithms, asymmetric encryption algorithms, or hash encryption algorithms, ensuring consistency in signature processing logic between the two parties. The user's preset key is a unique key that the user pre-registers or configures in the system. It is divided into a symmetric key (shared by the server and the user) and an asymmetric key (the user holds a private key, and the server holds a public key). This is the "core cryptography" for signature generation, ensuring that signatures can only be generated by legitimate users or the server.

[0067] Specifically, after receiving the second request information, the server invokes a pre-agreed encryption algorithm with the client, encrypting the first identity identifier, first data identifier, first timestamp information, and the user's preset key as a whole to obtain the first signature. The introduction of the preset key strongly binds the signature to the user—even if the original data is stolen, a valid signature cannot be generated without the key, significantly improving security.

[0068] S203. Based on the first identity identifier, the first data identifier, the first timestamp information, and the first signature, determine the user's temporary identity verification credential and send the temporary identity verification credential to the client.

[0069] In one possible implementation, according to a preset format, the first identity identifier, the first data identifier, the first timestamp information and the first signature are combined to obtain a first combined identifier; the first identifier is obtained, which is used to identify the number of times the temporary authentication credential can be used; and the user's temporary authentication credential is generated based on the first combined identifier and the first identifier.

[0070] The preset format consists of server-side pre-defined information combination rules, specifying the order and separators of the first identity identifier, first data identifier, first timestamp information, and first signature (e.g., "identity identifier|data identifier|timestamp|signature") to ensure the standardization of the combined identifiers. The first combined identifier is a string formed by combining core verification information according to the preset format; it is the "core data carrier" of the temporary credential, containing key information required for identity verification. The first identifier is also a "usage limit flag" for the temporary credential, used to specify the maximum number of data access requests that the credential can initiate (e.g., "1" represents only one use, "5" represents five uses), preventing the credential from being repeatedly misused.

[0071] Specifically, the server concatenates the first identity identifier, first data identifier, first timestamp information, and first signature according to a preset format (such as specifying separators and information order) to form a structurally unified first combined identifier, facilitating subsequent parsing and verification. The server determines the maximum number of times the temporary credential can be used based on factors such as data sensitivity and user permission level, generating the first identifier accordingly. For example, the number of uses for highly sensitive data (such as original contracts) is set to 1, while for ordinary data (such as product descriptions) it is set to 5. The server integrates the first combined identifier with the first identifier (through methods such as concatenation or encrypted nesting) to form the final temporary credential, which contains both identity verification information and clearly defines the usage limit.

[0072] In one possible implementation, the device identifier of the client is obtained; the device identifier is appended to the end of the first combined identifier to obtain the second combined identifier; the first identifier is inserted into a preset position of the second combined identifier to obtain the user's temporary authentication credential.

[0073] The device identifier is a unique identifier for the client device, such as the device code of a mobile phone, the device address of a computer, or the unique identifier of a browser. It possesses the characteristic of "device uniqueness" and is used to bind temporary credentials to a specific device. The second combined identifier is a new combined identifier formed by appending the device identifier to the end of the first combined identifier, achieving the association and binding of "user identity - target data - device information". The preset position is a server-preset insertion position for the first identifier (such as the beginning, a specific index in the middle, or the end of the second combined identifier) ​​to ensure a consistent credential structure and facilitate rapid extraction of usage frequency information during subsequent parsing.

[0074] Specifically, when the server receives a client request, it synchronously obtains the client's unique identifier. This identifier can be actively reported by the client or obtained by the server through technical means (such as reading device hardware information). The server appends the obtained device identifier to the end of the first combined identifier to form a second combined identifier, associating the credential with a specific device and preventing the credential from being reused on other devices. The server inserts the first identifier (with usage limits) at a preset position in the second combined identifier (such as after the 10th character or before the end), forming a structurally complete temporary authentication credential.

[0075] S204. Obtain the first request information sent by the client. The first request information is used to request data corresponding to the first data identifier in the server. The first request information includes a temporary authentication credential.

[0076] S205. Verify the temporary authentication credential in the first request information. When the temporary authentication credential is verified, send the data corresponding to the first data identifier to the client.

[0077] In one possible implementation, a second identity identifier, a second data identifier, a second timestamp information, and a first signature are extracted from the temporary authentication credential in the first request information; the current third timestamp information is obtained; the timestamp difference between the third timestamp information and the second timestamp information is determined; a second signature is determined based on the second identity identifier, the second data identifier, and the second timestamp information; a first threshold is determined; if the second signature is the same as the first signature and the timestamp difference is less than the first threshold, then the temporary authentication credential is determined to be verified successfully.

[0078] The second identity identifier / second data identifier / second timestamp information is the identity, data, and time information carried in the temporary credential. It is essentially the same as the first identity identifier / first data identifier / first timestamp information mentioned above, distinguished only by its name due to the different storage medium (first request information). Since it is unknown whether it has been tampered with, it is used for comparison with the original information recorded by the server. The third timestamp information is the current timestamp when the server receives the first request information, serving as the "baseline time" for determining whether the temporary credential has expired. The timestamp difference is the difference between the third timestamp and the second timestamp (usually in seconds or milliseconds), reflecting the time interval from the generation of the temporary credential to its use, and is a core indicator for timeliness verification. The second signature is a signature regenerated by the server based on the second identity identifier, second data identifier, and second timestamp information extracted from the temporary credential, used for comparison with the first signature carried in the credential to verify the authenticity of the information. The first threshold is the "upper limit of the effective time" of the temporary credential, i.e., the maximum allowed value of the timestamp difference. Exceeding this value invalidates the credential. This threshold is preset or dynamically generated by the system according to business needs.

[0079] Specifically, after receiving the first request information containing the temporary credential, the server first parses the credential, extracting the second identity identifier, second data identifier, second timestamp information, and first signature, providing a data foundation for subsequent verification. The server records the precise time of receiving the first request information and generates a third timestamp, which serves as the benchmark for judging the credential's validity. The third timestamp is subtracted from the second timestamp to obtain the timestamp difference, determining the duration the credential has existed. The server calls the same encryption algorithm used to generate the first signature, generating a second signature based solely on the extracted second identity identifier, second data identifier, and second timestamp information (no need to reuse the key, as the credential is already associated with user information), used to verify whether the original information has been tampered with. The server obtains a preset or dynamically generated first threshold (e.g., 300 seconds, i.e., 5 minutes) as the criterion for judging the timestamp difference. If "the second signature is completely consistent with the first signature" (confirming that the information has not been tampered with and the source is legitimate) and "the timestamp difference is less than the first threshold" (confirming that the credential has not expired), then the credential verification passes; if either condition is not met, the verification fails.

[0080] In one possible implementation, a first validity parameter of the client is obtained, which is the effective duration of a temporary authentication credential preset by the client; historical request frequency information of the user is obtained; a second validity parameter is determined based on the historical request frequency information; and a first threshold is determined based on the first validity parameter and the second validity parameter.

[0081] The first validity parameter is the basic validity period of a temporary credential preset by the client based on its business needs, reflecting the client's basic requirements for credential timeliness. Historical request frequency information is data recorded by the server on the frequency of users' past data access requests, such as "an average of 10 requests per day" or "once every 5 minutes during peak hours," reflecting users' access habits. The second validity parameter is a dynamic validity adjustment value generated based on the user's historical request frequency, used to adjust the first validity parameter—the second validity parameter can be slightly larger for high-frequency request users (to avoid frequent re-acquisition of credentials), and slightly smaller for low-frequency users (to enhance security).

[0082] Specifically, when the server receives a request from the client, it synchronously retrieves the client's preset first timeliness parameter, which serves as the basis for generating the first threshold. The server retrieves the current user's historical request records from the user behavior database, statistically analyzing frequency characteristics such as the number of requests and request intervals within a unit of time. The server then converts the historical request frequency into a second timeliness parameter using a preset algorithm (such as calculating the average request interval or setting a frequency threshold). For example, the second timeliness parameter for high-frequency users (average request interval of 2 minutes) is 120 seconds, while for low-frequency users (average request interval of 10 minutes) it is 60 seconds. The server determines the final first threshold through weighted calculations (such as the first timeliness parameter accounting for 70% and the second timeliness parameter accounting for 30%) or by taking a reasonable range (such as the average or minimum of the two), ensuring that the threshold meets both client security requirements and user access habits.

[0083] The data access verification method provided in this application specifically addresses the problem that attackers can intercept legitimate signature request data packets and repeatedly send them under the existing single signature mechanism, leading to unauthorized data access. This effectively improves data access security. Specifically, the method incorporates first timestamp information into the generation basis of first signature verification and temporary authentication credentials. The timeliness of the timestamp causes intercepted data packets to become invalid over time. Furthermore, the temporary authentication credential is a unique credential generated by combining the first identity identifier, first data identifier, first timestamp information, and first signature, making it difficult to copy and reuse, thus resisting replay attacks. The first signature covers the authenticity and integrity verification of core data access information, forming a security barrier in conjunction with the subsequent dual verification process of the temporary authentication credential, significantly reducing the risk of data tampering and theft. Simultaneously, the temporary authentication credential is generated based on a specific user and corresponding data, valid only for the current authorized access behavior, achieving precise authorization and reducing the scope of data exposure. Through multi-dimensional collaborative protection, the security of data access is comprehensively improved.

[0084] By clarifying the core logic of "generating the first signature based on the user's preset key," the method of obtaining core verification information is refined. Its core beneficial effects are reflected in strengthening security and process standardization in multiple dimensions: The introduction of the exclusive core element of "user preset key" strongly binds the first signature to the individual user. Since the preset key is only known to legitimate users and the server, even if an attacker steals publicly available information, they cannot generate a valid signature, fundamentally improving the signature's anti-forgery capability. The transmission of core verification information is split into "unsigned second request information" and "server-generated signature." The client only sends basic information and does not transmit the signature containing the key, reducing the frequency of exposure of core encrypted information and lowering transmission risks. At the same time, the signature generation rules "based on preset encryption algorithms" are clarified, ensuring logical consistency between the server and client, avoiding verification failures, and allowing abnormal signatures to be traced through key-based identity verification and algorithm-based traceability.

[0085] By constructing a dual verification mechanism of "signature verification + timestamp verification," the verification logic of temporary credentials has been refined. Its core benefits are reflected in the dual improvement of security protection and process optimization: combining "signature consistency verification" and "timestamp difference verification" to form a complementary defense line, signature verification ensures the authenticity and integrity of information, while timestamp verification ensures the timeliness of credentials to avoid expired reuse. This forces attackers to overcome two barriers, significantly improving the security level of credentials and effectively resisting attacks such as tampering and expiration abuse. By comparing "timestamp difference" with "first threshold," dynamic timeliness control is achieved, strictly limiting the time window for credential utilization, compressing the scope of security risk impact from a time perspective, and improving the dynamic security of data access. At the same time, the specific verification steps are specified in detail, providing clear and executable operational standards for credential verification, avoiding misjudgment problems caused by logical ambiguity, improving the accuracy and consistency of verification results, and reducing R&D and operation and maintenance risks.

[0086] By proposing a dynamic rule that "generates a first threshold by combining client-side preset parameters with user historical behavior," the limitations of fixed thresholds are overcome. Its core benefits lie in balancing security and user experience, and improving system adaptability: Through a weighted design of "first-time-sensitive parameter (ensuring security) + second-time-sensitive parameter (adapting to user experience)," the dilemma of "security and user experience being mutually exclusive" in traditional fixed thresholds is resolved. This allows for a moderately extended threshold for high-frequency users to reduce repetitive operations, while maintaining a shorter threshold for low-frequency users to enhance security, achieving an optimal balance between the two. Using the frequency of user historical requests as a key basis for threshold generation enables the first threshold to dynamically adapt to different user access habits, forming a "personalized" control model that fits actual business scenarios and avoids the irrationality of a "one-size-fits-all" approach. Simultaneously, the first-time-sensitive parameter can be flexibly adjusted by the client according to scenario security requirements, and the second-time-sensitive parameter changes dynamically with user behavior. The combination of these two allows the threshold to adapt to both scenario requirements and individual habits, improving the system's adaptability to different industries and user groups, and enhancing the universality and flexibility of the verification scheme.

[0087] By proposing a temporary credential generation rule of "combined identifier + usage limit," the logic of credential composition is refined. Its core benefits are reflected in efficiency improvement, risk control, and management optimization: The first identity identifier, data identifier, timestamp information, and signature are combined into a first combined identifier according to a preset format, making the temporary credential an "aggregated carrier" of core verification information. The server can obtain all verification information by parsing one credential, without multiple database queries, reducing the number of data interactions and improving verification efficiency, especially suitable for high-concurrency scenarios. The introduction of the "first identifier" enables precise control over the frequency of credential access. Highly sensitive data can be set to expire once, while the restriction is appropriately relaxed for ordinary data, avoiding the risk of repeated access to a single credential. Even if the credential is leaked, the number of times attackers can illegally access it is strictly limited, reducing security risks. The preset format and combination rules for credential generation are clearly defined, ensuring that credentials follow a unified structural standard, facilitating server-side parsing, storage, and management. Illegal credentials can be quickly identified through format verification, while reducing the difficulty of cross-system interaction and improving the scalability of the solution.

[0088] By introducing "device identifiers" and optimizing the credential generation structure, the core benefits lie in enhanced security and improved parsing: Integrating the client device identifier into temporary credentials achieves a triple binding of "user identity + target data + access device." Even if the credential and identity information are stolen, non-bound devices will be rejected due to identifier mismatch, forming a more comprehensive security barrier and effectively resisting cross-device abuse attacks. Leveraging the hardware-level uniqueness of device identifiers, even if different users' identities, data, and timestamp information are accidentally duplicated, they can still be distinguished by the device identifier, improving the global uniqueness of credentials and avoiding misauthorization or verification confusion caused by credential collisions, thus ensuring verification accuracy. Clarifying the rule of "inserting the first identifier at the preset position of the second combination identifier" makes the credential structure more regular, allowing the server to quickly locate and extract usage frequency information, prioritize frequency verification, and terminate parsing directly if the number of uses is exhausted, improving the targeting and efficiency of credential parsing and adapting to high-concurrency, fast verification requirements.

[0089] Figure 3 A schematic diagram of the structure of the data access verification device provided in the embodiments of this application is shown below. Figure 3 As shown, the data access verification device 30 provided in this embodiment includes an acquisition module 301, a determination module 302, and a verification model 303.

[0090] The acquisition module 301 is used to acquire the user's first identity identifier, first data identifier, first timestamp information and first signature. The first signature is used to verify the authenticity and integrity of the first identity identifier, first data identifier and first timestamp information.

[0091] The determination module 302 is used to determine the user's temporary authentication credentials based on the first identity identifier, the first data identifier, the first timestamp information, and the first signature, and send the temporary authentication credentials to the client.

[0092] The acquisition module 301 is also used to acquire first request information sent by the client. The first request information is used to request data corresponding to the first data identifier in the server. The first request information includes temporary authentication credentials.

[0093] The verification module 303 is used to verify the temporary authentication credential in the first request information, and when the temporary authentication credential is verified, it sends the data corresponding to the first data identifier to the client.

[0094] In one possible implementation, the acquisition module 301 is specifically used for:

[0095] Obtain the second request information sent by the client, which includes the user's first identity identifier, first data identifier, and first timestamp information;

[0096] Based on a preset encryption algorithm, the first identity identifier, the first data identifier, the first timestamp information, and the user's preset key are encrypted and calculated to obtain the first signature.

[0097] In one possible implementation, the verification module 303 is specifically used for:

[0098] Extract the second identity identifier, second data identifier, second timestamp information, and first signature from the temporary identity verification credential in the first request information;

[0099] Get the current third timestamp information;

[0100] Determine the timestamp difference between the third timestamp information and the second timestamp information;

[0101] The second signature is determined based on the second identity identifier, the second data identifier, and the second timestamp information;

[0102] Determine the first threshold;

[0103] If the second signature is the same as the first signature and the timestamp difference is less than the first threshold, then the temporary authentication credential is deemed to have been successfully verified.

[0104] In one possible implementation, the verification module 303 is specifically used for:

[0105] Obtain the client's first validity parameter, which is the effective duration of the client's preset temporary authentication credential;

[0106] Obtain the user's historical request frequency information;

[0107] The second timeliness parameter is determined based on historical request frequency information;

[0108] The first threshold is determined based on the first timeliness parameter and the second timeliness parameter.

[0109] In one possible implementation, the determining module 302 is specifically used for:

[0110] According to a preset format, the first identity identifier, the first data identifier, the first timestamp information and the first signature are combined to obtain the first combined identifier;

[0111] Obtain the first identifier, which identifies the number of times the temporary authentication credential can be used;

[0112] Based on the first combined identifier and the first identifier, a temporary authentication credential for the user is generated.

[0113] In one possible implementation, the determining module 302 is specifically used for:

[0114] Obtain the client's device identifier;

[0115] The equipment identifier is attached to the end of the first combined identifier to obtain the second combined identifier;

[0116] Insert the first identifier into the preset position of the second identifier combination to obtain the user's temporary authentication credentials.

[0117] The data access verification device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0118] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 40 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the device 40 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus.

[0119] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0120] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0121] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0122] The memory may include high-speed memory (Random Access Memory, RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0123] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0124] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0125] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0126] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0127] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in application-specific integrated circuits (ASICs). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0128] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0129] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0130] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0131] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0132] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0133] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A data access verification method, characterized in that, include: The user's first identity identifier, first data identifier, first timestamp information, and first signature are obtained, and the first signature is used to verify the authenticity and integrity of the first identity identifier, first data identifier, and first timestamp information. Based on the first identity identifier, the first data identifier, the first timestamp information, and the first signature, the user's temporary identity verification credential is determined, and the temporary identity verification credential is sent to the client. Obtain first request information sent by the client, the first request information being used to request data from the server corresponding to the first data identifier, the first request information including the temporary authentication credential; The temporary authentication credential in the first request information is verified, and when the temporary authentication credential is verified, the data corresponding to the first data identifier is sent to the client.

2. The method according to claim 1, characterized in that, The process of obtaining the user's first identity identifier, first data identifier, first timestamp information, and first signature includes: Obtain the second request information sent by the client, the second request information including the user's first identity identifier, first data identifier and first timestamp information; Based on a preset encryption algorithm, the first identity identifier, the first data identifier, the first timestamp information, and the user's preset key are encrypted and calculated to obtain the first signature.

3. The method according to claim 1, characterized in that, The verification of the temporary authentication credential in the first request information includes: Extract the second identity identifier, the second data identifier, the second timestamp information, and the first signature from the temporary identity verification credential in the first request information; Get the current third timestamp information; Determine the timestamp difference between the third timestamp information and the second timestamp information; The second signature is determined based on the second identity identifier, the second data identifier, and the second timestamp information; Determine the first threshold; If the second signature is the same as the first signature, and the timestamp difference is less than the first threshold, then the temporary identity verification credential is determined to be verified successfully.

4. The method according to claim 3, characterized in that, Determining the first threshold includes: Obtain the first validity parameter of the client, where the first validity parameter is the effective duration of the temporary authentication credential preset by the client; Obtain the user's historical request frequency information; Based on the historical request frequency information, a second timeliness parameter is determined; A first threshold is determined based on the first timeliness parameter and the second timeliness parameter.

5. The method according to claim 1, characterized in that, The step of determining the user's temporary authentication credentials based on the first identity identifier, the first data identifier, the first timestamp information, and the first signature includes: According to a preset format, the first identity identifier, the first data identifier, the first timestamp information and the first signature are combined to obtain the first combined identifier; Obtain a first identifier, which is used to identify the number of times the temporary authentication credential can be used; Based on the first combined identifier and the first identifier, a temporary authentication credential for the user is generated.

6. The method according to claim 5, characterized in that, The step of generating the user's temporary authentication credentials based on the first combined identifier and the first identifier includes: Obtain the client's device identifier; The device identifier is appended to the end of the first combined identifier to obtain the second combined identifier; Insert the first identifier at the preset position of the second combined identifier to obtain the user's temporary authentication credential.

7. A data access verification device, characterized in that, include: The acquisition module is used to acquire the user's first identity identifier, first data identifier, first timestamp information and first signature, wherein the first signature is used to verify the authenticity and integrity of the first identity identifier, first data identifier and first timestamp information; The determination module is used to determine the user's temporary authentication credential based on the first identity identifier, the first data identifier, the first timestamp information, and the first signature, and send the temporary authentication credential to the client; The acquisition module is further configured to acquire first request information sent by the client, the first request information being used to request data corresponding to the first data identifier in the server, and the first request information including the temporary authentication credential; The verification module is used to verify the temporary authentication credential in the first request information, and when the temporary authentication credential is verified, to send the data corresponding to the first data identifier to the client.

8. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-6.

Images