Method for determining access token, access method, device, equipment and medium
Patent Information
- Application Number
- CN202510561483.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-29
- Publication Date
- 2026-10-30
AI Technical Summary
[0004]本申请的多个方面提供一种访问令牌的确定方法、访问方法、装置、设备及介质，用以解决现有确定访问令牌的方法存在安全性较低的问题
[0055]本申请实施例提供的访问令牌的确定方法、访问方法、装置、设备及介质，该方法包括：获取签名信息和凭证信息，签名信息用于表示目标服务器的身份信息，凭证信息用于表示客户端的身份信息；向授权服务器发送令牌请求，令牌请求携带签名信息和凭证信息；接收授权服务器发送的访问令牌，访问令牌是授权服务器响应于令牌请求，对签名信息和凭证信息认证通过后生成的。本申请通过在令牌请求中附加额外的目标服务器的签名信息，来实现对令牌请求的二次认证，这样子即使客户端的凭证信息发生了泄露，攻击者也无法从授权服务器中获取访问令牌，提高了确定访问令牌的安全性。
Smart Images
Figure CN123020059A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method for determining an access token, an access method, an apparatus, a device, and a medium. Background Technology
[0002] M2M (Machine-to-Machine) communication refers to the technology that enables direct data exchange and collaborative work between machines through communication technologies. M2M communication is widely used in automation, the Internet of Things (IoT), and cloud computing. Because M2M communication involves the exchange of sensitive data, ensuring the security of M2M interactions is crucial.
[0003] Currently, M2M communication uses access tokens to achieve secure data exchange, but existing methods for determining access tokens have low security. Summary of the Invention
[0004] This application provides a method, access method, apparatus, device, and medium for determining an access token, in order to address the problem of low security in existing methods for determining access tokens.
[0005] In a first aspect, embodiments of this application provide a method for determining an access token, applied to a client deployed on a target server, the method comprising:
[0006] Obtain signature information and credential information. The signature information is used to represent the identity information of the target server, and the credential information is used to represent the identity information of the client.
[0007] Send a token request to the authorization server, the token request carrying signature information and credential information;
[0008] Receive the access token sent by the authorization server. The access token is generated by the authorization server in response to the token request after authenticating the signature information and credential information.
[0009] In one possible design, obtaining signature information includes:
[0010] Send a signature request to the target server;
[0011] Receive the signature information sent by the target server in response to the signature request.
[0012] In one possible design, the signature request carries the identification information of the authorizing server, which instructs the target server to generate signature information for the authorizing server.
[0013] In one possible design, the target server includes a cloud server, and the signature information includes instance identifier signature information of the cloud server, which is used to instruct the client to be deployed in a specified account on the cloud server.
[0014] In one possible design, the target server includes a cluster server, and the signature information includes a temporary token generated by a container on the cluster server.
[0015] In one possible design, the signature information is carried in the message header of the token request.
[0016] Secondly, embodiments of this application provide a method for determining an access token, applied to an authorization server, the method comprising:
[0017] Receive a token request sent by the client. The token request carries signature information and credential information. The client is deployed on the target server. The signature information is used to represent the identity information of the target server, and the credential information is used to represent the identity information of the client.
[0018] In response to a token request, authenticate the signature information and credential information;
[0019] An access token is generated once the signature and credentials are successfully authenticated.
[0020] Send an access token to the client.
[0021] Thirdly, embodiments of this application provide a method for determining an access token, applied to a target server, wherein a client is deployed on the target server, and the method includes:
[0022] Receive signature requests sent by clients;
[0023] In response to the signature request, determine the signature information;
[0024] The system sends a signature to the client, which represents the identity of the target server. The client then sends a token request to the authorization server to obtain an access token. The token request carries the signature and credential information.
[0025] Fourthly, embodiments of this application provide an access method applied to a client, the method comprising:
[0026] Send an access request to the resource server, the access request carrying an access token, the access token being determined by any of the methods in the first aspect above;
[0027] Receive access data sent by the resource server. The access data is generated by the resource server in response to the access request after the access token has been successfully authenticated.
[0028] Fifthly, embodiments of this application provide an access token determination device, applied to a client, the client being deployed on a target server, the device comprising:
[0029] The acquisition module is used to acquire signature information and credential information. The signature information is used to represent the identity information of the target server, and the credential information is used to represent the identity information of the client.
[0030] The sending module is used to send a token request to the authorization server. The token request carries signature information and credential information.
[0031] The receiving module is used to receive the access token sent by the authorization server. The access token is generated by the authorization server in response to the token request after authenticating the signature information and credential information.
[0032] Sixthly, embodiments of this application provide an access token determination device, applied to an authorization server, the device comprising:
[0033] The receiving module is used to receive token requests sent by the client. The token request carries signature information and credential information. The client is deployed on the target server. The signature information is used to represent the identity information of the target server, and the credential information is used to represent the identity information of the client.
[0034] The authentication module is used to respond to token requests and authenticate signature and credential information.
[0035] The generation module is used to generate an access token after the signature information and credential information have been successfully authenticated.
[0036] The sending module is used to send access tokens to clients.
[0037] In a seventh aspect, embodiments of this application provide an access token determination device, applied to a target server, the device comprising:
[0038] The receiving module is used to receive signature requests sent by the client;
[0039] The determination module is used to determine the signature information in response to a signature request;
[0040] The sending module is used to send signature information to the client. The signature information is used to represent the identity information of the target server. The client is used to send a token request to the authorization server to obtain an access token. The token request carries signature information and credential information.
[0041] Eighthly, embodiments of this application provide an access device applied to a client, the device comprising:
[0042] The sending module is used to send an access request to the resource server. The access request carries an access token, which is determined according to any of the methods in the first aspect above.
[0043] The receiving module is used to receive access data sent by the resource server. The access data is generated by the resource server in response to the access request after the access token is successfully authenticated.
[0044] Ninthly, embodiments of this application provide an access token determination system, comprising: a client, an authorization server, and a target server, wherein:
[0045] The client is used to send a signature request to the target server;
[0046] The target server responds to the signature request, determines the signature information, and sends the signature information to the client. The signature information is used to represent the identity information of the target server.
[0047] The client is used to obtain credential information and send a token request to the authorization server. The credential information is used to represent the client's identity information, and the token request carries signature information and credential information.
[0048] The authorization server, in response to a token request, generates an access token after verifying the signature and credential information, and sends the access token to the client.
[0049] In a tenth aspect, embodiments of this application provide a server, including: a memory, a transceiver, and a processor;
[0050] The transceiver is used to interact with other servers;
[0051] The memory stores instructions that the computer executes;
[0052] The processor executes computer execution instructions stored in memory, causing the processor to perform the methods shown in the possible designs of the first to fourth aspects.
[0053] Eleventhly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, are used to implement the methods shown in the possible designs of the first to fourth aspects.
[0054] In a twelfth aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, is used to implement the methods shown in the possible designs of the first to fourth aspects.
[0055] This application provides an access token determination method, access method, apparatus, device, and medium. The method includes: acquiring signature information and credential information, where the signature information represents the identity information of the target server and the credential information represents the identity information of the client; sending a token request to an authorization server, the token request carrying the signature information and credential information; and receiving an access token sent by the authorization server, the access token being generated by the authorization server in response to the token request after authenticating the signature information and credential information. This application achieves secondary authentication of the token request by attaching additional signature information of the target server to the token request. This way, even if the client's credential information is leaked, attackers cannot obtain the access token from the authorization server, thus improving the security of determining the access token. Attached Figure Description
[0056] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:
[0057] Figure 1 A flowchart illustrating the method for determining access tokens provided by existing technologies;
[0058] Figure 2 A schematic diagram illustrating a scenario for the method of determining an access token provided in an embodiment of this application;
[0059] Figure 3 A flowchart illustrating an embodiment of the method for determining an access token provided in this application.
[0060] Figure 4 A flowchart illustrating a second embodiment of the method for determining access tokens provided in this application.
[0061] Figure 5 This application provides an illustration of the configuration trusted environment information provided in its embodiments. Figure 1 ;
[0062] Figure 6 A flowchart illustrating Embodiment 3 of the method for determining access tokens provided in this application;
[0063] Figure 7 This application provides an illustration of the configuration trusted environment information provided in its embodiments. Figure 2 ;
[0064] Figure 8 A flowchart illustrating an embodiment of the access method provided in this application;
[0065] Figure 9 A schematic diagram of the structure of an embodiment of the access token determination device provided in this application;
[0066] Figure 10 A schematic diagram of the structure of the access token determination device according to an embodiment of this application;
[0067] Figure 11 A schematic diagram of the structure of the access token determination device according to embodiment three of this application;
[0068] Figure 12 This is a schematic diagram of the structure of an access device according to an embodiment of this application;
[0069] Figure 13 This is a schematic diagram of the server structure provided in an embodiment of this application. Detailed Implementation
[0070] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with relevant laws, regulations, and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.
[0071] Next, the scenarios involved in this application will be introduced.
[0072] The main application scenarios of M2M communication are as follows: (1) service to service; (2) daemon process to backend service; (3) client to backend service; (4) IoT (Internet of Things) device authorization; (5) external API (Application Programming Interface) authorization.
[0073] In service-to-service scenarios, M2M communication involves two sub-parts: authentication and authorization. Unlike typical applications, M2M communication does not involve user participation. Therefore, user-based identity trust and authorization methods are ineffective. Common authentication methods such as (username, password), QR code scanning, and WebAuthn (a network authentication protocol) are unusable in this M2M communication scenario. Current common solutions rely on determining access tokens to meet the authentication and authorization requirements of M2M communication.
[0074] Reference Figure 1 This is a flowchart illustrating a method for accessing related technologies, including the following steps:
[0075] S11, the client sends a signature request to the authorization server.
[0076] The signature request carries credential information.
[0077] S12, the client receives the access token sent by the authorization server.
[0078] S13, the client sends an access request to the resource server.
[0079] The access request carries an access token.
[0080] S14, the resource server returns the access result to the client.
[0081] exist Figure 1 In related technologies, after implementing M2M communication capabilities, the authorization server can support client authentication using credential information and issue corresponding access tokens to the client. However, in practical applications, it has been found that if the client's credential information is leaked, attackers can obtain the access tokens issued by the authorization server and perform malicious access.
[0082] To address the aforementioned issues, relevant technologies offer the following two solutions: (1) Replace the client's credential information so that the client does not need to hold credential information, but the client still only has single authentication information when initiating an authorization request. (2) When the client initiates an authorization request to the authorization server, the authorization request carries DPoP (Demonstrated Proof of Possession) information. This protects the access token from being used if it is stolen because DPoP information cannot be generated. However, if the client's credential information is leaked, the attacker can initiate an authorization request that only carries credential information instead of one that carries DPoP information, thus obtaining a usable access token.
[0083] Based on the above-mentioned technical problems, the inventive concept of this application is as follows: by attaching additional signature information of the target server to the token request, secondary authentication of the token request is achieved. In this way, even if the client's credential information authentication credentials are leaked, attackers will not be able to obtain the access token from the authorization server, thereby improving the security of determining the access token.
[0084] Based on this Figure 2 This is a schematic diagram illustrating a scenario for the method of determining an access token provided in an embodiment of this application. For example... Figure 2 The diagram illustrates an access token determination system 20, which includes a client 21, a target server 22, and an authorization server 23. The client 21 is deployed on the target server, the target server 22 provides signature information to the client, and the authorization server 23 is the server that provides the access token to the client.
[0085] Furthermore, in Figure 2 In the system 20 for determining access tokens, there is also a resource server 24, which is a server that provides access data to clients.
[0086] In practical applications, client 21 is an application deployed on target server 22 to provide services to users. Client 21 corresponds to resource server 24 and can obtain data from resource server to provide services to users.
[0087] The target server 22 is pre-configured with signature information that identifies the target server. The target server 22 can provide the signature information to the client 21 based on the signature request from the client 21.
[0088] The authorization server 23 is pre-configured with the credential information and signature information corresponding to the client 21. After the client 21 sends the credential information and signature information to the authorization server 23, the authorization server 23 can compare whether the credential information and signature information sent by the client 21 matches its own pre-configured credential information and signature information. If they match, the authorization server 23 sends an access token to the client 21.
[0089] The resource server 24 stores data in advance. After receiving the access request sent by the client 21, it authenticates the access token carried in the access request. If the authentication is successful, it can provide the access data to the client 21.
[0090] It should be understood that the specific implementation steps and principles of the above process will be described in detail in the following embodiments, and will not be repeated here.
[0091] It should be understood that, in a real-world scenario, there is no limit to the number of clients 21 and the number of servers (target server 22, authorization server 23, and resource server 24). Figure 1 The explanation uses only one terminal device 21, one target server 22, one authorization server 23, and one resource server 24. The specific number of clients 21 and the number of each server can be determined according to the actual situation.
[0092] The technical solutions shown in this application will be described in detail below through specific embodiments. It should be noted that the following embodiments may exist independently or in combination with each other, and the same or similar content will not be described again in different embodiments.
[0093] Figure 3 This is a flowchart illustrating an embodiment of the method for determining access tokens provided in this application. Figure 3 As shown, the method for determining this access token can be implemented through the following steps:
[0094] S31. The client obtains signature information and credential information.
[0095] The embodiments of this application can be used with OAuth2, which is an authorization framework that allows third-party applications to obtain partial access permissions.
[0096] The client is deployed on the target server. The target server may be a cloud server or a cluster server.
[0097] In some embodiments, the signature information is used to represent the identity information of the target server. This signature information may be pre-configured and fixed in the target server, or it may be temporarily generated by the target server.
[0098] In some embodiments, credential information is used to represent the client's identity information. This credential information includes either a client_secret (client password) or a private_key (private key), where the client_secret is a static credential held by the client to prove its identity. The private_key can be a private key credential held by the client to prove its identity.
[0099] The credential information is pre-stored on the client side, and the client can retrieve the pre-stored credential information when it needs to access the resource server.
[0100] In some embodiments, obtaining signature information includes: the client sending a signature request to the target server; and the client receiving signature information sent by the target server in response to the signature request.
[0101] It is understandable that the client obtains the signature information from the target server.
[0102] The client is deployed on the target server. When the client needs to access the resource server, it can send a signature request to the target server to obtain the signature information in real time, thereby further ensuring the security of the confirmed access token.
[0103] S32, the client sends a token request to the authorization server.
[0104] In this embodiment of the application, the authorization server can be an EIAM (Enterprise Identity Access Management) product.
[0105] The token request includes signature and credential information.
[0106] In some embodiments, the signature information is carried in the HTTP header of the token request. It is understood that carrying the signature information in the header of the token request makes minimal changes to the original token request, which facilitates the implementation of this step.
[0107] Furthermore, signature information can also be carried in other locations in the token request, without limitation here.
[0108] S33, the authorization server responds to the token request and generates an access token after successfully authenticating the signature and credential information.
[0109] In some embodiments, the credential information is client_secret, which can be authenticated using client_secret_basic (an OAuth 2.0 authentication method), client_secret_post (an OAuth 2.0 authentication method), or client_secret_jwt (an OAuth 2.0 authentication method) to authenticate the client's identity.
[0110] In some embodiments, the credential information is a private_key, and the private_key can be authenticated using the public key corresponding to the private_key to achieve authentication of the client's identity.
[0111] In this process, signature information can be pre-configured on the authorization server. After the authorization server receives the signature information, it can compare the received signature information with the pre-configured signature information. If the comparison is consistent, the signature information authentication is successful.
[0112] It is understandable that the authorization server generates an access token when both the signature information and the credential information are successfully authenticated.
[0113] The algorithm can be pre-configured on the authorization server side, and an access token can be generated based on the algorithm. This application does not limit the method of generating the access token.
[0114] S34, the client receives the access token sent by the authorization server.
[0115] This application prevents attackers from obtaining access tokens by protecting the acquisition of access tokens.
[0116] It is understood that in this application, the client needs to be deployed in a trusted environment (target server) in order to obtain the access token generated by the authorization server. The client cannot obtain the access token if it is deployed on other servers.
[0117] In this application embodiment, compared to Figure 1 The relevant authentication methods shown in this application are as follows: Figure 1 Based on the existing authentication method, this application adds the signature information of the target server deployed on the client. After the client's credential information is leaked, attackers cannot obtain the access token through this credential information. Therefore, this application can improve the security of determining the access token.
[0118] Figure 4 This is a flowchart illustrating a second embodiment of the method for determining access tokens provided in this application. Figure 4 As shown, the method for determining this access token can be implemented through the following steps:
[0119] S41, the client sends a signature request to the cloud server.
[0120] The target server includes a cloud server, meaning the client is deployed on a cloud server (ECS, Elastic Container Service), and the client sends a signature request to the cloud server.
[0121] In some embodiments, the signature request carries the identification information of the authorization server. It is understood that the identification information of the authorization server can be specified in the signature request, and this identification information is used to instruct the target server to generate signature information for the authorization server; that is, the signature information generated by the target server is used to make a token request to the authorization server.
[0122] S42, the cloud server responds to the signature request and determines the instance identifier signature information.
[0123] The instance identifier signature information is used to indicate the specific account on the cloud server where the client is deployed.
[0124] In this embodiment, the instance identifier signature information includes: the specific cloud server where it is deployed, and the designated account under the cloud server. Furthermore, the instance identifier signature information may also include: the location information of the cloud server.
[0125] For example, the instance identifier signature information includes: XX cloud server, account-id, and Hangzhou. This can be understood as the client being deployed on the account-id of the XX cloud server, located in Hangzhou. Here, account-id is a specific account on the XX cloud server, and the client is deployed on this account-id.
[0126] S43, the client receives instance identifier signature information sent by the cloud server.
[0127] In addition, the client also obtains credential information. The specific implementation process for obtaining credential information can be found in S31, and will not be elaborated here.
[0128] S44, the client sends a token request to the authorization server.
[0129] The token request carries: credential information and instance identifier signature information.
[0130] In some embodiments, the instance identifier signature information is carried in the header of the token request. It is understood that carrying the instance identifier signature information in the header of the token request makes minimal changes to the original token request, thus facilitating the implementation of this step.
[0131] Furthermore, instance identifier signature information can also be carried in other locations in the token request, without limitation here.
[0132] S45, the authorization server responds to the token request and generates an access token after verifying the credential information and instance identifier signature information.
[0133] In this embodiment of the application, the authorization server needs to authenticate the instance identifier signature information and credential information. After successful authentication, the authorization server determines an access token.
[0134] This includes pre-configuring the client's trusted environment information on the authorization server. This trusted environment information includes, for example... Figure 5 As shown, Figure 5 In this context, the client's trusted environment information includes: the trusted environment is XX cloud server, the specified account is 12345678, and the specified region is Hangzhou. Therefore, the authorized server can only provide access tokens to the client if the client is deployed on the cloud server corresponding to the trusted environment information.
[0135] The authentication method for credential information can be found in S33, and will not be elaborated here.
[0136] S46, the client receives the access token sent by the authorization server.
[0137] The access token is determined by the authorization server based on the instance identifier signature information and credential information.
[0138] It is understandable that when a client is deployed on a cloud server, it can attach the corresponding instance identifier signature information to the HTTP header when requesting an access token from the authorization server, thereby enhancing the security of obtaining the access token.
[0139] In summary, this application can precisely limit access token acquisition to clients deployed under specific accounts on cloud servers in a specified region, thereby improving the security of obtaining access tokens.
[0140] Figure 6 This is a flowchart illustrating Embodiment 3 of the method for determining access tokens provided in this application. Figure 6 As shown, the method for determining this access token can be implemented through the following steps:
[0141] S61, the client sends a signature request to the cluster server.
[0142] In this embodiment, the client is deployed on a cluster server, such as a Kubernetes cluster (an open-source application for managing containerized applications across multiple hosts in a cloud platform). Specifically, the client can be deployed within a container on the cluster server. The client sends a signature request to that container on the cluster server.
[0143] The signature request carries the identification information of the authorization server. This identification information instructs the container to generate signature information for the authorization server.
[0144] S62, the container responds to the signature request and determines a temporary token.
[0145] In this embodiment of the application, the temporary token represents the identity information of the container.
[0146] Specifically, a temporary token, namely a temporary Service Account Token, can be obtained based on the ServiceAccount mechanism of the cluster server. This temporary ServiceAccount Token can be used to prove that the client is deployed in a container on the specified cluster server.
[0147] S63, the client receives a temporary token sent by the container.
[0148] In addition, the client also obtains credential information. The specific implementation process for obtaining credential information can be found in S301, and will not be elaborated here.
[0149] S64, the client sends a token request to the authorization server.
[0150] The token request includes: credential information and a temporary token.
[0151] In some embodiments, a temporary token is carried in the header of the token request. It is understood that carrying a temporary token in the header of the token request makes minimal changes to the original token request, thus facilitating the implementation of this step.
[0152] In addition, temporary tokens may be carried in other locations where token requests are made, without limitation.
[0153] In S65, the authorization server responds to the token request by generating an access token after verifying the credential information and the temporary token.
[0154] Reference Figure 7 The trusted environment information of the client can be pre-configured on the authorization server. This trusted environment information is as follows: Figure 7 As shown, Figure 7 In this context, the client's trusted environment information includes: the cluster URL is Https: / / www.example.com / oidc, the namespace is APP-release (the client's installer), and the service account name is Proof-for-eiam (the proof of EIAM). Therefore, the authorization server can only provide access tokens to the client if the client is deployed in a container of the cluster server corresponding to this trusted environment information.
[0155] S66, the client receives the access token sent by the authorization server.
[0156] When the client is deployed on a cluster server, it can attach a corresponding temporary token to the HTTP header when requesting an access token from the authorization server, thereby enhancing the security of obtaining the access token.
[0157] In summary, this application can precisely limit the access tokens to clients deployed in specified containers on a cluster server, thereby improving the security of obtaining access tokens.
[0158] Furthermore, in Figure 3 , Figure 4 or Figure 6 Based on any one of them, refer to Figure 8 This provides an access method, which can be implemented through the following steps:
[0159] S81, the client sends an access request to the resource server.
[0160] The access request carries an access token.
[0161] It is understandable that, in the above steps, after obtaining the access token, the client can send an access request to the resource server to request access to data.
[0162] S82, the client receives access data sent by the resource server.
[0163] Upon receiving an access request, the resource server responds by authenticating the access token. Once the access token is successfully authenticated, access data is sent to the client, indicating the access result.
[0164] In this embodiment of the application, since the client can obtain an access token in a secure manner and access the resource server based on the access token, secure access can be achieved, avoiding malicious access to the resource server.
[0165] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.
[0166] Figure 9 A schematic diagram of the structure of an embodiment of the access token determination device provided in this application is shown below. Figure 9 As shown, the access token determining device 90 is applied to a client deployed on a target server. The access token determining device 90 includes:
[0167] The acquisition module 91 is used to acquire signature information and credential information. The signature information is used to represent the identity information of the target server, and the credential information is used to represent the identity information of the client.
[0168] Sending module 92 is used to send a token request to the authorization server. The token request carries signature information and credential information.
[0169] The receiving module 93 is used to receive the access token sent by the authorization server. The access token is generated by the authorization server in response to the token request after authenticating the signature information and credential information.
[0170] In one possible implementation, module 91 is specifically used for:
[0171] Send a signature request to the target server;
[0172] Receive the signature information sent by the target server in response to the signature request.
[0173] In one possible implementation, the signature request carries the identification information of the authorizing server, which instructs the target server to generate signature information for the authorizing server.
[0174] In one possible implementation, the target server includes a cloud server, and the signature information includes instance identifier signature information of the cloud server, which is used to instruct the client to be deployed in a specified account on the cloud server.
[0175] In one possible implementation, the target server includes a cluster server, and the signature information includes a temporary token generated by a container on the cluster server.
[0176] In one possible implementation, the signature information is carried in the message header of the token request.
[0177] The access token determination device provided in this application embodiment can execute the technical solution shown in the above client-side method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.
[0178] Figure 10 A schematic diagram of the structure of the access token determination device according to an embodiment of this application is shown below. Figure 10 As shown, the access token determining device 100 is applied to the authorization server, and the access token determining device 100 includes:
[0179] The receiving module 101 is used to receive a token request sent by the client. The token request carries signature information and credential information. The client is deployed on the target server. The signature information is used to represent the identity information of the target server, and the credential information is used to represent the identity information of the client.
[0180] Authentication module 102 is used to respond to token requests and authenticate signature information and credential information;
[0181] The generation module 103 is used to generate an access token after the signature information and credential information have been successfully authenticated.
[0182] The sending module 103 is used to send access tokens to the client.
[0183] The access token determination device provided in this application embodiment can execute the technical solution shown in the above-described authorization server-side method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.
[0184] Figure 11 A schematic diagram of the structure of the access token determination device according to embodiment three of this application is shown below. Figure 11 As shown, the access token determining device 110 is applied to the target server, and the access token determining device 110 includes:
[0185] The receiving module 111 is used to receive the signature request sent by the client;
[0186] Module 112 is used to determine signature information in response to a signature request;
[0187] The sending module 113 is used to send signature information to the client. The signature information is used to represent the identity information of the target server. The client is used to send a token request to the authorization server to obtain an access token. The token request carries signature information and credential information.
[0188] The access token determination device provided in this application embodiment can execute the technical solution shown in the above-described method embodiment on the target server side. Its implementation principle and beneficial effects are similar, and will not be repeated here.
[0189] Figure 12 This is a schematic diagram of the structure of an access device according to an embodiment of this application, as shown in the diagram. Figure 12 As shown, the access device 120 is applied to the target server, and the access device 120 includes:
[0190] The sending module 121 is used to send an access request to the resource server. The access request carries an access token, which is determined according to the method described above.
[0191] The receiving module 122 is used to receive access data sent by the resource server. The access data is generated by the resource server in response to the access request after the access token is successfully authenticated.
[0192] The access device provided in this application embodiment can execute the technical solution shown in the above-described method embodiment on the target server side. Its implementation principle and beneficial effects are similar, and will not be repeated here.
[0193] In addition, refer to Figure 2 This application also provides an access token determination system 20, comprising: a client 21, an authorization server 23, and a target server 22, wherein:
[0194] Client 21 is used to send a signature request to the target server;
[0195] Target server 22 is used to respond to the signature request, determine the signature information, and send the signature information to the client. The signature information is used to represent the identity information of the target server.
[0196] Client 21 is used to obtain credential information and send a token request to the authorization server. The credential information is used to represent the client's identity information, and the token request carries signature information and credential information.
[0197] Authorization server 23 is used to respond to token requests, generate access tokens after authenticating signature and credential information, and send access tokens to clients.
[0198] The access token determination system provided in this application embodiment can execute the technical solution shown in the corresponding method embodiment above. Its implementation principle and beneficial effects are similar, and will not be repeated here.
[0199] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software through processing element calls, or entirely in hardware. Alternatively, some modules can be implemented through processing element calls in software, while others are implemented in hardware. Moreover, these modules can be fully or partially integrated together, or implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. During implementation, each step of the above method or each of the above modules can be completed through the integrated logic circuits in the hardware of the processor element or through software instructions.
[0200] Figure 13 This is a schematic diagram of the structure of a server provided in an embodiment of this application. The server can be... Figure 1 The target server, authorization server, or resource server shown is as follows: Figure 13 As shown, the server may include a processor 131, a memory 132, and a transceiver 133. Exemplarily, the processor 131, memory 132, and transceiver 133 are interconnected via a system bus 134.
[0201] Transceiver 133 is used to interact with other servers.
[0202] Memory 132 stores computer-executed instructions.
[0203] The processor 131 executes computer execution instructions stored in the memory 132, causing the processor 131 to perform the access token determination method as described in the above server-side method embodiment.
[0204] Optionally, the various devices of the server can be connected via system bus 134.
[0205] The server provided in this application embodiment can be used to execute the access token determination method as shown in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described again here.
[0206] It should be understood that the processor can be a CPU, or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this application can be directly manifested as being executed by a hardware processor, or being executed by a combination of hardware and software modules within the processor.
[0207] The system bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the diagram, but this does not indicate that there is only one bus or one type of bus. Memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.
[0208] Accordingly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the access token determination method of the above method embodiments.
[0209] Accordingly, embodiments of this application may also provide a computer program product, including a computer program, which, when executed by a processor, can implement the access token determination method shown in the above method embodiments.
[0210] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0211] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0212] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0213] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0214] In a typical configuration, a computing device (server or electronic device) includes one or more processors, input / output interfaces, network interfaces, and memory.
[0215] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0216] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), SRAM, dynamic random access memory (DRAM), other types of RAM, read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0217] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0218] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. A method for determining an access token, characterized in that, Applied to a client deployed on a target server, the method includes: Obtain signature information and credential information, wherein the signature information is used to represent the identity information of the target server and the credential information is used to represent the identity information of the client; Send a token request to the authorization server, the token request carrying the signature information and the credential information; The system receives an access token sent by the authorization server, which is generated by the authorization server in response to the token request after authenticating the signature information and the credential information.
2. The method according to claim 1, characterized in that, The acquisition of signature information includes: Send a signature request to the target server; Receive the signature information sent by the target server in response to the signature request.
3. The method according to claim 2, characterized in that, The signature request carries the identification information of the authorization server, which instructs the target server to generate the signature information for the authorization server.
4. The method according to claim 2 or 3, characterized in that, The target server includes a cloud server, and the signature information includes instance identifier signature information of the cloud server, which is used to instruct the client to be deployed in a specified account on the cloud server.
5. The method according to claim 2 or 3, characterized in that, The target server includes a cluster server, and the signature information includes a temporary token generated by a container on the cluster server.
6. The method according to any one of claims 1 to 3, characterized in that, The signature information is carried in the header of the token request.
7. A method for determining an access token, characterized in that, Applied to an authorization server, the method includes: The client receives a token request sent by a client, the token request carrying signature information and credential information, the client being deployed on a target server, the signature information representing the identity information of the target server, and the credential information representing the identity information of the client; In response to the token request, authenticate the signature information and the credential information; If the signature information and the credential information are successfully authenticated, the access token is generated; Send the access token to the client.
8. A method for determining an access token, characterized in that, Applied to a target server, on which a client is deployed, the method includes: Receive the signature request sent by the client; In response to the signature request, the signature information is determined; The client sends signature information to the client, the signature information being used to represent the identity information of the target server. The client then sends a token request to the authorization server to obtain an access token, the token request carrying the signature information and credential information.
9. An access method, characterized in that, Applied to a client, the method includes: Send an access request to the resource server, the access request carrying an access token, the access token being determined by the method according to any one of claims 1 to 6; The system receives access data sent by the resource server, which is generated by the resource server in response to the access request after successfully authenticating the access token.
10. A device for determining an access token, characterized in that, Applied to a client, the client being deployed on a target server, the device includes: The acquisition module is used to acquire signature information and credential information, wherein the signature information is used to represent the identity information of the target server and the credential information is used to represent the identity information of the client. The sending module is used to send a token request to the authorization server, wherein the token request carries the signature information and the credential information; The receiving module is used to receive the access token sent by the authorization server. The access token is generated by the authorization server in response to the token request after authenticating the signature information and the credential information.
11. A device for determining an access token, characterized in that, Applied to an authorization server, the device includes: A receiving module is used to receive a token request sent by a client. The token request carries signature information and credential information. The client is deployed on a target server. The signature information is used to represent the identity information of the target server, and the credential information is used to represent the identity information of the client. The authentication module is used to authenticate the signature information and the credential information in response to the token request; A generation module is used to generate the access token if the signature information and the credential information are successfully authenticated. The sending module is used to send the access token to the client.
12. A device for determining an access token, characterized in that, Applied to a target server, the device includes: A receiving module is used to receive a signature request sent by the client; The determination module is used to determine signature information in response to the signature request; The sending module is used to send signature information to the client, the signature information being used to represent the identity information of the target server. The client is used to send a token request to the authorization server to obtain an access token, the token request carrying the signature information and credential information.
13. An access device, characterized in that, Applied to a client, the device includes: A sending module is configured to send an access request to a resource server, the access request carrying an access token, the access token being determined by the method according to any one of claims 1 to 6; The receiving module is used to receive access data sent by the resource server, the access data being generated by the resource server in response to the access request after the access token has been successfully authenticated.
14. A system for determining an access token, characterized in that, include: Client, authorization server, and target server, where: The client is used to send a signature request to the target server; The target server is configured to respond to the signature request, determine signature information, and send the signature information to the client, wherein the signature information is used to represent the identity information of the target server; The client is used to obtain credential information and send a token request to the authorization server. The credential information is used to represent the client's identity information, and the token request carries the signature information and the credential information. The authorization server, in response to the token request, generates an access token after successfully authenticating the signature information and the credential information, and sends the access token to the client.
15. A server, characterized in that, include: Memory, transceiver, and processor; The transceiver is used to interact with other servers; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method for determining the access token as described in any one of claims 1 to 8 and / or the access method as described in claim 9.
16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method for determining the access token as described in any one of claims 1 to 8 or the access method as described in claim 9.
17. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it is used to implement the method for determining the access token as described in any one of claims 1 to 8 or the access method as described in claim 9.