An access token verification method, device, equipment and storage medium

Abstract

The application discloses a kind of access token check method, device and equipment and storage medium, belong to token management technical field, the method includes: in the case where it is detected that token check interface is not fused, target access token carried in service request is input token check interface, and target authentication object is obtained;According to the client identifier in target authentication object, obtain client configuration information;According to client configuration information, target authentication object, and the resource required for request and request equipment identifier carried in service request, execute resource range check or equipment identifier check, and after determining that check passes, according to client configuration information, current time, preset delay time and target authentication object, generate token check response message;In the case where it is detected that token check interface is fused, if it is detected that target access token is not empty and its token length is greater than or equal to minimum length threshold, then generate token check response message according to target access token.

Description

Technical Field

[0001] This invention relates to the field of token management technology, and in particular to an access token verification method, apparatus, device, and storage medium. Background Technology

[0002] In high-frequency authentication scenarios, the existing token verification methods of distributed authentication centers have the following problems: First, when the token verification interface is circuit-broken, not only will the authentication object reading fail and regular verification be unable to be performed, but the upstream will also be unable to obtain a usable authentication context, making it difficult to carry out controlled degradation. Second, the return logic of regular verification and fault degradation is not layered, which poses a security risk of misusing degradation responses. Third, the uniform use of the current time plus a fixed validity period to calculate the expiration time will cause a large number of token expiration times and cache write times to be concentrated in a similar period, resulting in token expiration time clustering, which exacerbates the instantaneous load on the system. Summary of the Invention

[0003] This invention provides an access token verification method, apparatus, device, and storage medium to achieve layering of conventional token verification logic and token verification logic under fault degradation scenarios, avoid security risks of misuse of degradation response, alleviate the phenomenon of token expiration time clustering, and thereby reduce the instantaneous system load of the distributed authentication center.

[0004] According to one aspect of the present invention, an access token verification method is provided, the method being executed by a distributed authentication center, comprising: Receive business requests and check whether the token verification interface has been circuit-broken; If the token verification interface is not detected to be blocked, the target access token carried in the business request is input into the token verification interface to obtain the target authentication object; Based on the client identifier in the target authentication object, obtain the client configuration information; the client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period; Based on the client's allowed resource range, device verification enable flag, target authentication object, and the resources required for the request and the request device flag carried in the business request, perform resource range verification or device flag verification, and after confirming that the verification is successful, generate a token verification response message based on the token auto-extension enable flag, token validity period, current time, preset extension time and target authentication object; If the token verification interface is detected to be blocked, and the target access token is detected to be non-empty and its length is greater than or equal to the minimum length threshold, the target access token is decrypted locally to obtain the target field sequence, and a token verification response message is generated based on the target field sequence.

[0005] According to another aspect of the present invention, an access token verification device is provided, which is deployed in a distributed authentication center and includes: The request receiving and token verification interface detection module is used to receive business requests and detect whether the token verification interface has been circuit-broken. The target authentication object determination module is used to input the target access token carried in the business request into the token verification interface to obtain the target authentication object when it is detected that the token verification interface has not been blocked. The client configuration information acquisition module is used to obtain client configuration information based on the client identifier in the target authentication object. The client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period. The first token verification response message generation module is used to perform resource range verification or device identifier verification based on the client's allowed resource range, device verification enable identifier, target authentication object, and the resources required for the request and the request device identifier carried in the business request. After confirming that the verification is successful, it generates a token verification response message based on the token automatic extension enable identifier, token validity period, current time, preset extension time and target authentication object. The second token verification response message generation module is used to decrypt the target access token locally when the token verification interface is detected to be blocked, if the target access token is detected to be non-empty and its token length is greater than or equal to the minimum length threshold, to obtain the target field sequence, and generate a token verification response message based on the target field sequence.

[0006] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and a memory communicatively connected to at least one processor; wherein, The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the access token verification method of any embodiment of the present invention.

[0007] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the access token verification method of any embodiment of the present invention.

[0008] According to another aspect of the present invention, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the access token verification method of any embodiment of the present invention.

[0009] The technical solution of this invention involves a distributed authentication center receiving a service request and detecting whether the token verification interface has been circuit-broken. If the token verification interface has not been circuit-broken, the target access token carried in the service request is input into the token verification interface to obtain the target authentication object. Client configuration information is obtained based on the client identifier in the target authentication object. The client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period. Based on the client's allowed resource range, device verification enable identifier, target authentication object, and the resources required for the request and the request device identifier carried in the service request, resource range verification or device identifier verification is performed. After confirming that the verification is successful, a token verification response message is generated based on the token auto-extension enable identifier, token validity period, current time, preset extension time, and target authentication object. If the token verification interface is circuit-broken, and the target access token is detected to be non-empty and its length is greater than or equal to the minimum length threshold, the target access token is decrypted locally to obtain the target field sequence, and a token verification response message is generated based on the target field sequence. The above technical solution achieves a layered approach between conventional token verification logic and token verification logic in fault degradation scenarios. When the distributed authentication center detects that the token verification interface has been circuit-broken, it processes the target access token locally to obtain a token verification response message. This ensures that the upstream still has a usable authentication context in fault degradation scenarios, facilitating controlled degradation processing by combining the calling interface and risk level. It also distinguishes the capability boundaries between conventional verification and degradation responses, preventing the upstream from mistakenly using degradation results as complete security verification results, thus avoiding the security risk of misuse of degradation responses. Furthermore, when the distributed authentication center detects that the token verification interface has not been circuit-broken and all required verifications have passed, it updates the absolute expiration time of the token in the target authentication object in different ways based on the token auto-extension enable flag, token validity period, current time, and preset extension time. Then, based on the updated absolute expiration time and other authentication fields in the target authentication object, it generates a token verification response message. This avoids a large number of token expiration times coinciding with cache write times, alleviating the token expiration time clustering phenomenon and reducing the instantaneous system load of the distributed authentication center.

[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of an access token verification method provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of an access token verification method provided according to Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the structure of an access token verification device according to Embodiment 3 of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device that implements the access token verification method of this invention. Detailed Implementation

[0013] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0014] It should be noted that the terms "target," "first," and "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0015] Example 1 Figure 1 This is a flowchart of an access token verification method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where a distributed authentication center verifies the access token in a business request. The method can be executed by an access token verification device, which can be implemented in hardware and / or software and can be configured in an electronic device. Figure 1 As shown, this method is executed by a distributed authentication center and includes: S101, Receive service request.

[0016] Specifically, the distributed authentication center receives business requests from the business gateway or business server.

[0017] S102. Check if the token verification interface has been circuit broken.

[0018] The token verification interface refers to an interface provided by the distributed authentication center for accessing token verification.

[0019] Specifically, if the distributed authentication center detects that the token verification interface has not been circuit-broken by the traffic protection component for distributed microservices (such as Sentinel), it executes S103; if the distributed authentication center detects that the token verification interface has been circuit-broken by the traffic protection component for distributed microservices, it executes S106.

[0020] S103. Input the target access token carried in the business request into the token verification interface to obtain the target authentication object.

[0021] The target access token refers to a short-term identity credential carried in the business request and obtained by the client. It should be noted that the target access token is generated as follows: Preset authentication fields are concatenated into a plaintext field sequence in a fixed order using a preset separator; this plaintext field sequence is then symmetrically encrypted to obtain the target access token.

[0022] The preset authentication fields refer to the fields required for subsequent verification of the target access token. Optionally, these fields can be pre-set according to actual business needs. For example, preset authentication fields might include: Client Identifier, Client Name, Token Authorization Resource Scope, Token Scope, Global User Identifier, Token Absolute Expiration Time, and Token Binding Device Identifier. The Token Authorization Resource Scope refers to the set of accessible business resources granted to the target access token when it is issued. The Token Scope refers to the set of executable operations granted to the target access token when it is issued. The Global User Identifier is the unique identifier used to identify users within the distributed authentication center. The Token Absolute Expiration Time is the absolute timestamp at which the target access token expires. The Token Binding Device Identifier is the device identifier bound to the target access token.

[0023] It should be noted that the plaintext field sequence of the target access token must include at least the following authentication fields: client identifier, token authorized resource scope, global user identifier, and token absolute expiration time. The target authentication object refers to the authentication object corresponding to the target access token; optionally, the target authentication object includes the following authentication fields: token authorized resource scope and token bound device identifier. Furthermore, the target authentication object may also include the following authentication fields: client identifier, client name, global user identifier, and token absolute expiration time.

[0024] Specifically, when the distributed authentication center detects that the token verification interface has not been circuit-broken, it inputs the target access token carried in the business request into the token verification interface; the token verification interface uses the target access token as an index to read the target authentication object from the main cache; if the token verification interface does not read the target authentication object from the main cache, it uses the target access token as an index to read the target authentication object from the backup cache and then fills the read target authentication object back into the main cache.

[0025] Understandably, if the token verification interface does not retrieve the target authentication object from the main cache, it retrieves the target authentication object from the backup cache and then populates it back into the main cache. This population operation completes the hot token data in the main cache, allowing subsequent verification requests for the target access token to directly hit the main cache and continue performing complete server-side state verification.

[0026] S104. Obtain client configuration information based on the client identifier in the target authentication object; the client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period.

[0027] The client-allowed resource range refers to the set of business resources that the client is allowed to access. The device verification enable flag is a flag used to indicate whether the device verification function is enabled. It should be noted that if the device verification enable flag is 1, the device verification function is enabled; if the value is 0, the device verification function is disabled. The token auto-renewal enable flag is a flag used to indicate whether the token auto-renewal function is enabled. It should be noted that if the token auto-renewal enable flag is 1, the token auto-renewal function is enabled; if the value is 0, the token auto-renewal function is disabled. The token validity period refers to the total duration of the target access token from issuance to expiration.

[0028] Specifically, the distributed authentication center uses the client identifier in the target authentication object as an index to retrieve client configuration information from the main cache.

[0029] S105. Based on the client's allowed resource range, device verification enable flag, target authentication object, and the resources required for the request and the request device flag carried in the business request, perform resource range verification or device flag verification. After confirming that the verification is successful, generate a token verification response message based on the token auto-extension enable flag, token validity period, current time, preset extension time and target authentication object.

[0030] Here, "resources required for the request" refers to the business resources needed for the business request. "Request device identifier" refers to the device identifier carried in the business request. "Token verification response message" refers to the output message generated by the distributed authentication center after completing the verification process of the target access token; optionally, the token verification response message may include the token verification result and authentication field information.

[0031] Specifically, if the distributed authentication center detects that the device verification enable flag is 1, it performs resource range verification based on the client's allowed resource range, the token authorized resource range, and the resources required by the request carried in the business request. It also performs device identifier verification based on the request device identifier and the token-bound device identifier carried in the business request. If the device verification enable flag is 0, it performs resource range verification based on the client's allowed resource range, the token authorized resource range, and the resources required by the request carried in the business request. After determining that all required verifications have passed, the distributed authentication center generates a token verification response message based on the token auto-extension enable flag, the token validity period, the current time, the preset extension time, and the target authentication object, using a preset verification response message generation algorithm.

[0032] More specifically, if the distributed authentication center detects that the device verification enable flag is 1, it further checks whether the token authorization resource range is within the client's allowed resource range. If the token authorization resource range is not within the client's allowed resource range, the resource range verification fails. If the token authorization resource range is within the client's allowed resource range, and the resources required by the request carried in the business request are within the token authorization resource range, the resource range verification passes. If the token authorization resource range is within the client's allowed resource range, but the resources required by the request carried in the business request are not within the token authorization resource range, the resource range verification fails. Simultaneously, the distributed authentication center compares the request device identifier carried in the business request with the token-bound device identifier. If the request device identifier matches the token-bound device identifier, the device identifier verification passes. If the request device identifier does not match the token-bound device identifier, the device identifier verification fails. Afterward, once the distributed authentication center confirms that both the resource range verification and device identifier verification have passed, it generates a token verification response message based on the token auto-extension enable flag, token validity period, current time, preset extension time, and target authentication object, using a preset verification response message generation algorithm.

[0033] If the distributed authentication center detects that the device verification enable flag is 0, it further checks whether the token authorization resource range is within the client's allowed resource range. If the token authorization resource range is not within the client's allowed resource range, the resource range verification fails. If the token authorization resource range is within the client's allowed resource range, and the resources required by the request carried in the business request are within the token authorization resource range, the resource range verification passes. If the token authorization resource range is within the client's allowed resource range, but the resources required by the request carried in the business request are not within the token authorization resource range, the resource range verification fails. After confirming that the resource range verification has passed, the distributed authentication center generates a token verification response message based on the token auto-extension enable flag, token validity period, current time, preset extension time, and target authentication object, using a preset verification response message generation algorithm.

[0034] S106. If the target access token is detected to be non-empty and its token length is greater than or equal to the minimum length threshold, the target access token is decrypted locally to obtain the target field sequence, and a token verification response message is generated based on the target field sequence.

[0035] The minimum length threshold refers to the pre-set minimum length of the access token. The target field sequence refers to the field sequence obtained after decrypting the target access token.

[0036] Specifically, if the distributed authentication center detects that the token verification interface has been circuit-broken, and further detects that the target access token is not empty and its token length is greater than or equal to the minimum length threshold, it decrypts the target access token locally to obtain the target field sequence. Based on the token's absolute expiration time and the current time in the target field sequence, it determines whether the target access token has expired. If it is determined that the target access token has not expired, it splits the target field sequence to obtain multiple target field values, and generates a token verification response message based on each target field value.

[0037] It should be noted that the key used to decrypt the target access token is the same key used to encrypt the plaintext field sequence of the target access token.

[0038] Specifically, the determination of whether the target access token has expired is based on the absolute expiration time of the token in the target field sequence and the current time. Specifically, if the distributed authentication center detects that the current time is earlier than the absolute expiration time of the token in the target field sequence, it determines that the target access token has not expired; otherwise, it determines that the target access token has expired.

[0039] Specifically, if the target access token is determined to be valid, the target field sequence is split to obtain multiple target field values, and a token verification response message is generated based on each target field value. This includes: the distributed authentication center, after determining that the target access token has not expired, splits the target field sequence according to a preset separator to obtain multiple target field values; and generates a token verification response message according to a preset response message format based on each obtained target field value.

[0040] Optionally, the distributed authentication center may execute S106 if it detects that the token verification interface has not been circuit-broken, but both the main cache and the backup cache have failed.

[0041] Understandably, when the distributed authentication center detects that the token verification interface has been circuit-broken, or if it detects that the token verification interface has not been circuit-broken but both the main cache and backup cache have failed, it generates a token verification response message locally based on the target access token. This allows the center to output a minimum usable authentication context without relying on the main cache and backup cache in fault-tolerant scenarios, thus ensuring that the upstream still obtains a usable authentication context. This facilitates controlled degradation processing by the upstream based on the calling interface and risk level. Furthermore, it distinguishes the capability boundaries between regular verification and degradation responses, preventing the upstream from mistakenly using degradation results as complete security verification results, thereby mitigating the security risks of misuse of degradation responses. In addition, this mechanism prevents all authentication requests from failing directly, mitigating service avalanches caused by faulty traffic, ensuring the controllability of core business pathways in fault-tolerant scenarios, and preventing complete business interruption.

[0042] The technical solution of this invention involves a distributed authentication center receiving a service request and detecting whether the token verification interface has been circuit-broken. If the token verification interface has not been circuit-broken, the target access token carried in the service request is input into the token verification interface to obtain the target authentication object. Client configuration information is obtained based on the client identifier in the target authentication object. The client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period. Based on the client's allowed resource range, device verification enable identifier, target authentication object, and the resources required for the request and the request device identifier carried in the service request, resource range verification or device identifier verification is performed. After confirming that the verification is successful, a token verification response message is generated based on the token auto-extension enable identifier, token validity period, current time, preset extension time, and target authentication object. If the token verification interface is circuit-broken, and the target access token is detected to be non-empty and its length is greater than or equal to the minimum length threshold, the target access token is decrypted locally to obtain the target field sequence, and a token verification response message is generated based on the target field sequence. The above technical solution achieves a layered approach between conventional token verification logic and token verification logic in fault degradation scenarios. When the distributed authentication center detects that the token verification interface has been circuit-broken, it processes the target access token locally to obtain a token verification response message. This ensures that the upstream still has a usable authentication context in fault degradation scenarios, facilitating controlled degradation processing by combining the calling interface and risk level. It also distinguishes the capability boundaries between conventional verification and degradation responses, preventing the upstream from mistakenly using degradation results as complete security verification results, thus avoiding the security risk of misuse of degradation responses. Furthermore, when the distributed authentication center detects that the token verification interface has not been circuit-broken and all required verifications have passed, it updates the absolute expiration time of the token in the target authentication object in different ways based on the token auto-extension enable flag, token validity period, current time, and preset extension time. Then, based on the updated absolute expiration time and other authentication fields in the target authentication object, it generates a token verification response message. This avoids a large number of token expiration times coinciding with cache write times, alleviating the token expiration time clustering phenomenon and reducing the instantaneous system load of the distributed authentication center.

[0043] Example 2 Figure 2 This is a flowchart of an access token verification method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment further optimizes the process of "generating a token verification response message based on the token auto-extension enable flag, token validity period, current time, preset extension time, and target authentication object," providing an optional implementation scheme. It should be noted that parts not detailed in this embodiment can be referred to in other embodiments. Figure 2 As shown, this method is executed by a distributed authentication center and includes: S201, Receive service request.

[0044] S202. Check if the token verification interface has been circuit broken.

[0045] Specifically, if the distributed authentication center detects that the token verification interface has not been circuit-broken, it executes S203; if the distributed authentication center detects that the token verification interface has been circuit-broken, it executes S213.

[0046] S203. Input the target access token carried in the business request into the token verification interface to obtain the target authentication object.

[0047] S204. Obtain client configuration information based on the client identifier in the target authentication object; the client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period.

[0048] S205. Based on the client's allowed resource range, device verification enable flag, target authentication object, and the resources required for the request and the request device flag carried in the business request, perform resource range verification or device flag verification.

[0049] S206. After confirming that the verification is successful, check whether the value of the token auto-delay enable flag is 1.

[0050] Specifically, after the distributed authentication center confirms that all required verifications have passed, if it detects that the value of the token auto-extension enable flag is 1, it means that the token auto-extension function has been started. At this time, the distributed authentication center executes S207; if it detects that the value of the token auto-extension enable flag is 0, it means that the token auto-extension function has not been started. At this time, the distributed authentication center executes S212.

[0051] S207. Determine whether the target access token is about to expire based on the token's validity period, current time, and preset extension time.

[0052] The preset extension time can be set in advance according to actual business needs. For example, the preset extension time can be 3 days. This embodiment of the invention does not specifically limit it.

[0053] Specifically, when the distributed authentication center detects that the value of the token auto-extension enable flag is 1, it adds the current time to the preset extension time to obtain the reference time. The distributed authentication center further checks whether the reference time is within the token's validity period. If the reference time is not within the token's validity period, it determines that the target access token is about to expire and executes S208; otherwise, it determines that the target access token is not about to expire and executes S212.

[0054] S208. Detect whether the current time is during off-peak hours.

[0055] The off-peak period refers to a time period with relatively low business request traffic. It can be preset based on the expert experience of those skilled in the art. For example, the off-peak period can be from 0:00 to 6:59. This embodiment of the invention does not specifically limit it.

[0056] Specifically, when the distributed authentication center detects that the value of the token auto-renewal enable flag is 1 and the target access token is about to expire, it further checks whether the current time is during an off-peak period. If the distributed authentication center detects that the current time is during an off-peak period, it executes S209; if the distributed authentication center detects that the current time is outside of an off-peak period, it executes S211.

[0057] S209. Update the absolute expiration time of the token in the target authentication object based on the current time and the token's expiration time.

[0058] Specifically, when the distributed authentication center detects that the value of the token auto-extension enable flag is 1, the target access token is about to expire, and the current time is during an off-peak period, it adds the current time to the token's validity period to obtain the updated absolute expiration time of the token in the target authentication object.

[0059] S210. Generate a token verification response message based on the updated absolute expiration time of the token and other authentication fields in the target authentication object.

[0060] Specifically, the distributed authentication center generates a token verification response message according to a preset response message format, based on the updated absolute expiration time of the token in the target authentication object, as well as other authentication fields such as client identifier, client name, token authorization resource scope, token scope, global user identifier, and token bound device identifier.

[0061] S211. Update the absolute expiration time of the token in the target authentication object according to the preset off-peak time and token validity period.

[0062] The preset off-peak time can be pre-set based on the expert experience of those skilled in the art. For example, the preset off-peak time can be 0:00 on the next natural day after the current time.

[0063] Specifically, when the distributed authentication center detects that the value of the token auto-extension enable flag is 1, the target access token is about to expire, and the current time is outside of off-peak hours, it obtains a random offset. The random offset, the preset off-peak time, and the token validity period are added together to obtain the updated absolute expiration time of the token in the target authentication object. Then, S210 is executed.

[0064] S212. Generate a token verification response message based on the target authentication object.

[0065] Specifically, when the distributed authentication center detects that the value of the token auto-extension enable flag is 1 and the target access token is not about to expire, or when the value of the token auto-extension enable flag is 0, it generates a token verification response message according to a preset response message format based on the authentication fields in the target authentication object, such as client identifier, client name, token authorization resource scope, token scope, global user identifier, token absolute expiration time, and token bound device identifier.

[0066] S213. If the target access token is detected to be non-empty and its token length is greater than or equal to the minimum length threshold, the target access token is decrypted locally to obtain the target field sequence, and a token verification response message is generated based on the target field sequence.

[0067] Specifically, when the distributed authentication center detects that the token verification interface has been circuit-broken, if it detects that the target access token is not empty and its token length is greater than or equal to the minimum length threshold, it decrypts the target access token locally to obtain the target field sequence, and generates a token verification response message based on the target field sequence.

[0068] The technical solution of this invention involves a distributed authentication center receiving a service request; detecting that the token verification interface has not been circuit-broken; if the token verification interface has not been circuit-broken, inputting the target access token carried in the service request into the token verification interface to obtain the target authentication object; obtaining client configuration information based on the client identifier in the target authentication object; the client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period; performing resource range verification or device identifier verification based on the client's allowed resource range, device verification enable identifier, target authentication object, and the resources required for the request and the request device identifier carried in the service request; after confirming that the verification is successful, checking whether the value of the token auto-extension enable identifier is 1; if the value of the token auto-extension enable identifier is 1, determining whether the target access token is nearing expiration based on the token validity period, current time, and preset extension time; if the target access token is nearing expiration, checking whether the current time is during a low-peak period; if the target access token is nearing expiration and the current time is within a low-peak period... During off-peak hours, update the absolute expiration time of the token in the target authentication object based on the current time and token validity period; generate a token verification response message based on the updated absolute expiration time and other authentication fields in the target authentication object; if the target access token is nearing expiration and the current time is outside of off-peak hours, update the absolute expiration time of the token in the target authentication object based on the preset off-peak time and token validity period; generate a token verification response message based on the updated absolute expiration time and other authentication fields in the target authentication object; if the value of the automatic token extension enable flag is 1 and the target access token is not nearing expiration, or if the value of the automatic token extension enable flag is 0, generate a token verification response message based on the target authentication object; if the token verification interface is detected to be circuit-broken, and if the target access token is not empty and its token length is greater than or equal to the minimum length threshold, decrypt the target access token locally to obtain the target field sequence, and generate a token verification response message based on the target field sequence.The above technical solution achieves a layered approach between conventional token verification logic and token verification logic in fault degradation scenarios. When the distributed authentication center detects that the token verification interface has been circuit-broken, it processes the target access token locally to obtain a token verification response message. This ensures that the upstream still has a usable authentication context in fault degradation scenarios, facilitating controlled degradation processing by combining the calling interface and risk level. It also distinguishes the capability boundaries between conventional verification and degradation responses, preventing the upstream from mistakenly using degradation results as complete security verification results, thus avoiding the security risk of misuse of degradation responses. Furthermore, when the distributed authentication center detects that the token verification interface has not been circuit-broken and all required verifications have passed, it updates the absolute expiration time of the token in the target authentication object in different ways based on the token auto-extension enable flag, token validity period, current time, and preset extension time. Then, based on the updated absolute expiration time and other authentication fields in the target authentication object, it generates a token verification response message. This avoids a large number of token expiration times coinciding with cache write times, alleviating the token expiration time clustering phenomenon and reducing the instantaneous system load of the distributed authentication center.

[0069] Example 3 Figure 3 This is a schematic diagram of an access token verification device provided in Embodiment 3 of the present invention. This embodiment is applicable to situations where a distributed authentication center verifies the access token in a business request. The device can be implemented in hardware and / or software and can be configured in an electronic device. Figure 3 As shown, the device is deployed in a distributed authentication center and includes: The request receiving and token verification interface detection module 301 is used to receive business requests and detect whether the token verification interface has been circuit-broken. The target authentication object determination module 302 is used to input the target access token carried in the business request into the token verification interface to obtain the target authentication object when it is detected that the token verification interface has not been circuit-broken. The client configuration information acquisition module 303 is used to acquire client configuration information based on the client identifier in the target authentication object; the client configuration information includes the client's allowed resource range, device verification enable identifier, token automatic extension enable identifier, and token validity period; The first token verification response message generation module 304 is used to perform resource range verification or device identifier verification based on the client's allowed resource range, device verification enable identifier, target authentication object, and the resources required for the request and the request device identifier carried in the business request. After confirming that the verification is successful, it generates a token verification response message based on the token automatic extension enable identifier, token validity period, current time, preset extension time and target authentication object. The second token verification response message generation module 305 is used to, when the token verification interface is detected to be blocked, if the target access token is detected to be non-empty and its token length is greater than or equal to the minimum length threshold, decrypt the target access token locally to obtain the target field sequence, and generate a token verification response message based on the target field sequence.

[0070] The technical solution of this invention involves a distributed authentication center receiving a service request and detecting whether the token verification interface has been circuit-broken. If the token verification interface has not been circuit-broken, the target access token carried in the service request is input into the token verification interface to obtain the target authentication object. Client configuration information is obtained based on the client identifier in the target authentication object. The client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period. Based on the client's allowed resource range, device verification enable identifier, target authentication object, and the resources required for the request and the request device identifier carried in the service request, resource range verification or device identifier verification is performed. After confirming that the verification is successful, a token verification response message is generated based on the token auto-extension enable identifier, token validity period, current time, preset extension time, and target authentication object. If the token verification interface is circuit-broken, and the target access token is detected to be non-empty and its length is greater than or equal to the minimum length threshold, the target access token is decrypted locally to obtain the target field sequence, and a token verification response message is generated based on the target field sequence. The above technical solution achieves a layered approach between conventional token verification logic and token verification logic in fault degradation scenarios. When the distributed authentication center detects that the token verification interface has been circuit-broken, it processes the target access token locally to obtain a token verification response message. This ensures that the upstream still has a usable authentication context in fault degradation scenarios, facilitating controlled degradation processing by combining the calling interface and risk level. It also distinguishes the capability boundaries between conventional verification and degradation responses, preventing the upstream from mistakenly using degradation results as complete security verification results, thus avoiding the security risk of misuse of degradation responses. Furthermore, when the distributed authentication center detects that the token verification interface has not been circuit-broken and all required verifications have passed, it updates the absolute expiration time of the token in the target authentication object in different ways based on the token auto-extension enable flag, token validity period, current time, and preset extension time. Then, based on the updated absolute expiration time and other authentication fields in the target authentication object, it generates a token verification response message. This avoids a large number of token expiration times coinciding with cache write times, alleviating the token expiration time clustering phenomenon and reducing the instantaneous system load of the distributed authentication center.

[0071] Optionally, the target authentication object includes the following authentication fields: token authorization resource scope and token-bound device identifier; The first token verification response message generation module 304 includes a token verification unit, which is specifically used for: If the device verification enable flag is detected to be 1, then resource range verification is performed based on the client's allowed resource range, token authorized resource range, and the resources required by the request carried in the business request. Device identifier verification is also performed based on the request device identifier and token-bound device identifier carried in the business request. If the device verification enable flag is detected to be 0, then resource range verification is performed based on the client's allowed resource range, the token-authorized resource range, and the resources required by the request carried in the business request.

[0072] Optionally, the first token verification response message generation module 304 further includes a verification response message generation unit, which is specifically used for: If the value of the token auto-extension enable flag is detected to be 1, then the target access token is determined to be close to expiration based on the token validity period, current time, and preset extension time. If it is determined that the target access token is about to expire and the current time is during an off-peak period, update the absolute expiration time of the token in the target authentication object according to the current time and the token's validity period; Generate a token verification response message based on the updated absolute expiration time of the token and other authentication fields in the target authentication object; If it is determined that the target access token is about to expire and the current time is outside of off-peak hours, update the absolute expiration time of the token in the target authentication object according to the preset off-peak time and token validity period; Generate a token verification response message based on the updated absolute expiration time of the token and other authentication fields in the target authentication object; If it is determined that the target access token is not about to expire, a token verification response message is generated based on the target authentication object.

[0073] Optionally, the verification response message generation unit is also specifically used for: If the value of the token auto-delay enable flag is detected to be 0, a token verification response message is generated based on the target authentication object.

[0074] Optionally, the second token verification response message generation module 305 is specifically used for: Determine whether the target access token has expired based on the absolute expiration time and the current time in the target field sequence; If the target access token is determined to be valid, the target field sequence is split to obtain multiple target field values, and a token verification response message is generated based on each target field value.

[0075] Optionally, the plaintext field sequence of the target access token may include at least the following authentication fields: client identifier, token authorized resource scope, global user identifier, and token absolute expiration time.

[0076] The access token verification device provided in the embodiments of the present invention can execute the access token verification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing each access token verification method.

[0077] According to embodiments of the present invention, the present invention also provides an electronic device, a readable storage medium, and a computer program product.

[0078] Example 4 Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0079] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0080] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0081] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as access token verification methods.

[0082] In some embodiments, the access token verification method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the access token verification method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the access token verification method by any other suitable means (e.g., by means of firmware).

[0083] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0084] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0085] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0086] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0087] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0088] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0089] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0090] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An access token verification method, characterized in that, Performed by a distributed authentication center, the method includes: Receive business requests and check whether the token verification interface has been circuit broken; If it is detected that the token verification interface has not been blocked, the target access token carried in the business request is input into the token verification interface to obtain the target authentication object; Based on the client identifier in the target authentication object, obtain the client configuration information; the client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period; Based on the client's allowed resource range, the device verification enable identifier, the target authentication object, and the resources required for the request and the request device identifier carried in the service request, perform resource range verification or device identifier verification, and after confirming that the verification is successful, generate a token verification response message based on the token auto-extension enable identifier, the token validity period, the current time, the preset extension time and the target authentication object; If the token verification interface is detected to be blocked, and if the target access token is not empty and its length is greater than or equal to the minimum length threshold, the target access token is decrypted locally to obtain the target field sequence, and a token verification response message is generated based on the target field sequence.

2. The method according to claim 1, characterized in that, The target authentication object includes the following authentication fields: token authorization resource scope and token-bound device identifier; Based on the client's allowed resource range, the device verification enable flag, the target authentication object, and the resources required and device identifier carried in the service request, perform resource range verification or device identifier verification, including: If the value of the device verification enable flag is detected to be 1, then resource range verification is performed according to the client's allowed resource range, the token authorized resource range, and the resources required by the request carried in the service request, and device identifier verification is performed according to the request device identifier carried in the service request and the token-bound device identifier; If the value of the device verification enable flag is detected to be 0, then a resource range verification is performed based on the client's allowed resource range, the token-authorized resource range, and the resources required by the request carried in the service request.

3. The method according to claim 2, characterized in that, Based on the token auto-extension enable flag, the token validity period, the current time, the preset extension time, and the target authentication object, a token verification response message is generated, including: If the value of the token auto-extension enable flag is detected to be 1, then the target access token is determined to be close to expiration based on the token's validity period, current time, and preset extension time. If it is determined that the target access token is about to expire and the current time is during an off-peak period, the absolute expiration time of the token in the target authentication object is updated according to the current time and the token's validity period. Generate a token verification response message based on the updated absolute expiration time of the token and other authentication fields in the target authentication object; If it is determined that the target access token is about to expire and the current time is outside of off-peak hours, the absolute expiration time of the token in the target authentication object is updated according to the preset off-peak time and the token validity period. Generate a token verification response message based on the updated absolute expiration time of the token and other authentication fields in the target authentication object; If it is determined that the target access token is not about to expire, a token verification response message is generated based on the target authentication object.

4. The method according to claim 3, characterized in that, Based on the token auto-extension enable flag, the token validity period, the current time, the preset extension time, and the target authentication object, a token verification response message is generated, which also includes: If the value of the token auto-delay enable flag is detected to be 0, a token verification response message is generated based on the target authentication object.

5. The method according to claim 1, characterized in that, Based on the target field sequence, a token verification response message is generated, including: Based on the absolute expiration time of the token in the target field sequence and the current time, determine whether the target access token has expired; If it is determined that the target access token has not expired, the target field sequence is split to obtain multiple target field values, and a token verification response message is generated based on each target field value.

6. The method according to claim 1, characterized in that, The plaintext field sequence of the target access token includes at least the following authentication fields: client identifier, token authorized resource scope, global user identifier, and token absolute expiration time.

7. An access token verification device, characterized in that, Deployed in a distributed authentication center, the device includes: The request receiving and token verification interface detection module is used to receive business requests and detect whether the token verification interface has been circuit-broken. The target authentication object determination module is used to input the target access token carried in the business request into the token verification interface to obtain the target authentication object when it is detected that the token verification interface has not been circuit-broken. The client configuration information acquisition module is used to acquire client configuration information based on the client identifier in the target authentication object; the client configuration information includes the client's allowed resource range, device verification enable identifier, token auto-extension enable identifier, and token validity period; The first token verification response message generation module is used to perform resource range verification or device identifier verification based on the client's allowed resource range, the device verification enable identifier, the target authentication object, and the resources required for the request and the request device identifier carried in the service request. After determining that the verification is successful, it generates a token verification response message based on the token automatic extension enable identifier, the token validity period, the current time, the preset extension time, and the target authentication object. The second token verification response message generation module is used to, when the token verification interface is detected to be circuit-broken, if the target access token is detected to be non-empty and its token length is greater than or equal to the minimum length threshold, decrypt the target access token locally to obtain the target field sequence, and generate a token verification response message based on the target field sequence.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the access token verification method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the access token verification method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the access token verification method according to any one of claims 1-6.

Images