CN115883113A - JWT-based login authentication method and related equipment - Google Patents

Abstract

The present disclosure provides a login authentication method and related devices based on JWT, which is implemented by a central system and an edge system, the method includes: the central system acquires a request sent by a target user for logging in a target edge system; the target user is any user who has logged in the central system; the central system generates JWT for the target user and splices the JWT to the network address of the target edge system; the target edge system acquires the JWT and verifies the JWT by using the key; the target edge system further verifies whether the JWT is expired in response to determining that the JWT passes the key verification; the target edge system further verifies whether JWT is misappropriated sm _ url in response to determining that JWT is not expired; the target edge system logs the target user into the target edge system in response to determining that the JWT is unmixed sm _ url. Through the method and the device, cross-system login can be realized without inputting login information again.

Description

JWT-based login authentication method and related equipment

technical field

The present disclosure relates to the technical field of the Internet, in particular to a JWT-based login authentication method and related equipment.

Background technique

The application system login and authentication method in the prior art is usually that each system has its own independent authentication module and authority data, so when there are too many systems, each system needs to be authenticated once for the corresponding system. This method leads to frequent login operations, inconvenience for users, and low efficiency of multi-system login.

At the same time, the heterogeneity of data leads to the incompatibility of personnel information, and the change of user information requires simultaneous maintenance of multiple systems, which greatly increases maintenance costs.

Contents of the invention

In view of this, the purpose of this disclosure is to propose a JWT-based login authentication method and related equipment.

Based on the above purpose, the present disclosure provides a JWT-based login authentication method, which is realized by a central system and an edge system. The method includes:

The central system obtains a request from a target user to log in to the target edge system; the target user is any user who has logged into the central system;

The central system generates a JWT for the target user, and splices the JWT into the network address of the target edge system;

the target edge system obtains the JWT and verifies the JWT using a secret key;

The target edge system, in response to determining that the JWT passes key validation, further verifies whether the JWT has expired;

The target edge system, in response to determining that the JWT has not expired, further verifies whether the JWT mixes sm_url;

The target edge system logs the target user into the target edge system in response to determining that the JWT does not mix sm_url.

Based on the same inventive concept, the present disclosure provides a JWT-based login authentication system, including: a central system and an edge system;

The central system for:

Obtaining a request sent by a target user to log in to the target edge system; the target user is any user who has already logged into the central system;

generating a JWT for the target user, and splicing the JWT to the network address of the target edge system;

The target limbic system for:

Obtain the JWT, and verify the JWT with a secret key;

further verifying whether the JWT has expired in response to determining that the JWT passes key validation;

In response to determining that the JWT has not expired, further verifying whether the JWT is mixed with sm_url;

Responsive to determining that the JWT is not mixed with sm_url, logging the target user into the target edge system.

Based on the same inventive concept, the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored on the memory and operable on the processor, and the processor implements the above-mentioned method when executing the program .

Based on the same inventive concept, the present disclosure provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute the above method.

It can be seen from the above that the JWT-based login authentication method and related equipment provided by the present disclosure are implemented through the central system and the edge system. The method includes: the central system obtains the request sent by the target user to log in to the target edge system; The target user is any user who has logged into the central system; the central system generates a JWT for the target user, and splices the JWT to the network address of the target edge system; the target edge system obtains the JWT, and uses the key to verify the JWT; the target edge system responds Determine whether the JWT has passed the key verification, and further verify whether the JWT has expired; the target edge system further verifies whether the JWT is mixed with sm_url in response to determining that the JWT is not expired; Through the present disclosure, cross-system login can be realized without inputting login information again.

Description of drawings

In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the following will briefly introduce the accompanying drawings that need to be used in the descriptions of the embodiments or related technologies. Obviously, the accompanying drawings in the following description are only for the present disclosure Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

FIG. 1 is a schematic flowchart of a JWT-based login authentication method provided by an embodiment of the present disclosure;

FIG. 2 is a schematic structural diagram of a JWT-based login authentication system provided by an embodiment of the present disclosure;

FIG. 3 is a schematic diagram of a more specific hardware structure of an electronic device provided by an embodiment of the present disclosure.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the present disclosure will be further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure shall have ordinary meanings understood by those skilled in the art to which the present disclosure belongs. "First", "second" and similar words used in the embodiments of the present disclosure do not indicate any sequence, quantity or importance, but are only used to distinguish different components. "Comprising" or "comprising" and similar words mean that the elements or items appearing before the word include the elements or items listed after the word and their equivalents, without excluding other elements or items. Words such as "connected" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "Down", "Left", "Right" and so on are only used to indicate the relative positional relationship. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

In view of this, this disclosure proposes a JWT-based login authentication method and related equipment, adopts a JWT-based platform login authentication docking method, breaks the traditional system login and authority control methods, passes security verification throughout the entire process, and uses JWT to solve the problem. The issue of cross-system authentication, while using the encryption key mechanism for transmission, protects information security and reduces the probability of being stolen or forged.

JWT (JSON Web Token) is an open standard that defines a compact, self-contained way to securely transmit information between parties as JSON objects. This information can be verified and trusted because it is digitally signed.

FIG. 1 is a schematic flowchart of a JWT-based login authentication method provided by an embodiment of the present disclosure.

The JWT-based login authentication method is implemented through the central system and the edge system, and the method includes:

S110. The central system acquires a request sent by the target user to log in to the target edge system. The target user is any user who has logged into the central system.

S120. The central system generates a JWT for the target user, and splices the JWT to the network address of the target edge system.

In some embodiments, the JWT includes: a header, a payload and a signature;

Header, used to carry the declaration type and the encryption algorithm of the declaration;

The payload section is used to store valid information including declarations registered in the standard, public declarations and private declarations;

Signature, including encrypted header, encrypted payload and private key.

S130. The target edge system acquires the JWT, and uses the key to verify the JWT.

In some embodiments, the target edge system verifies the JWT with a key, including:

The target edge system decodes the header, obtains the algorithm for claim encryption, and uses the algorithm for claim encryption to sign the header and the payload to obtain a signature for verification. In response to determining that the signature for verification is the same as the signature in the JWT, determine the JWT Pass key authentication.

S140. The target edge system further verifies whether the JWT is expired in response to determining that the JWT passes the key verification.

In some embodiments, the statement registered in the standard includes a preset valid time, and the target edge system further verifies whether the JWT is expired in response to determining that the JWT passes the key verification, including:

The target edge system obtains the current time, and in response to determining that the current time does not exceed the preset valid time, determines that the JWT has not expired.

S150. In response to determining that the JWT has not expired, the target edge system further verifies whether the JWT is mixed with sm_url.

S160. The target edge system enables the target user to log in the target edge system in response to determining that the JWT is not mixed with sm_url.

It can be seen from the above that the JWT-based login authentication method and related equipment provided by the present disclosure are implemented through the central system and the edge system. The method includes: the central system obtains the request sent by the target user to log in to the target edge system; The target user is any user who has logged into the central system; the central system generates a JWT for the target user, and splices the JWT to the network address of the target edge system; the target edge system obtains the JWT, and uses the key to verify the JWT; the target edge system responds Determine whether the JWT has passed the key verification, and further verify whether the JWT has expired; the target edge system further verifies whether the JWT is mixed with sm_url in response to determining that the JWT is not expired; Through the present disclosure, cross-system login can be realized without inputting login information again.

It should be noted that the methods in the embodiments of the present disclosure may be executed by a single device, such as a computer or a server. The method of this embodiment can also be applied in a distributed scenario, and is completed by cooperation of multiple devices. In the case of such a distributed scenario, one of the multiple devices may only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete all described method.

It should be noted that some embodiments of the present disclosure are described above. Other implementations are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in an order different from those in the above-described embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. Multitasking and parallel processing are also possible or may be advantageous in certain embodiments.

Based on the same inventive concept, the present disclosure further provides a JWT-based login authentication device corresponding to the method in any of the above embodiments.

Referring to FIG. 2, the JWT-based login authentication device includes: a central system 210 and an edge system 220;

Central system 210 for:

Obtain the request sent by the target user to log in to the target edge system; the target user is any user who has already logged into the central system;

Generate JWT for the target user, and splicing the JWT to the network address of the target edge system;

target edge system 220 for:

Get the JWT and verify the JWT with the key;

further verifying whether the JWT has expired in response to determining that the JWT passes key validation;

In response to determining that the JWT has not expired, further verifying whether the JWT is mixed with sm_url;

Responsive to determining that the JWT is not mixed with sm_url, the target user is logged into the target edge system.

In some embodiments, the central system 210 is specifically used for:

Generate header, payload and signature;

Header, used to carry the declaration type and the encryption algorithm of the declaration;

The payload section is used to store valid information including declarations registered in the standard, public declarations and private declarations;

Signature, including encrypted header, encrypted payload and private key.

In some embodiments, the target edge system 220 is specifically used for:

Decoding the header to obtain a statement encryption algorithm, and using the statement encryption algorithm to sign the header and the payload part to obtain a verification signature, and in response to determining that the verification signature is the same as the signature in the JWT, determine the JWT passing key verify.

In some embodiments, the statement registered in the standard includes a preset effective time, and the target edge system 220 is specifically used for:

The current time is obtained, and in response to determining that the current time does not exceed the preset effective time, it is determined that the JWT has not expired.

For the convenience of description, when describing the above devices, functions are divided into various modules and described separately. Of course, when implementing the present disclosure, the functions of each module can be implemented in one or more pieces of software and/or hardware.

The device in the above embodiment is used to implement the corresponding JWT-based login authentication method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

Based on the same inventive concept, and corresponding to the methods in any of the above embodiments, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and operable on the processor, the processor When the program is executed, the JWT-based login authentication method described in any one of the above embodiments is realized.

FIG. 3 shows a schematic diagram of a more specific hardware structure of an electronic device provided by this embodiment. The device may include: a processor 1010 , a memory 1020 , an input/output interface 1030 , a communication interface 1040 and a bus 1050 . The processor 1010 , the memory 1020 , the input/output interface 1030 and the communication interface 1040 are connected to each other within the device through the bus 1050 .

The processor 1010 may be implemented by a general-purpose CPU (Central Processing Unit, central processing unit), a microprocessor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute related programs to realize the technical solutions provided by the embodiments of this specification.

The memory 1020 may be implemented in the form of ROM (Read Only Memory, read only memory), RAM (Random Access Memory, random access memory), static storage device, dynamic storage device, and the like. The memory 1020 can store operating systems and other application programs. When implementing the technical solutions provided by the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 1020 and invoked by the processor 1010 for execution.

The input/output interface 1030 is used to connect the input/output module to realize information input and output. The input/output module can be configured in the device as a component (not shown in the figure), or can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, and the like.

The communication interface 1040 is used to connect a communication module (not shown in the figure), so as to realize the communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.), and can also realize communication through wireless means (such as mobile network, WIFI, Bluetooth, etc.).

Bus 1050 includes a path that carries information between the various components of the device (eg, processor 1010, memory 1020, input/output interface 1030, and communication interface 1040).

It should be noted that although the above device only shows the processor 1010, the memory 1020, the input/output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components. In addition, those skilled in the art can understand that the above-mentioned device may only include components necessary to implement the solutions of the embodiments of this specification, and does not necessarily include all the components shown in the figure.

The electronic device in the above-mentioned embodiments is used to implement the corresponding JWT-based login authentication method in any of the above-mentioned embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

Based on the same inventive concept, the present disclosure also provides a non-transitory computer-readable storage medium corresponding to the method in any of the above-mentioned embodiments, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions use It is used to make the computer execute the JWT-based login authentication method described in any one of the above embodiments.

The computer-readable medium in this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape magnetic disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

The computer instructions stored in the storage medium of the above embodiments are used to make the computer execute the JWT-based login authentication method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

It should be noted that the embodiments of the present disclosure can also be further described in the following ways:

A JWT-based login authentication method, implemented by a central system and an edge system, the method includes:

The central system obtains the request sent by the target user to log in to the target edge system; the target user is any user who has logged into the central system;

The central system generates a JWT for the target user, and splices the JWT to the network address of the target edge system;

The target edge system obtains the JWT and verifies the JWT with the key;

The target edge system further verifies whether the JWT has expired in response to determining that the JWT passes key validation;

The target edge system, in response to determining that the JWT has not expired, further verifies whether the JWT is mixed with sm_url;

The target edge system logs the target user into the target edge system in response to determining that the JWT is not mixed with sm_url.

Optionally, JWT includes: header, payload and signature;

Header, used to carry the declaration type and the encryption algorithm of the declaration;

The payload section is used to store valid information including declarations registered in the standard, public declarations and private declarations;

Signature, including encrypted header, encrypted payload and private key.

Optionally, where the target edge system validates the JWT with a key, including:

The target edge system decodes the header, obtains the algorithm for claim encryption, and uses the algorithm for claim encryption to sign the header and the payload to obtain a signature for verification. In response to determining that the signature for verification is the same as the signature in the JWT, determine the JWT Pass key authentication.

Optionally, the statement registered in the standard includes a preset valid time, and the target edge system further verifies whether the JWT is expired in response to determining that the JWT passes key verification, including:

The target edge system obtains the current time, and in response to determining that the current time does not exceed the preset valid time, determines that the JWT has not expired.

A JWT-based login authentication system, including: a central system and an edge system;

Central system for:

Obtain the request sent by the target user to log in to the target edge system; the target user is any user who has already logged into the central system;

Generate JWT for the target user, and splicing the JWT to the network address of the target edge system;

Targets the limbic system for:

Get the JWT and verify the JWT with the key;

Further verifying whether the JWT has expired in response to determining that the JWT passes key verification;

In response to determining that the JWT has not expired, further verifying whether the JWT is mixed with sm_url;

Responsive to determining that the JWT is not mixed with sm_url, the target user is logged into the target edge system.

Optionally, the central system is specifically used for:

Generate header, payload and signature;

Header, used to carry the declaration type and the encryption algorithm of the declaration;

The payload section is used to store valid information including declarations registered in the standard, public declarations and private declarations;

Signature, including encrypted header, encrypted payload and private key.

Optionally, wherein the target limbic system is specifically used for:

Decoding the header to obtain a statement encryption algorithm, and using the statement encryption algorithm to sign the header and the payload part to obtain a verification signature, and in response to determining that the verification signature is the same as the signature in the JWT, determine the JWT passing key verify.

Optionally, the statement registered in the standard includes a preset effective time, the target limbic system, specifically for:

The current time is obtained, and in response to determining that the current time does not exceed the preset effective time, it is determined that the JWT has not expired.

An electronic device includes a memory, a processor, and a computer program stored in the memory and operable on the processor, and the processor implements the above-mentioned method when executing the program.

A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute the above method.

Those of ordinary skill in the art should understand that: the discussion of any of the above embodiments is exemplary only, and is not intended to imply that the scope of the present disclosure (including claims) is limited to these examples; under the idea of the present disclosure, the above embodiments or Combinations between technical features in different embodiments are also possible, steps may be implemented in any order, and there are many other variations of the different aspects of the disclosed embodiments as described above, which are not provided in detail for the sake of brevity.

In addition, to simplify illustration and discussion, and so as not to obscure the embodiments of the present disclosure, well-known power supply/connection circuits associated with integrated circuit (IC) chips and other components may or may not be shown in the provided figures. ground connection. Furthermore, devices may be shown in block diagram form in order to avoid obscuring the embodiments of the disclosure, and this also takes into account the fact that details regarding the implementation of these block diagram devices are highly dependent on the implementation of the embodiments of the disclosure in which they are to be implemented. platform (ie, the details should be well within the purview of those skilled in the art). Where specific details (eg, circuits) have been set forth in order to describe example embodiments of the present disclosure, it will be apparent to those skilled in the art that reference may be made without or with variation from these specific details. Embodiments of the present disclosure are implemented below. Accordingly, these descriptions should be regarded as illustrative rather than restrictive.

Although the disclosure has been described in conjunction with specific embodiments thereof, many alternatives, modifications and variations of those embodiments will be apparent to those of ordinary skill in the art from the foregoing description. For example, other memory architectures such as dynamic RAM (DRAM) may use the discussed embodiments.

The disclosed embodiments are intended to embrace all such alterations, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure shall fall within the protection scope of the present disclosure.

Claims (10)

1. A JWT-based login authentication method, realized by a central system and an edge system, said method comprising: The central system obtains a request from a target user to log in to the target edge system; the target user is any user who has logged into the central system; The central system generates a JWT for the target user, and splices the JWT into the network address of the target edge system; the target edge system obtains the JWT and verifies the JWT using a secret key; The target edge system, in response to determining that the JWT passes key validation, further verifies whether the JWT has expired; The target edge system, in response to determining that the JWT has not expired, further verifies whether the JWT mixes sm_url; The target edge system logs the target user into the target edge system in response to determining that the JWT does not mix sm_url. 2. The method according to claim 1, wherein the JWT comprises: a header, a payload and a signature; The header is used to carry the declaration type and the encryption algorithm of the declaration; The payload part is used to store valid information including declarations registered in the standard, public declarations and private declarations; The signature includes the encrypted header, encrypted payload and private key. 3. The method of claim 2, wherein the target edge system authenticating the JWT with a secret key comprises: The target edge system decodes the header to obtain the statement encryption algorithm, and uses the statement encryption algorithm to sign the header and the payload to obtain a signature for verification, and responds to the determination The verification signature is the same as the signature in the JWT, and it is determined that the JWT passes key verification. 4. The method according to claim 2, wherein the statement registered in the standard includes a preset validity time, and the target edge system further verifies whether the JWT is expired in response to determining that the JWT passes key verification ,include: The target edge system acquires the current time, and in response to determining that the current time does not exceed the preset valid time, determines that the JWT has not expired. 5. A JWT-based login authentication system, including: a central system and an edge system; The central system for: Obtaining a request sent by a target user to log in to the target edge system; the target user is any user who has already logged into the central system; generating a JWT for the target user, and splicing the JWT to the network address of the target edge system; The target limbic system for: Obtain the JWT, and verify the JWT with a secret key; further verifying whether the JWT has expired in response to determining that the JWT passes key validation; In response to determining that the JWT has not expired, further verifying whether the JWT is mixed with sm_url; Responsive to determining that the JWT is not mixed with sm_url, logging the target user into the target edge system. 6. The system according to claim 5, wherein the central system is specifically used for: Generate header, payload and signature; The header is used to carry the declaration type and the encryption algorithm of the declaration; The payload part is used to store valid information including declarations registered in the standard, public declarations and private declarations; The signature includes the encrypted header, encrypted payload and private key. 7. The system according to claim 6, wherein the target edge system is specifically used for: Decoding the header to obtain the declared encryption algorithm, signing the header and the payload with the declared encrypted algorithm to obtain a verification signature, and responding to determining the verification signature Same as the signature in the JWT, it is determined that the JWT passes key verification. 8. The system according to claim 6, wherein the statement registered in the standard includes a preset effective time, and the target edge system is specifically used for: The current time is obtained, and in response to determining that the current time does not exceed the preset effective time, it is determined that the JWT has not expired. 9. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, when the processor executes the program, the method described in any one of claims 1 to 4 is realized. method. 10. A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute the method according to any one of claims 1 to 4.

Images