WO2020173019A1 - 访问凭证验证方法、装置、计算机设备及存储介质 - Google Patents

访问凭证验证方法、装置、计算机设备及存储介质 Download PDF

Info

Publication number
WO2020173019A1
WO2020173019A1 PCT/CN2019/091903 CN2019091903W WO2020173019A1 WO 2020173019 A1 WO2020173019 A1 WO 2020173019A1 CN 2019091903 W CN2019091903 W CN 2019091903W WO 2020173019 A1 WO2020173019 A1 WO 2020173019A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
client
verification
credential
characteristic information
Prior art date
Application number
PCT/CN2019/091903
Other languages
English (en)
French (fr)
Inventor
邹陈波
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2020173019A1 publication Critical patent/WO2020173019A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • This application relates to the field of identity authentication technology, and in particular to an access credential verification method, device, computer equipment and storage medium.
  • a certain type of data file is stored on the cloud server, and the owner of the data file can share it with a designated third party.
  • the commonly used data sharing method generally adopts the access method based on user name and password, which has the following shortcomings: if the user name and password are too simple, it is easy to be cracked by a malicious third party; if the owner of the data file, the user name and password will be assigned The data is shared with A, but there is no guarantee that A will not disclose the user name and password to other person B. This is undesirable for the file owner; if user A obtains an access link to a data file through normal channels, If the link is accidentally leaked, the privacy of the data file will be leaked.
  • the embodiments of the present application provide an access credential verification method, device, computer equipment, and storage medium to prevent access to files through stolen, tampered, or forged access credential, and better ensure data privacy.
  • this application provides an access credential verification method, which includes:
  • the access instruction including the access purpose, characteristic information of the client, and the access credential
  • the access instruction passes the verification.
  • this application provides an access credential verification device, the device including:
  • the first obtaining module is configured to obtain an access request sent by the client, where the access request includes an access purpose
  • the second obtaining module is used to obtain the access code corresponding to the access purpose
  • the first generating module is configured to generate an access credential according to the access code and the characteristic information of the client;
  • a sending module for sending the generated access credential to the client
  • a third obtaining module configured to obtain an access instruction sent by a client, the access instruction including the access purpose, characteristic information of the client, and the access credential;
  • the second generating module is configured to generate a verification voucher according to the access code corresponding to the access purpose and the characteristic information of the client;
  • the verification module is configured to pass the verification if the verification credential is consistent with the access credential in the access instruction.
  • the present application provides a computer device that includes a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program and when the computer is executed The program implements the above-mentioned access credential verification method.
  • the present application provides a computer-readable storage medium that stores a computer program, and if the computer program is executed by a processor, the above-mentioned access credential verification method is implemented.
  • This application discloses an access credential verification method, device, equipment and storage medium.
  • the access credential is generated and verified according to the access code corresponding to the file requested by the client and the characteristic information of the client to prevent access through theft, tampering or forgery Credentials to access the file; for example, the hash value calculated based on the access code and the client's public key and/or expiration time is used as the client's access credentials, which can prevent a client's access credentials from being stolen by other clients and still pass verification , To prevent the access credentials from being leaked intentionally or unintentionally, and to better ensure the privacy of data.
  • FIG. 1 is a schematic flowchart of an access credential verification method according to an embodiment of this application
  • Figure 2 is a schematic diagram of an application scenario of the access credential verification method of this application.
  • FIG. 3 is a schematic flowchart of an access credential verification method according to another embodiment of this application.
  • FIG. 4 is a schematic flowchart of an access credential verification method according to another embodiment of this application.
  • FIG. 5 is a schematic flowchart of an access credential verification method according to another embodiment of this application.
  • FIG. 6 is a schematic flowchart of an access credential verification method according to another embodiment of this application.
  • FIG. 7 is a schematic flowchart of an access credential verification method according to another embodiment of this application.
  • FIG. 8 is a schematic flowchart of an access credential verification method according to another embodiment of this application.
  • FIG. 9 is a schematic structural diagram of an access credential verification device according to an embodiment of the application.
  • FIG. 10 is a schematic structural diagram of an access credential verification device according to another embodiment of the application.
  • FIG. 11 is a schematic structural diagram of an access credential verification device according to still another embodiment of this application.
  • FIG. 12 is a schematic structural diagram of a computer device provided by an embodiment of this application.
  • the embodiments of the present application provide an access credential verification method, device, equipment and storage medium.
  • the access credential verification method can be applied to the server to verify whether the client has the corresponding authority.
  • the access credential verification method is used to download the server, and of course it can also be used in scenarios such as website access control and data query.
  • the following embodiments will introduce in detail the scenario where the client requests a file managed by the server from the server.
  • the server pre-stores the storage address of the file, the file identifier corresponding to the file, and the unique and fixed access code corresponding to the file.
  • the information stored by the server on a file is expressed in the following JSON format:
  • server indicates the storage address where the file is stored, for example, the address of the server where the file is stored.
  • “uid” indicates the file identifier of the file, which is the unique identifier corresponding to the file on the server.
  • access_code Indicates the unique and fixed access code of the file. Exemplarily, the access code is not open to the client.
  • the information stored by the server for each file can be placed in a separate server for verifying the client and issuing credentials, and the file is placed in another server dedicated to storing data.
  • the storage address of the file is The address of the file on the server dedicated to storing data.
  • the file and the information stored in the file are located on the same server.
  • FIG. 1 is a schematic flowchart of an access credential verification method provided by an embodiment of the present application, and the access credential verification method is used in a server.
  • the client requests a file managed by the server from the server.
  • the access credential verification method includes the following steps:
  • Step S110 The server obtains the access request sent by the client, where the access request includes the access purpose.
  • the client can send a corresponding access request to the server, for example, can request the server to access a certain file.
  • the access purpose includes the network address requested by the client to access and/or the file identifier of the file requested by the client to access.
  • the server can detect the access request sent by the client.
  • the client requests the server to access the storage address of a certain file.
  • the client sends an access request including the storage address http://download.pinganyun.com/image/ to the server.
  • the client sends an access request containing a certain file identifier to the server, such as an access request containing the file identifier, that is, the uid of ca0aeab7360a9dc6a29a-2aae6c35c94...08b9ce91ee846ed to the server.
  • Step S120 The server obtains the access code corresponding to the access purpose.
  • the server can query the storage address and/or the storage address of the file according to the information stored in the file by the server.
  • the access code corresponding to the file identifier corresponding to the file for example, the access code access_code is: d6b0d82cea4269b51572b8fab43adcee9fc3cf9a.
  • Step S130 The server generates an access credential according to the access code and the characteristic information of the client.
  • the characteristic information of the client includes the public key of the client.
  • the client's public key certificate is also sent to the server, so that the server can obtain the client's public key.
  • the access request sent by the server obtained by the server in step S110 also includes the public key of the client.
  • the client when the client requests a file from the server, it also sends the public key certificate corresponding to the account of the user logged in on the client to the server, so that the server can obtain the public key of the client.
  • the public key of the client can be the public key issued by the server for the corresponding client, or the public key issued by the server for an account. After the account logs in to an unspecified client, the public key is used as the public key of the client .
  • the client when the client requests a file from the server, it also sends information such as the account of the user logged in on the client to the server, and the server queries the corresponding public key certificate according to the user's account and other information.
  • step S130 that the server generates an access credential according to the access code and the characteristic information of the client specifically includes the following steps:
  • Step S131 The server generates an access credential according to the access code and the public key of the client.
  • the server calculates a hash value according to the access code corresponding to the file and the public key of the client together, and uses the calculated hash value as an access credential for the client to access the file.
  • the access credential generated by the server is related to the access_code of the specific file requested by the client and the public key certificate of the specific client, which can prevent forged clients from accessing the file.
  • the public key certificates corresponding to different clients or different accounts are different; therefore, different clients or different accounts access the storage address of the same file, or request access For the same file, the access credentials calculated by the server based on the client's public key are all different.
  • Step S140 The server sends the generated access credential to the client.
  • the client needs to send an access request to the server each time to obtain the access credentials generated by the server, that is, the server executes the above steps S110-S140 each time It can be considered that the access credential is one-time; in other feasible embodiments, when the same client requests the same file from the server, the access credential generated by the server obtained when the file is requested can be reused, so that the server does not need The above steps S110-S140 are executed each time.
  • Step S150 The server obtains the access instruction sent by the client, where the access instruction includes the access purpose, the characteristic information of the client, and the access credential.
  • the client After the client obtains the access credential access_key_1 generated by the server, it can go to the server to access the file corresponding to the access credential access_key_1.
  • the client When the client needs to request a file from the server, it calls the corresponding access credential obtained from the server to access the file.
  • the access credential in the access instruction is the access credential itself obtained from the server.
  • the access credential obtained from the server is tampered with and used as the access credential in the access instruction, or the access credential in the access instruction is forged, the access credential in the access instruction is inconsistent with the access credential obtained from the server.
  • the access purpose in the access instruction includes the network address requested by the client to access and/or the file identifier of the file requested by the client to access.
  • the client accesses the storage address of a certain file, such as the client directly accesses http://download.pinganyun.com/image/, and the server can detect the access instruction sent by the client.
  • the client requests the server to access the storage address of a certain file.
  • the client sends an access instruction including the storage address http://download.pinganyun.com/image/ to the server.
  • the client sends an access instruction containing a certain file identifier to the server, such as an access instruction containing the file identifier, that is, the uid of ca0aeab7360a9dc6a29a-2aae6c35c94...08b9ce91ee846ed to the server.
  • Step S160 The server generates a verification certificate according to the access code corresponding to the access purpose and the characteristic information of the client.
  • the server finds the access code corresponding to the storage address of the file and/or the file identifier corresponding to the file according to the access purpose in the access instruction sent by the client, such as the storage address of the file and/or the file identifier corresponding to the file, For example, d6b0d82cea4269b51572b8fab43adcee9fc3cf9a.
  • the characteristic information of the client in the access instruction acquired by the server in step S150 includes the public key of the client.
  • the server in step S160, the server generates a verification voucher according to the access code corresponding to the access purpose and the characteristic information of the client, which specifically includes the following steps:
  • Step S161 The server generates a verification certificate according to the access code corresponding to the access purpose and the public key of the client in the access instruction.
  • the server calculates a hash value according to the access code corresponding to the access destination in the access instruction and the public key of the client, and uses the calculated hash value as a method for verifying whether the client can access the file. Verify the credentials.
  • Step S170 If the verification credential is consistent with the access credential in the access instruction, the access instruction passes the verification.
  • the authentication credential generated by the server is consistent with the access credential in the access instruction, it means that the access credential in the access instruction does belong to the client or the corresponding account, and the access instruction is verified, and the client can access the file, for example
  • the file can be read, modified, moved, and deleted; if the authentication credential generated by the server is inconsistent with the access credential in the access instruction, the access credential has been tampered with or forged. If the access instruction fails the verification, the server rejects the client Access the file.
  • the access credentials of the same file for different clients are different, and the access credentials after hash calculation must be different. Even if another person's access certificate is obtained, when using the access certificate to request data, it is difficult to provide characteristic information corresponding to the access certificate, such as a public key certificate, and the verification of the access certificate cannot be passed. For example, a third party attaches its own public key certificate to initiate an access instruction after obtaining the access credentials of other clients, then the verification credentials recalculated by the server will definitely not match the access credentials in the client's access instruction; because the hash calculation The public key used is different.
  • the access credential verification method generateds and verifies the access credential according to the access code corresponding to the file requested by the client and the characteristic information of the client to prevent access to the file through theft, tampering or forged access credential;
  • the hash value calculated by the access code and the client's public key is used as the client's access credential, which can prevent a client's access credential from being stolen by other clients and still pass the verification, avoiding the access credential from being leaked intentionally or unintentionally. Good to ensure the privacy of data.
  • the access request sent by the server obtained by the server in step S110 further includes the public key of the client. As shown in FIG. 4, after the server obtains the access request sent by the client in step S110, such as before the server obtains the access code corresponding to the access purpose in step S120, the following steps are further included:
  • Step S101 The server verifies whether the client is legal according to the public key of the client in the access request.
  • the server verifies whether the issuing authority of the public key is trustworthy. If step S101 verifies that the client is legal, then step S120 is executed. If it is illegal, there is no need to perform the next steps.
  • the access instruction obtained by the server from the client in step S150 further includes the private key signature of the client.
  • the client uses its own private key certificate to sign the access instruction.
  • the access instruction can be:
  • image_uid is the file identifier of the file
  • access_key is the client's unique reading certificate of the file, that is, the access certificate
  • certificate is the public key of the client
  • in the header of the access instruction there is a field Signature, It means that the client uses its own private key certificate to sign the request body BODY of the entire HTTP request, that is, the access instruction.
  • the server allocates a public key and a private key to the client.
  • the public key represents the identity of the client and corresponds to the unique private key.
  • step S150 after the server obtains the access instruction sent by the client in step S150, before the server generates a verification voucher according to the access code corresponding to the access purpose and the characteristic information of the client in step S160, It also includes the following steps:
  • Step S102 The server verifies whether the private key signature is correct according to the public key of the client in the access instruction.
  • step S160 If it is correct, the access instruction has not been tampered with, and the subsequent steps can be performed, such as step S160; if it is incorrect, the access is denied and the subsequent steps are not executed.
  • a third party steals a client’s legal access certificate and the client’s public key corresponding to the access certificate, initiates an access command and signs it with its own private key; because the private key signature in the entire access command is different from the public key If it matches, even if the matching verification certificate can be recalculated, it cannot pass the verification of the private key signature. Because anyone's private key will not be disclosed, the public and private keys of third parties do not match.
  • the characteristic information of the client includes an expiration time of the client.
  • the expiration time corresponding to the client or account is pre-stored in the server or specified by the server.
  • the file owner and/or the server side agreed on the expiration time for the client to store or use the file in advance, and the server saves this information; or the server based on the business situation of the file owner or client user, such as pay-per-use,
  • the expiration time of the client is established for monthly subscription and annual subscription.
  • the expiration time of the client is the time when the subscription expires one month after the subscription.
  • the expiration time of the client terminal is the time when the service expires.
  • step S130 that the server generates an access credential according to the access code and the characteristic information of the client specifically includes the following steps:
  • Step S132 The server generates an access credential according to the access code and the expiration time of the client.
  • the server calculates a hash value according to the access code corresponding to the file and the expiration time of the client, and uses the calculated hash value as an access credential for the client to access the file.
  • the access credential generated by the server is related to the access code access_code of the specific file requested by the client and the client's expiration time expire_time, which can prevent the client from using the tampered or forged expiration time to access the file.
  • the access credential verification method further includes the following step: sending an expiration time corresponding to the access credential to the client.
  • the client may display the expiration time to the user in a clear text to prompt the user to pay attention to the time when the file can be accessed, such as prompting the user to renew in time.
  • the characteristic information of the client in the access instruction acquired by the server in step S150 includes the expiration time expire_time sent by the client.
  • the access instruction can be:
  • image_uid is the file identifier of the file
  • access_key is the access credential
  • expire_time is the expiration time of the client.
  • step S160 the server generates a verification voucher according to the access code corresponding to the access purpose and the characteristic information of the client, which specifically includes the following steps:
  • Step S162 The server generates a verification voucher according to the access code corresponding to the access purpose and the expiration time of the client in the access instruction.
  • the server calculates a hash value according to the access code and the expiration time, and uses the calculated hash value as a verification credential for verifying that the client accesses the file. If the verification credential in step S170 is consistent with the access credential in the access instruction, it means that the access credential in the access instruction does belong to the client or the corresponding account, and the access instruction is verified, and the client can access the file. For example, the file can be read, modified, moved, or deleted; if the generated verification credential is inconsistent with the access credential in the access instruction, the access credential is tampered with or forged, the expiration time may be tampered with, and the access instruction fails the verification , The server denies the client access to the file.
  • the access credential verification method generateds and verifies the access credential according to the access code corresponding to the file requested by the client and the expiration time of the client to prevent access to the file through theft, tampering or forged access credential For example, if the expiration time access_key in the access credential expires, the client attempts to continue to use the access credential by modifying the expiration time. Because the client does not know the access code of the file, it cannot regenerate legal access based on the modified expiration time Certificate, it cannot be verified.
  • step S150 after the server obtains the access instruction sent by the client in step S150, before the server generates a verification voucher according to the access code corresponding to the access purpose and the characteristic information of the client in step S160, It also includes the following steps:
  • Step S103 The server determines whether the access credential has expired according to the expiration time of the client in the access instruction.
  • step S160 is executed; if it has expired, the client is denied access to the file, and there is no need to generate verification credentials.
  • the characteristic information of the client includes both the public key of the client and the expiration time of the client.
  • step S130 the server generates an access voucher according to the access code and the characteristic information of the client, which specifically includes the following steps:
  • Step S133 The server generates an access credential according to the access code, the public key of the client and the expiration time.
  • the server calculates a hash value according to the access code access_code, the client's public key certificate, and the expiration time expire_time, and sends the calculated hash value to the client as the client's access credential; both can prevent forgery
  • the client's access to the file can also prevent the client from using the tampered or forged expiration time to access the file.
  • access_key SHA1 (access_code+certificate+expire_time).
  • step S160 the server generates a verification voucher according to the access code corresponding to the access purpose and the characteristic information of the client, which specifically includes the following steps:
  • Step S163 The server generates a verification certificate according to the access code corresponding to the access purpose and the public key and expiration time of the client in the access instruction.
  • the access credential verification method provided by the foregoing embodiment generates and verifies the access credential according to the access code corresponding to the file requested by the client and the two characteristic information of the client’s public key and expiration time, thereby preventing access through theft, tampering or forgery Credentials to access the file are more secure.
  • FIG. 9 is a schematic structural diagram of an access credential verification device provided by an embodiment of the present application.
  • the access credential verification device can be configured in a server for executing the aforementioned access credential verification method.
  • the access credential verification device includes:
  • the first obtaining module 110 is configured to obtain an access request sent by a client, where the access request includes an access purpose.
  • the access purpose includes the network address requested by the client to access and/or the file identifier of the file requested to be accessed by the client.
  • the second obtaining module 120 is configured to obtain an access code corresponding to the access purpose.
  • the first generating module 130 is configured to generate an access credential according to the access code and the characteristic information of the client.
  • the characteristic information of the client includes the public key of the client and/or the expiration time of the client.
  • the first generating module 130 generates an access credential according to the access code, the public key of the client and/or the expiration time of the client.
  • the sending module 140 is configured to send the generated access credential to the client.
  • the third obtaining module 150 is configured to obtain an access instruction sent by a client, where the access instruction includes the access purpose, characteristic information of the client, and the access credential.
  • the second generating module 160 is configured to generate a verification voucher according to the access code corresponding to the access purpose and the characteristic information of the client.
  • the characteristic information of the client includes the public key of the client and/or the expiration time of the client.
  • the second generation module 160 generates a verification credential according to the access code corresponding to the access purpose, the public key of the client in the access instruction, and/or the expiration time of the client in the access instruction.
  • the verification module 170 is configured to verify the access instruction if the verification credential is consistent with the access credential in the access instruction.
  • the access request sent by the client acquired by the first acquiring module 110 further includes the public key of the client.
  • the access credential verification device further includes:
  • the first verification unit 101 is configured to verify whether the client is legal according to the public key of the client in the access request.
  • the second obtaining module 120 obtains the access code corresponding to the access purpose.
  • the access instruction sent by the client acquired by the third acquiring module 150 further includes the private key signature of the client.
  • the access credential verification device further includes:
  • the second verification unit 102 is configured to verify whether the private key signature is correct according to the public key of the client in the access instruction.
  • the second generating module 160 If it is correct, the second generating module 160 generates a verification voucher according to the access code corresponding to the access purpose and the characteristic information of the client.
  • the access credential verification device further includes:
  • the third verification unit 103 is configured to determine whether the access credential has expired according to the expiration time of the client in the access instruction.
  • the second generation module 160 If it has not expired, the second generation module 160 generates a verification voucher according to the access code corresponding to the access purpose and the characteristic information of the client.
  • the method and device of this application can be used in many general or special computing system environments or configurations.
  • the above-mentioned method and apparatus may be implemented in the form of a computer program, and the computer program may run on the computer device as shown in FIG. 12.
  • FIG. 12 is a schematic structural diagram of a computer device according to an embodiment of the present application.
  • the computer device may be a server.
  • the computer device includes a processor, a memory, and a network interface connected through a system bus, where the memory may include a non-volatile storage medium and an internal memory.
  • the non-volatile storage medium can store an operating system and a computer program.
  • the computer program includes program instructions, and when the program instructions are executed, the processor can execute any access credential verification method.
  • the processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.
  • the internal memory provides an environment for the operation of the computer program in the non-volatile storage medium.
  • the processor can execute any method for verifying access credentials.
  • the network interface is used for network communication, such as sending assigned tasks.
  • the network interface is used for network communication, such as sending assigned tasks.
  • FIG. 12 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied.
  • the specific computer device may Including more or fewer parts than shown in the figure, or combining some parts, or having a different arrangement of parts.
  • the processor may be a central processing unit (Central Processing Unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), and application specific integrated circuits (Application Specific Integrated Circuits). Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor.
  • the processor is configured to run a computer program stored in a memory, so as to implement the steps of any access credential verification method provided in the embodiments of the present application.
  • a computer-readable storage medium stores a computer program
  • the computer program includes program instructions
  • the processor executes the program instructions to implement any access provided by the embodiments of the present application Credential verification method.
  • the computer-readable storage medium may be the internal storage unit of the computer device described in the foregoing embodiment, such as the hard disk or memory of the computer device.
  • the computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SMC), or a secure digital (Secure Digital, SD) equipped on the computer device. ) Card, Flash Card, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • Automation & Control Theory (AREA)
  • Storage Device Security (AREA)

Abstract

一种访问凭证验证方法、装置、设备及存储介质，该方法包括：获取客户端访问请求中访问目的对应的访问码；然后根据访问码以及客户端的特征信息生成访问凭证并发客户端；之后获取客户端的访问指令；根据访问指令中访问目的对应的访问码以及特征信息生成验证凭证；若验证凭证与访问指令中的访问凭证一致，则访问指令通过验证。

Description

访问凭证验证方法、装置、计算机设备及存储介质
本申请要求于2019年2月27日提交中国专利局、申请号为201910145579.3、发明名称为“访问凭证验证方法、装置、计算机设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及身份认证技术领域，尤其涉及一种访问凭证验证方法、装置、计算机设备及存储介质。
背景技术
在云服务器上存储着某一种类型的数据文件，数据文件的所有者可以分享给指定的第三方。
目前常用的数据共享的方式一般采用基于用户名密码访问的方式，存在以下缺陷：如果用户名密码过于简单，容易被恶意的第三方破解；如果数据文件所有者，通过分配用户名密码的方式将数据分享给了A，但是无法保障A不会泄露用户名密码给其他人B，这是文件所有者不希望发生的；如果用户A通过正常的渠道得到了某个数据文件的访问链接，但是该链接不小心被泄露，则会造成数据文件的隐私泄露。
发明内容
本申请实施例提供一种访问凭证验证方法、装置、计算机设备及存储介质，防止通过窃取、篡改或伪造的访问凭证访问文件，更好的保证了数据的隐私性。
第一方面，本申请提供了一种访问凭证验证方法，所述方法包括：
获取客户端发送的访问请求，所述访问请求包括访问目的；
获取所述访问目的对应的访问码；
根据所述访问码以及所述客户端的特征信息生成访问凭证；
将生成的访问凭证发送给所述客户端；
获取客户端发送的访问指令，所述访问指令包括所述访问目的、所述客户端的特征信息以及所述访问凭证；
根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证；
若所述验证凭证与所述访问指令中的访问凭证一致，则所述访问指令通过验证。
第二方面，本申请提供了一种访问凭证验证装置，所述装置包括：
第一获取模块，用于获取客户端发送的访问请求，所述访问请求包括访问 目的；
第二获取模块，用于获取所述访问目的对应的访问码；
第一生成模块，用于根据所述访问码以及所述客户端的特征信息生成访问凭证；
发送模块，用于将生成的访问凭证发送给所述客户端；
第三获取模块，用于获取客户端发送的访问指令，所述访问指令包括所述访问目的、所述客户端的特征信息以及所述访问凭证；
第二生成模块，用于根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证；
验证模块，用于若所述验证凭证与所述访问指令中的访问凭证一致，则所述访问指令通过验证。
第三方面，本申请提供了一种计算机设备，所述计算机设备包括存储器和处理器；所述存储器用于存储计算机程序；所述处理器，用于执行所述计算机程序并在执行所述计算机程序时实现上述的访问凭证验证方法。
第四方面，本申请提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，若所述计算机程序被处理器执行，实现上述的访问凭证验证方法。
本申请公开了一种访问凭证验证方法、装置、设备及存储介质，通过根据客户端所请求文件对应的访问码，以及客户端的特征信息生成和验证访问凭证，防止通过窃取、篡改或伪造的访问凭证访问该文件；例如将根据访问码和客户端的公钥和/或过期时间计算出的哈希值作为客户端的访问凭证，可以防止某一客户端的访问凭证被其他客户端窃取后仍然可以通过验证，避免访问凭证被有意或是无意的泄露，更好的保证了数据的隐私性。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请一实施例的访问凭证验证方法的流程示意图；
图2为本申请的访问凭证验证方法的应用场景示意图；
图3为本申请另一实施例的访问凭证验证方法的流程示意图；
图4为本申请再一实施例的访问凭证验证方法的流程示意图；
图5为本申请又一实施例的访问凭证验证方法的流程示意图；
图6为本申请又一实施例的访问凭证验证方法的流程示意图；
图7为本申请又一实施例的访问凭证验证方法的流程示意图；
图8为本申请又一实施例的访问凭证验证方法的流程示意图；
图9为本申请一实施例的访问凭证验证装置的结构示意图；
图10为本申请另一实施例的访问凭证验证装置的结构示意图；
图11为本申请再一实施例的访问凭证验证装置的结构示意图；
图12为本申请一实施例提供的一种计算机设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
附图中所示的流程图仅是示例说明，不是必须包括所有的内容和操作/步骤，也不是必须按所描述的顺序执行。例如，有的操作/步骤还可以分解、组合或部分合并，因此实际执行的顺序有可能根据实际情况改变。另外，虽然在装置示意图中进行了功能模块的划分，但是在某些情况下，可以以不同于装置示意图中的模块划分。
本申请的实施例提供了一种访问凭证验证方法、装置、设备及存储介质。其中，该访问凭证验证方法可以应用于服务器中，以验证客户端是否具有相应的权限。
例如，访问凭证验证方法用于下载服务器，当然也可以用于网站访问控制、数据查询等场景。但为了便于理解，以下实施例将以客户端向服务器请求服务器管理的某文件这一场景进行详细介绍。
在本实施例中，服务器预先存储有文件的存储地址、与文件对应的文件标识以及与文件对应的唯一且固定的访问码。
例如，服务器对某一文件存储的信息，用以下JSON格式来表示：
"external_data":{
"server":"http://download.pinganyun.com/image/"，
"uid":"ca0aeab7360a9dc6a29a-2aae6c35c94…08b9ce91ee846ed",
"access_code":"d6b0d82cea4269b51572b8fab43adcee9fc3cf9a"
}
其中"server"：表示存储该文件的存储地址，例如为存储该文件的服务器的地址。
"uid"：表示该文件的文件标识，为该文件在服务器上的与该文件对应的唯一标识。
"access_code"：表示该文件唯一且固定的访问码，示例性的，访问码不对客户端公开。
在一些实施例中，服务器对各文件存储的信息可以单独放在一个用于对客户端进行验证、发放凭证的服务器中，而文件放置在其他专用于存储数据的服务器中，文件的存储地址即该文件在专用于存储数据的服务器中的地址。在另一些实施例中，文件和文件存储的信息位于同一个服务器中。
下面结合附图，对本申请的一些实施方式作详细说明。在不冲突的情况下，下述的实施例及实施例中的特征可以相互组合。
请参阅图1，图1是本申请的实施例提供的一种访问凭证验证方法的流程示意图，访问凭证验证方法用于服务器。
如图2所示，客户端向服务器请求服务器管理的某文件。
如图1所示，访问凭证验证方法包括以下步骤：
步骤S110、服务器获取客户端发送的访问请求，所述访问请求包括访问目的。
客户端可以向服务器发送相应的访问请求，例如可以向服务器请求访问某一文件。
在一些实施例中，所述访问目的包括所述客户端请求访问的网络地址和/或所述客户端所请求访问文件的文件标识。
示例性的，客户端访问某一文件的存储地址，如客户端直接访问http://download.pinganyun.com/image/，服务器可以侦测到客户端发送的访问请求。
在另一些实施例中，客户端向服务器请求访问某一文件的存储地址，如客户端将包括存储地址http://download.pinganyun.com/image/的访问请求发送给服务器。
在其他一些实施例中，客户端向服务器发送包含某文件标识的访问请求，如包含文件标识即uid为ca0aeab7360a9dc6a29a-2aae6c35c94…08b9ce91ee846ed的访问请求给服务器。
步骤S120、服务器获取所述访问目的对应的访问码。
服务器根据客户端发送的访问请求中的访问目的，如文件的存储地址和/或与文件对应的文件标识，就可以根据服务器对该文件存储的信息查询到和该文件的存储地址和/或与该文件对应的文件标识对应的访问码，例如访问码access_code为：d6b0d82cea4269b51572b8fab43adcee9fc3cf9a。
步骤S130、服务器根据所述访问码以及所述客户端的特征信息生成访问凭证。
在一些实施例中，所述客户端的特征信息包括所述客户端的公钥。
示例性的，客户端向服务器请求某一文件时，还将客户端的公钥证书发送给服务器，从而服务器可以获取该客户端的公钥。例如，步骤S110中服务器获取客户端发送的访问请求还包括该客户端的公钥。
示例性的，客户端向服务器请求某一文件时，还将在客户端上登录用户的账户对应的公钥证书发送给服务器，从而服务器可以获取该客户端的公钥。客户端的公钥可以为服务器为相应客户端发放的公钥，也可以为服务器为某一账 户发放的公钥，该账户登录某一非特定的客户端后，该公钥作为该客户端的公钥。
示例性的，客户端向服务器请求某一文件时，还将在客户端上登录用户的账户等信息发送给服务器，服务器根据用户的账户等信息查询对应的公钥证书。
在一些可行的实施例中，如图3所示，步骤S130服务器根据所述访问码以及所述客户端的特征信息生成访问凭证，具体包括以下步骤：
步骤S131、服务器根据所述访问码以及所述客户端的公钥生成访问凭证。
示例性的，服务器根据该文件对应的访问码以及该客户端的公钥一起计算出一个哈希值，将计算出的哈希值作为该客户端访问该文件的访问凭证。
具体的，服务器生成的访问凭证access_key＝SHA1(access_code+certificate)，其中access_code表示该文件的访问码，certificate表示该客户端的公钥。服务器生成的访问凭证是和客户端所请求的具体文件的访问码access_code，以及具体的客户端的公钥certificate相关的，可以防止伪造的客户端访问文件。
由于客户端或者不同账户的公钥证书的唯一性，即不同的客户端或者不同的账户对应的公钥证书均不同；因此不同的客户端或者不同的账户访问同一文件的存储地址，或者请求访问同一文件时，服务器根据客户端的公钥计算出的访问凭证都是不一样的。
步骤S140、服务器将生成的访问凭证发送给所述客户端。
在一些可行的实施例中，如果同一客户端多次向服务器请求同一文件，每一次都需要客户端向服务器发送访问请求以获取服务器生成的访问凭证，即服务器每次都执行上述步骤S110-S140，可以认为该访问凭证是一次性的；在另一些可行的实施例中，同一客户端向服务器请求同一文件时，可以重复利用先前请求该文件时获取的服务器生成的访问凭证，从而服务器不需要每次都执行上述步骤S110-S140。
步骤S150、服务器获取客户端发送的访问指令，所述访问指令包括所述访问目的、所述客户端的特征信息以及所述访问凭证。
客户端得到服务器生成的访问凭证access_key_1后，就可以去服务器访问该访问凭证access_key_1对应的文件了。
客户端需要向服务器请求某一文件时，调取从服务器获取的相应的访问凭证以访问该文件。一般的，访问指令中的访问凭证为从服务器获取的访问凭证本身。但是如果将从服务器获取的访问凭证篡改后作为访问指令中的访问凭证，或者伪造访问指令中的访问凭证，则访问指令中的访问凭证与从服务器获取的访问凭证不一致。
在一些实施例中，访问指令中的访问目的包括所述客户端请求访问的网络地址和/或所述客户端所请求访问文件的文件标识。
示例性的，客户端访问某一文件的存储地址，如客户端直接访问http://download.pinganyun.com/image/，服务器可以侦测到客户端发送的访问指令。
在另一些实施例中，客户端向服务器请求访问某一文件的存储地址，如客 户端将包括存储地址http://download.pinganyun.com/image/的访问指令发送给服务器。
在其他一些实施例中，客户端向服务器发送包含某文件标识的访问指令，如包含文件标识即uid为ca0aeab7360a9dc6a29a-2aae6c35c94…08b9ce91ee846ed的访问指令给服务器。
步骤S160、服务器根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证。
服务器根据客户端发送的访问指令中的访问目的，如文件的存储地址和/或与文件对应的文件标识查询到和该文件的存储地址和/或与该文件对应的文件标识对应的访问码，例如d6b0d82cea4269b51572b8fab43adcee9fc3cf9a。
在一些实施例中，步骤S150服务器获取的访问指令中客户端的特征信息包括所述客户端的公钥。如图3所示，步骤S160服务器根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证，具体包括以下步骤：
步骤S161、服务器根据所述访问目的对应的访问码以及访问指令中所述客户端的公钥生成验证凭证。
示例性的，服务器根据访问指令中访问目对应的访问码以及该客户端的公钥一起计算出一个哈希值，将计算出的这个哈希值作为用于验证该客户端是否可以访问该文件的验证凭证。
步骤S170、若所述验证凭证与所述访问指令中的访问凭证一致，则所述访问指令通过验证。
如果服务器生成的验证凭证和访问指令中的访问凭证一致，则表示该访问指令中的访问凭证确实属于该客户端或者相应的账户，则该访问指令通过验证，该客户端可以访问该文件，例如可以读取、修改、移动、删除该文件；如果服务器生成的验证凭证和访问指令中的访问凭证不一致，则访问凭证被篡改或者是伪造的，这一访问指令未通过验证，服务器拒绝该客户端访问该文件。
因为不同客户端的特征信息，如公钥证书是不同的，因此同一个文件对于不同客户端的访问凭证是不同的，哈希计算之后的访问凭证必然也不同。即便拿到了其他人的访问凭证，在使用该访问凭证请求数据时，也很难提供与该访问凭证对应的特征信息，如公钥证书，则访问凭证的验证无法通过。例如，第三方在获取到其他客户端的访问凭证后附带自己的公钥证书发起访问指令，那么，服务器重算的验证凭证一定不会与客户端访问指令中的访问凭证匹配；因为哈希计算中使用的公钥不一样。
上述实施例提供的访问凭证验证方法，通过根据客户端所请求文件对应的访问码，以及客户端的特征信息生成和验证访问凭证，防止通过窃取、篡改或伪造的访问凭证访问该文件；例如将根据访问码和客户端的公钥计算出的哈希值作为客户端的访问凭证，可以防止某一客户端的访问凭证被其他客户端窃取后仍然可以通过验证，避免访问凭证被有意或是无意的泄露，更好的保证了数据的隐私性。
在一些实施例中，步骤S110中服务器获取客户端发送的访问请求还包括该客户端的公钥。如图4所示，在步骤S110服务器获取客户端发送的访问请求之后，如在步骤S120服务器获取所述访问目的对应的访问码之前，还包括以下步骤：
步骤S101、服务器根据所述访问请求中所述客户端的公钥验证所述客户端是否合法。
示例性的，服务器验证公钥的签发机构是否可信任。若步骤S101验证所述客户端合法，则执行步骤S120。若不合法，则无需执行后续步骤。
在一些实施例中，步骤S150中服务器从客户端获取的访问指令还包括所述客户端的私钥签名。示例性的，客户端用自己的私钥证书对访问指令进行签名。
例如，访问指令可以是：
POST/v1/image/data HTTP/1.1
Accept:application/json
Content-Length:676
Content-Type:application/json
Signature:3ff7af79177cae……121825582eb8a4a11d
{
"image_uid":"ca0aeab7360a9dc6a29a-2aae6c35c94…08b9ce91ee846ed",
"access_key":"d6b0d82cea4269b51572b8fab43adcee9fc3cf9a",
"certificate":tLS1CRUdJTiBDakNDQVVHZ0F3SUJBZ…＝＝"
}
其中，image_uid为文件的该文件的文件标识，access_key为客户端独一无二的该文件的读取凭证，即访问凭证，certificate为该客户端的公钥；在该访问指令的头部，有一个字段Signature，表示客户端用自己的私钥证书对整个HTTP请求的请求体BODY，即访问指令进行了签名。
示例性的，服务器为客户端分配公匙和私匙，公匙代表客户端身份并对应唯一的私匙。
在一些实施例中，如图5所示，在步骤S150服务器获取客户端发送的访问指令之后，如步骤S160服务器根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证之前，还包括以下步骤：
步骤S102、服务器根据所述访问指令中所述客户端的公钥验证所述私钥签名是否正确。
若正确则该访问指令没有被篡改，可以进行后续步骤，如步骤S160；若不正确则拒绝访问，不执行后续步骤。
第三方如果在窃取某客户端的合法的访问凭证以及与该访问凭证对应的客户端的公钥发起访问指令，并用自己的私钥进行签名；由于整个访问指令中的私钥签名与该公钥是不匹配的，即使可以重算出匹配的验证凭证也无法通过私钥签名的验证。因为任何人的私钥是不会公开的，第三方的公私钥不匹配。
在另一些可行的实施例中，所述客户端的特征信息包括所述客户端的过期时间。
具体的，客户端或账户对应的过期时间预先保存在服务器中或者由服务器规定。例如，文件所有者和/或服务器方预先商定了客户端存储或使用该文件的过期时间，服务器保存了这些信息；或者服务器根据文件所有者或者客户端使用者的业务情况，如按次付费，包月，包年等制定了客户端的过期时间。
示例性的，文件所有者订购了包月服务将一个文件存放于服务器，供自己或其他人访问，则客户端的过期时间为订购后一个月到期时的时间。又例如，客户端使用者按次付费，则客户端的过期时间为该次业务到期的时间。
在一些可行的实施例中，如图6所示，步骤S130服务器根据所述访问码以及所述客户端的特征信息生成访问凭证，具体包括以下步骤：
步骤S132、服务器根据所述访问码以及所述客户端的过期时间生成访问凭证。
示例性的，服务器根据该文件对应的访问码以及该客户端的过期时间一起计算出一个哈希值，将计算出的哈希值作为该客户端访问该文件的访问凭证。
具体的，服务器生成的访问凭证access_key＝SHA1(access_code+expire_time)，其中access_code表示该文件的访问码，expire_time表示该客户端的过期时间。服务器生成的访问凭证是和客户端所请求的具体文件的访问码access_code，以及客户端的过期时间expire_time相关的，可以防止客户端利用被篡改或伪造的过期时间访问文件。
在一些实施例中，访问凭证验证方法还包括以下步骤：将与所述访问凭证对应的过期时间发送给所述客户端。
示例性的，客户端可以以明文的方式将该过期时间展示给用户，以提示用户关注可以访问该文件的时间，如提示用户及时续费。
在本实施例中，步骤S150服务器获取的访问指令中客户端的特征信息包括客户端发送的过期时间expire_time。
例如，访问指令可以是：
{
"image_uid":"ca0aeab7360a9dc6a29a-2aae6c35c94…08b9ce91ee846ed",
"access_key":"d6b0d82cea4269b51572b8fab43adcee9fc3cf9a",
"expire_time":"1538097133"
}
其中，image_uid为文件的该文件的文件标识，access_key为访问凭证，expire_time为客户端的过期时间。
在本实施例中，如图6所示，步骤S160服务器根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证，具体包括以下步骤：
步骤S162、服务器根据所述访问目的对应的访问码以及访问指令中所述客户端的过期时间生成验证凭证。
示例性的，服务器根据访问码以及该过期时间一起计算出一个哈希值，将计算出的这个哈希值作为用于验证该客户端访问该文件的验证凭证。如果步骤S170中该验证凭证和访问指令中的访问凭证一致，则表示该访问指令中的访问凭证确实属于该客户端或者相应的账户，则该访问指令通过验证，该客户端可以访问该文件，例如可以读取、修改、移动、删除该文件；如果生成的验证凭证和访问指令中的访问凭证不一致，则访问凭证被篡改或者是伪造的，过期时间可能被篡改，这一访问指令未通过验证，服务器拒绝该客户端访问该文件。
上述实施例提供的访问凭证验证方法，通过根据客户端所请求文件对应的访问码，以及客户端的过期时间这一特征信息生成和验证访问凭证，防止通过窃取、篡改或伪造的访问凭证访问该文件；例如，如果访问凭证中的过期时间access_key过期，客户端企图通过修改过期时间来继续使用访问凭证，由于客户端不知道该文件的访问码，因此无法根据修改后的过期时间重新生成合法的访问凭证，则不能通过验证。
在一些实施例中，如图7所示，在步骤S150服务器获取客户端发送的访问指令之后，如步骤S160服务器根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证之前，还包括以下步骤：
步骤S103、服务器根据所述访问指令中所述客户端的过期时间判断所述访问凭证是否过期。
若未过期，执行步骤S160；若已过期，拒绝所述客户端访问该文件，也无需生成验证凭证。
在另一些可行的实施例中，客户端的特征信息既包括所述客户端的公钥，也包括客户端的过期时间。
如图8所示，步骤S130服务器根据所述访问码以及所述客户端的特征信息生成访问凭证，具体包括以下步骤：
步骤S133、服务器根据所述访问码以及所述客户端的公钥和过期时间生成访问凭证。
示例性的，服务器根据访问码access_code和客户端的公钥certificate，以及过期时间expire_time一起计算出一个哈希值，将计算出的哈希值发送给该客户端作为客户端的访问凭证；既可以防止伪造的客户端访问文件，也可以防止客户端利用被篡改或伪造的过期时间访问文件。
具体的，access_key＝SHA1(access_code+certificate+expire_time)。
如图8所示，步骤S160服务器根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证，具体包括以下步骤：
步骤S163、服务器根据所述访问目的对应的访问码以及访问指令中所述客户端的公钥和过期时间生成验证凭证。
上述实施例提供的访问凭证验证方法，通过根据客户端所请求文件对应的访问码，以及客户端的公钥和过期时间这两个特征信息生成和验证访问凭证，防止通过窃取、篡改或伪造的访问凭证访问该文件，安全性更高。
请参阅图9，图9是本申请一实施例提供的一种访问凭证验证装置的结构示意图，该访问凭证验证装置可以配置于服务器中，用于执行前述的访问凭证验证方法。
如图9所示，该访问凭证验证装置包括：
第一获取模块110，用于获取客户端发送的访问请求，所述访问请求包括访问目的。
具体的，所述访问目的包括所述客户端请求访问的网络地址和/或所述客户端所请求访问文件的文件标识。
第二获取模块120，用于获取所述访问目的对应的访问码。
第一生成模块130，用于根据所述访问码以及所述客户端的特征信息生成访问凭证。
具体的，所述客户端的特征信息包括所述客户端的公钥和/或所述客户端的过期时间。
具体的，第一生成模块130根据所述访问码以及所述客户端的公钥和/或所述客户端的过期时间生成访问凭证。
发送模块140，用于将生成的访问凭证发送给所述客户端。
第三获取模块150，用于获取客户端发送的访问指令，所述访问指令包括所述访问目的、所述客户端的特征信息以及所述访问凭证。
第二生成模块160，用于根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证。
具体的，所述客户端的特征信息包括所述客户端的公钥和/或所述客户端的过期时间。
具体的，第二生成模块160根据所述访问目的对应的访问码以及访问指令中所述客户端的公钥和/或访问指令中所述客户端的过期时间生成验证凭证。
验证模块170，用于若所述验证凭证与所述访问指令中的访问凭证一致，则所述访问指令通过验证。
在一些可行的实施例中，第一获取模块110获取的客户端发送的访问请求还包括所述客户端的公钥。如图10所示，访问凭证验证装置还包括：
第一验证单元101、用于根据所述访问请求中所述客户端的公钥验证所述客户端是否合法。
若合法，第二获取模块120获取所述访问目的对应的访问码。
在一些可行的实施例中，第三获取模块150获取的客户端发送的访问指令还包括所述客户端的私钥签名。如图10所示，访问凭证验证装置还包括：
第二验证单元102、用于根据所述访问指令中所述客户端的公钥验证所述私钥签名是否正确。
若正确，第二生成模块160根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证。
在一些可行的实施例中，如图11所示，访问凭证验证装置还包括：
第三验证单元103、用于根据所述访问指令中所述客户端的过期时间判断所述访问凭证是否过期。
若未过期，第二生成模块160根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证。
需要说明的是，所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和各模块、单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
本申请的方法、装置可用于众多通用或专用的计算系统环境或配置中。例如：个人计算机、服务器计算机、手持设备或便携式设备、平板型设备、多处理器系统、基于微处理器的系统、机顶盒、可编程的消费电子设备、网络PC、小型计算机、大型计算机、包括以上任何系统或设备的分布式计算环境等等。
示例性的，上述的方法、装置可以实现为一种计算机程序的形式，该计算机程序可以在如图12所示的计算机设备上运行。
请参阅图12，图12是本申请实施例提供的一种计算机设备的结构示意图。该计算机设备可以是服务器。
参阅图12，该计算机设备包括通过系统总线连接的处理器、存储器和网络接口，其中，存储器可以包括非易失性存储介质和内存储器。
非易失性存储介质可存储操作系统和计算机程序。该计算机程序包括程序指令，该程序指令被执行时，可使得处理器执行任意一种访问凭证验证方法。
处理器用于提供计算和控制能力，支撑整个计算机设备的运行。
内存储器为非易失性存储介质中的计算机程序的运行提供环境，该计算机程序被处理器执行时，可使得处理器执行任意一种访问凭证验证方法。
该网络接口用于进行网络通信，如发送分配的任务等。本领域技术人员可以理解，图12中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
应当理解的是，处理器可以是中央处理单元(Central Processing Unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。其中，通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
其中，在一个实施例中，所述处理器用于运行存储在存储器中的计算机程序，以实现本申请实施例提供的任一项访问凭证验证方法的步骤。
通过以上的实施方式的描述可知，本领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例或者实施例的某些部分所述的方法，如：
一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序中包括程序指令，所述处理器执行所述程序指令，实现本申请实施例提供的任一项访问凭证验证方法。
其中，所述计算机可读存储介质可以是前述实施例所述的计算机设备的内部存储单元，例如所述计算机设备的硬盘或内存。所述计算机可读存储介质也可以是所述计算机设备的外部存储设备，例如所述计算机设备上配备的插接式硬盘，智能存储卡(Smart Media Card，SMC)，安全数字(Secure Digital，SD)卡，闪存卡(Flash Card)等。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (20)

  1. 一种访问凭证验证方法，包括：
    获取客户端发送的访问请求，所述访问请求包括访问目的；
    获取所述访问目的对应的访问码；
    根据所述访问码以及所述客户端的特征信息生成访问凭证；
    将生成的访问凭证发送给所述客户端；
    获取客户端发送的访问指令，所述访问指令包括所述访问目的、所述客户端的特征信息以及所述访问凭证；
    根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证；
    若所述验证凭证与所述访问指令中的访问凭证一致，则所述访问指令通过验证。
  2. 如权利要求1所述的访问凭证验证方法，其中，所述访问目的包括所述客户端请求访问的网络地址和/或所述客户端所请求访问文件的文件标识。
  3. 如权利要求1所述的访问凭证验证方法，其中，所述客户端的特征信息包括所述客户端的公钥；
    所述根据所述访问码以及所述客户端的特征信息生成访问凭证，具体包括：
    根据所述访问码以及所述客户端的公钥生成访问凭证；
    所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证，具体包括：
    根据所述访问目的对应的访问码以及访问指令中所述客户端的公钥生成验证凭证。
  4. 如权利要求3所述的访问凭证验证方法，其中，所述访问请求还包括所述客户端的公钥；
    所述获取所述访问目的对应的访问码之前，还包括：
    根据所述访问请求中所述客户端的公钥验证所述客户端是否合法；
    若合法，获取所述访问目的对应的访问码。
  5. 如权利要求3所述的访问凭证验证方法，其中，所述访问指令还包括所述客户端的私钥签名；
    所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证之前，还包括：
    根据所述访问指令中所述客户端的公钥验证所述私钥签名是否正确；
    若正确，根据所述访问目的对应的访问码以及所述客户端的特征信息生成 验证凭证。
  6. 如权利要求1-5中任一项所述的访问凭证验证方法，其中，所述客户端的特征信息包括所述客户端的过期时间；
    所述根据所述访问码以及所述客户端的特征信息生成访问凭证，具体包括：
    根据所述访问码以及所述客户端的过期时间生成访问凭证；
    所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证，具体包括：
    根据所述访问目的对应的访问码以及访问指令中所述客户端的过期时间生成验证凭证。
  7. 如权利要求6所述的访问凭证验证方法，其中，所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证之前，还包括：
    根据所述访问指令中所述客户端的过期时间判断所述访问凭证是否过期；
    若未过期，根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证。
  8. 一种访问凭证验证装置，包括：
    第一获取模块，用于获取客户端发送的访问请求，所述访问请求包括访问目的；
    第二获取模块，用于获取所述访问目的对应的访问码；
    第一生成模块，用于根据所述访问码以及所述客户端的特征信息生成访问凭证；
    发送模块，用于将生成的访问凭证发送给所述客户端；
    第三获取模块，用于获取客户端发送的访问指令，所述访问指令包括所述访问目的、所述客户端的特征信息以及所述访问凭证；
    第二生成模块，用于根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证；
    验证模块，用于若所述验证凭证与所述访问指令中的访问凭证一致，则所述访问指令通过验证。
  9. 一种计算机设备，其中，所述计算机设备包括存储器和处理器；
    所述存储器用于存储计算机程序；
    所述处理器，用于执行所述计算机程序并在执行所述计算机程序时实现如 下步骤：
    获取客户端发送的访问请求，所述访问请求包括访问目的；
    获取所述访问目的对应的访问码；
    根据所述访问码以及所述客户端的特征信息生成访问凭证；
    将生成的访问凭证发送给所述客户端；
    获取客户端发送的访问指令，所述访问指令包括所述访问目的、所述客户端的特征信息以及所述访问凭证；
    根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证；
    若所述验证凭证与所述访问指令中的访问凭证一致，则所述访问指令通过验证。
  10. 根据权利要求9所述的计算机设备，其中，所述处理器在实现所述根据所述访问码以及所述客户端的特征信息生成访问凭证时，用于实现如下步骤：
    根据所述访问码以及所述客户端的公钥生成访问凭证；
    所述处理器在实现所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证时，用于实现如下步骤：
    根据所述访问目的对应的访问码以及访问指令中所述客户端的公钥生成验证凭证。
  11. 根据权利要求10所述的计算机设备，其中，所述处理器在实现所述获取所述访问目的对应的访问码之前，还用于实现如下步骤：
    根据所述访问请求中所述客户端的公钥验证所述客户端是否合法；
    若合法，获取所述访问目的对应的访问码。
  12. 根据权利要求10所述的计算机设备，其中，所述处理器在实现所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证之前，还用于实现如下步骤：
    根据所述访问指令中所述客户端的公钥验证所述访问请求中的私钥签名是否正确；
    若正确，根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证。
  13. 根据权利要求9-12中任一项所述的计算机设备，其中，所述处理器在实现所述根据所述访问码以及所述客户端的特征信息生成访问凭证时，用于实 现如下步骤：
    根据所述访问码以及所述客户端的过期时间生成访问凭证；
    所述处理器在实现所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证时，用于实现如下步骤：
    根据所述访问目的对应的访问码以及访问指令中所述客户端的过期时间生成验证凭证。
  14. 根据权利要求13所述的计算机设备，其中，所述处理器在实现所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证之前，还用于实现如下步骤：
    根据所述访问指令中所述客户端的过期时间判断所述访问凭证是否过期；
    若未过期，根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证。
  15. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，若所述计算机程序被处理器执行，实现如下步骤：
    获取客户端发送的访问请求，所述访问请求包括访问目的；
    获取所述访问目的对应的访问码；
    根据所述访问码以及所述客户端的特征信息生成访问凭证；
    将生成的访问凭证发送给所述客户端；
    获取客户端发送的访问指令，所述访问指令包括所述访问目的、所述客户端的特征信息以及所述访问凭证；
    根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证；
    若所述验证凭证与所述访问指令中的访问凭证一致，则所述访问指令通过验证。
  16. 根据权利要求15所述的存储介质，其中，所述处理器在实现所述根据所述访问码以及所述客户端的特征信息生成访问凭证时，用于实现如下步骤：
    根据所述访问码以及所述客户端的公钥生成访问凭证；
    所述处理器在实现所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证时，用于实现如下步骤：
    根据所述访问目的对应的访问码以及访问指令中所述客户端的公钥生成验证凭证。
  17. 根据权利要求16所述的存储介质，其中，所述处理器在实现所述获取所述访问目的对应的访问码之前，还用于实现如下步骤：
    根据所述访问请求中所述客户端的公钥验证所述客户端是否合法；
    若合法，获取所述访问目的对应的访问码。
  18. 根据权利要求16所述的存储介质，其中，所述处理器在实现所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证之前，还用于实现如下步骤：
    根据所述访问指令中所述客户端的公钥验证所述访问请求中的私钥签名是否正确；
    若正确，根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证。
  19. 根据权利要求15-18中任一项所述的存储介质，其中，所述处理器在实现所述根据所述访问码以及所述客户端的特征信息生成访问凭证时，用于实现如下步骤：
    根据所述访问码以及所述客户端的过期时间生成访问凭证；
    所述处理器在实现所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证时，用于实现如下步骤：
    根据所述访问目的对应的访问码以及访问指令中所述客户端的过期时间生成验证凭证。
  20. 根据权利要求19所述的存储介质，其中，所述处理器在实现所述根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证之前，还用于实现如下步骤：
    根据所述访问指令中所述客户端的过期时间判断所述访问凭证是否过期；
    若未过期，根据所述访问目的对应的访问码以及所述客户端的特征信息生成验证凭证。
PCT/CN2019/091903 2019-02-27 2019-06-19 访问凭证验证方法、装置、计算机设备及存储介质 WO2020173019A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910145579.3A CN109992976A (zh) 2019-02-27 2019-02-27 访问凭证验证方法、装置、计算机设备及存储介质
CN201910145579.3 2019-02-27

Publications (1)

Publication Number Publication Date
WO2020173019A1 true WO2020173019A1 (zh) 2020-09-03

Family

ID=67130210

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/091903 WO2020173019A1 (zh) 2019-02-27 2019-06-19 访问凭证验证方法、装置、计算机设备及存储介质

Country Status (2)

Country Link
CN (1) CN109992976A (zh)
WO (1) WO2020173019A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110443070A (zh) * 2019-08-12 2019-11-12 南京芯驰半导体科技有限公司 多主机共享存储系统及数据完整性保护方法
CN112910900B (zh) * 2021-02-03 2023-04-07 叮当快药科技集团有限公司 文件访问控制方法、装置、设备和存储介质
CN113992420B (zh) * 2021-10-29 2023-12-01 蜂巢能源科技(无锡)有限公司 一种权限管理方法、系统，电子设备和存储介质
CN115061826B (zh) * 2022-02-28 2024-02-13 华为技术有限公司 一种组件通信方法及计算设备
CN115277168B (zh) * 2022-07-25 2023-05-26 绿盟科技集团股份有限公司 一种访问服务器的方法以及装置、系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140215210A1 (en) * 2013-01-30 2014-07-31 Huawei Device Co., Ltd Data Sharing Method and Device
CN109150528A (zh) * 2018-11-07 2019-01-04 杭州海兴电力科技股份有限公司 一种电表数据访问方法、装置、设备及可读存储介质
CN109150910A (zh) * 2018-10-11 2019-01-04 平安科技（深圳）有限公司 登录令牌生成及验证方法、装置及存储介质
CN109347637A (zh) * 2018-08-01 2019-02-15 华为技术有限公司 一种认证方法、内容分发网络cdn和内容服务器

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103428235B (zh) * 2012-05-15 2018-08-17 上海博路信息技术有限公司 一种数据交换系统
CN107306246A (zh) * 2016-04-18 2017-10-31 北京市神州百戏文化产业有限公司 基于访问密钥的数据获取方法
CN106295401A (zh) * 2016-08-13 2017-01-04 深圳市樊溪电子有限公司 一种用于区块链的只读安全文件存储系统及其方法
CN106899570B (zh) * 2016-12-14 2019-11-05 阿里巴巴集团控股有限公司 二维码的处理方法、装置及系统
CN106844111B (zh) * 2016-12-26 2021-01-08 深圳创新科技术有限公司 云存储网络文件系统的访问方法
CN109039990B (zh) * 2017-06-08 2020-07-07 腾讯科技（深圳）有限公司 基于验证码进行行为验证的方法及装置
CN108289100B (zh) * 2018-01-25 2019-11-12 北京深思数盾科技股份有限公司 一种安全访问方法、终端设备及系统
CN109344647A (zh) * 2018-09-12 2019-02-15 上海点融信息科技有限责任公司 用于区块链网络的访问凭证生成方法、数据访问方法、存储介质、计算设备
CN109194673B (zh) * 2018-09-20 2021-08-03 江苏满运软件科技有限公司 基于用户授权信息的认证方法、系统、设备及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140215210A1 (en) * 2013-01-30 2014-07-31 Huawei Device Co., Ltd Data Sharing Method and Device
CN109347637A (zh) * 2018-08-01 2019-02-15 华为技术有限公司 一种认证方法、内容分发网络cdn和内容服务器
CN109150910A (zh) * 2018-10-11 2019-01-04 平安科技（深圳）有限公司 登录令牌生成及验证方法、装置及存储介质
CN109150528A (zh) * 2018-11-07 2019-01-04 杭州海兴电力科技股份有限公司 一种电表数据访问方法、装置、设备及可读存储介质

Also Published As

Publication number Publication date
CN109992976A (zh) 2019-07-09

Similar Documents

Publication Publication Date Title
US11558381B2 (en) Out-of-band authentication based on secure channel to trusted execution environment on client device
US11784791B2 (en) Verifying an identity based on multiple distributed data sources using a blockchain to safeguard the identity
US11475137B2 (en) Distributed data storage by means of authorisation token
US10771459B2 (en) Terminal apparatus, server apparatus, blockchain and method for FIDO universal authentication using the same
US11122028B2 (en) Control method for authentication/authorization server, resource server, and authentication/authorization system
WO2020173019A1 (zh) 访问凭证验证方法、装置、计算机设备及存储介质
CN107005568B (zh) 数据安全操作与预期
CA2975843A1 (en) Apparatus, system, and methods for a blockchain identity translator
US20130212382A1 (en) Device-bound certificate authentication
US10742651B2 (en) Digital identity network interface system
CN110535884B (zh) 跨企业系统间访问控制的方法、装置及存储介质
US20230412399A1 (en) Database Multi-Authentication Method and System, Terminal, and Storage Medium
TWM595792U (zh) 跨平台授權存取資源的授權存取系統
US10318725B2 (en) Systems and methods to enable automatic password management in a proximity based authentication
CN116529729A (zh) 用于获得基于网络的资源的增强权限并根据其执行动作的集成电路
CN106992978B (zh) 网络安全管理方法及服务器
US20240039707A1 (en) Mobile authenticator for performing a role in user authentication
CN112738005A (zh) 访问处理方法、装置、系统、第一认证服务器及存储介质
CN111107055B (zh) 一种实现ca统一认证平台用户认证登录方法及系统
US20230224309A1 (en) Method and system for digital identity and transaction verification
WO2024120636A1 (en) Managing authorisations for local object sharing and integrity protection
TW202127289A (zh) 跨平台授權存取資源方法及授權存取系統
JP2023132934A (ja) 認証情報署名システム、認証装置、認証情報署名プログラム及び認証情報署名方法
CN116305313A (zh) 一种权限管理系统、方法、装置及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19916779

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19916779

Country of ref document: EP

Kind code of ref document: A1