WO2020215709A1

WO2020215709A1 - Identity authentication method and system, computer device, and storage medium

Info

Publication number: WO2020215709A1
Application number: PCT/CN2019/119479
Authority: WO
Inventors: 王丽
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-04-25
Filing date: 2019-11-19
Publication date: 2020-10-29
Also published as: CN110213229A; CN110213229B

Abstract

Disclosed are an identity authentication method and system, a computer device, and a storage medium. The identity authentication method comprises: a serving party receives a service call request sent by a consuming party, the service call request comprising consumption code information and authorization relation encryption information; the authorization relation encryption information comprising consumption code-service code calling relation information; according to the consumption code information, check whether a service key is pre-stored in the serving party; if the service key is pre-stored in the serving party, use the service key to decrypt the authorization relation encryption information to obtain the consumption code-service code calling relation information; verify whether the consumption code-service code calling relation information is legal according to the consumption code information and the pre-stored service code information; and if yes, in response to the service call request, return a corresponding service resource to the consuming party. The identity authentication method can solve the large network consumption problem during the process that the serving party performs identity authentication on the consuming party.

Description

Identity authentication method, system, computer equipment and storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on April 25, 2019, the application number is 201910341167.7, and the invention title is "identity authentication method, system, computer equipment and storage medium", the entire content of which is incorporated by reference In this application.

Technical field

This application relates to the field of computer technology, in particular to an identity authentication method, system, computer equipment and storage medium.

Background technique

Internet services are inseparable from identity authentication. For server clusters, or a cross-domain service-oriented architecture, when consumers (that is, consumers of services, such as application systems that call various service interfaces) cross-domain access to service providers (that is, service provision) For example, when providing resources of the application system of each service interface, since there is no prior trust relationship between the consumer and the server, the server needs to authenticate the consumer to determine whether it has access rights. In the prior art, the service party needs to rely on a third-party authentication data source (that is, it needs to rely on a third-party authentication center for identity authentication) in the process of authenticating the consumer's identity, which greatly increases the consumption of network queries.

Therefore, how to reduce the consumption of network queries during the process of the service party's identity authentication of the consumer is a technical problem to be solved urgently by those skilled in the art.

technical problem

The main purpose of this application is to provide an identity authentication method, system, computer equipment, and storage medium, aiming to solve the problem of high network consumption during the process of identity authentication by the service party to the consumer.

Technical solutions

This application proposes an identity authentication method, including:

The service party receives the service invocation request sent by the consumer, where the service invocation request includes the consumption code information of the consumer and the authorization relation encryption information pre-stored in the consumer, and the authorization relation encryption information contains consumption code-service code invocation relation information;

According to the consumption code information, check whether the service key corresponding to the consumption code information is pre-stored;

If it is checked that the service key corresponding to the consumption code information is pre-stored, the service key is used to decrypt the authorization relationship encryption information to obtain the consumption code-service code call relationship information;

According to the consumption code information and the pre-stored service code information, verify the consumption code-service code call relationship information, and determine whether the consumption code-service code call relationship information is legal;

If the consumption code-service code call relationship information is valid, the service call request is responded to and the corresponding service resource is returned to the consumer.

This application also proposes a permission application method, including:

The consumer sends a service registration request to the service registration center to register the service of the service party, where the service registration request includes the consumption code information of the consumer;

Receive the service information of the service party returned by the service registration center in response to the service registration request, where the service information includes service code information;

According to the service code information and pre-stored consumption code information, generate consumption code-service code call relationship information;

Send a permission application request to the service registration center, where the permission application request includes consumer code-service code invocation relationship information;

The receiving service registration center returns and saves the authorization relationship encryption information in response to the permission application request, wherein the authorization relationship encryption information contains consumption code-service code invocation relationship information.

This application also proposes an identity authentication system, including:

The service registration center is used to generate service key and authorization relationship encryption information, store service information of the service party, provide service key for the service party, and provide authorization relationship encryption information and service information for the consumer, where the authorization relationship encryption information Contains consumption code-service code call relationship information, and service information includes service code information;

Consumer, used to generate consumption code-service code call relationship information based on service code information and its own consumption code information, obtain and save authorization relationship encryption information and service information from the service registry, and send service call requests to service providers , Where the service invocation request includes consumption encoding information and authorization relationship encryption information;

The service party is used to register its own service information to the service registration center, obtain and save the service key from the service registration center, and determine whether the consumer has the right to call its own service resources according to the service invocation request sent by the consumer.

This application also proposes a computer device, including a memory and a processor, the memory stores a computer program, and the processor implements the steps of the aforementioned identity authentication method when the computer program is executed.

This application also proposes a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned identity authentication method are realized.

This application also proposes an identity authentication device, including:

The first receiving module is used for the service party to receive the service invocation request sent by the consumer, wherein the service invocation request includes the consumption code information of the consumer and the authorization relationship encryption information pre-stored in the consumer. The authorization relationship encryption information contains consumer code-service code call relationship information;

The checking module is configured to check whether the service key corresponding to the consumption coding information is pre-stored in itself according to the consumption coding information;

The decryption module is configured to, if it is checked that the service key corresponding to the consumption code information is pre-stored, the service key is used to decrypt the authorization relationship encryption information to obtain the consumption code-service code call relationship information ；

The verification module is configured to verify the consumption code-service code invocation relationship information according to the consumption code information and prestored service code information, and determine whether the consumption code-service code invocation relationship information is legal;

The return module is configured to respond to the service invocation request and return the corresponding service resource to the consumer if the consumption code-service code invocation relationship information is legal.

This application also provides a permission application device, including:

The sending module is used for the consumer to send a service registration request to the service registration center to register the service of the service party, wherein the service registration request includes the consumption code information of the consumer;

The second receiving module is configured to receive the service information of the service party returned by the service registration center in response to the service registration request, wherein the service information includes service code information;

A generating module, configured to generate consumption code-service code invocation relationship information according to the service code information and the prestored consumption code information;

The request module is configured to send a permission application request to the service registration center, where the permission application request includes the consumption code-service code invocation relationship information;

The saving module is configured to receive and save the authorization relationship encryption information returned by the service registration center in response to the authorization request request, wherein the authorization relationship encryption information contains the consumption code-service code invocation relationship information.

Beneficial effect

The beneficial effects of this application are: in the identity authentication method provided by the embodiments of this application, the service party’s identity verification of the consumer is achieved through algorithms, except for the first identity authentication process, the consumer needs to obtain information from the service registration center The authorization relationship encryption information, the server needs to obtain the service key from the service registration center, and every time after that, when the server authenticates the consumer, it only needs to decrypt and verify the authorization relationship encryption information sent by the consumer. , Without relying on third-party authentication data sources, which can reduce the consumption of network queries.

Description of the drawings

Figure 1 is a schematic flow diagram of an identity authentication method in an implementation of this application;

Figure 2 is a schematic flow diagram of a permission application method in the implementation of this application;

Figure 3 is a schematic diagram of the structure of an identity authentication system in an implementation of this application;

Fig. 4 is a schematic diagram of the structure of a computer device in an implementation of the present application.

The realization of the objectives, functional characteristics and advantages of the present invention will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

The best mode of the invention

It should be understood that the specific embodiments described here are only used to explain the present invention, but not to limit the present invention.

1 and 3, an embodiment of the present application provides an identity authentication method, which is applied to an identity authentication system, the identity authentication system includes a consumer, a server, and a service registry, and the consumer, a server, and a service registry They can communicate with each other in the form of a network. The identity authentication method includes:

S11, the service party receives the service invocation request sent by the consumer, where the service invocation request includes the consumption code information of the consumer and the authorization relationship encryption information pre-stored in the consumer, and the authorization relationship encryption information contains the consumption code-service code invocation relationship information;

S12, according to the consumption code information, check whether the service key corresponding to the consumption code information is pre-stored;

If it is checked that the service key corresponding to the consumption code information is pre-stored, S13 is executed to decrypt the authorization relationship encrypted information using the service key to obtain consumption code-service code call relationship information;

S14: Verify the consumption code-service code call relationship information according to the consumption code information and the pre-stored service code information, and determine whether the consumption code-service code call relationship information is legal;

If the consumption code-service code call relationship information is valid, execute S15, respond to the service call request, and return the corresponding service resource to the consumer.

In the above step S11, the consumption code information is the unique identity of the consumer, and different consumers have different consumption code information; the authorization relationship encryption information is the consumption code-service code invocation relationship information encrypted by the service key , Used to realize the security authentication of the identity of the consumer by the service party, where the specific expression form of the consumer code-service code call relationship information can be represented by Cn-Pn, where Cn is the consumer code information corresponding to the consumer n, Pn Is the service code information corresponding to the service party n (the service code information is the unique identity of the service party, and different service parties have different service code information). Therefore, through the consumption code-service code call relationship information, the consumer and the The call relationship between the service parties, that is, a consumer needs to call a service resource of a server, for example, consumer 1 needs to call the service resource of server 1, then the consumption code-service code call relationship information can be C1-P1 Means

In this step, specifically, when the server starts for the first time, the server will register its own service information in the service registry, where the service information of the server includes the name of the server, the service code information of the server, The server’s IP address and port, the server’s request address, etc.; when the consumer first calls the server’s service resources, the consumer first needs to register the server’s service. Specifically, the consumer receives the account and password entered by the user Log in to the service registration center. After the login is successful, the consumer sends a service registration request to the service registration center for registering the service side service, where the service registration request includes the consumer's consumption code information, when the service registration center receives the service registration When requested, the service registration center will respond to the service registration request, randomly generate and save a service key corresponding to the consumption code information, and return the service information of the service to the consumer. When the consumer receives the service information, the consumer The party will generate consumption code-service code call relationship information based on the service code information in the service information and its own consumption code information, and then the consumer will send a permission request for applying for access to the service party to the service registration center, where the permission The application request includes consumption code-service code call relationship information, consumer IP address information and the above consumption code information. When the service registration center receives the permission application request, the service registration center will respond to the permission application request based on the consumption code information Find the previously generated service key corresponding to the consumption code information, and use the service key to encrypt the consumption code-service code call relationship information, thereby generating the above-mentioned authorization relationship encryption information, and then returning the authorization relationship encryption information to the consumer The consumer receives the encrypted information of the authorization relationship and saves it. When the consumer calls the service resource of the server, the consumer finds the request address of the server from the service information saved by itself, and then sends a request address to the server via http A service call request, where the authorization relationship encryption information and the consumer's consumption code information are placed in the http request header for subsequent related operations.

In the above step S12, specifically, when the server receives the authorization relationship encryption information and the consumption code information sent by the consumer, in order to verify whether the current consumer has access rights, the server needs to check the consumption code-service code call relationship The legitimacy of the information, therefore, it is necessary to decrypt the encrypted information of the authorization relationship first to obtain the consumption code-service code call relationship information, and decrypt the encrypted information of the authorization relationship requires a service key, so it is necessary to check whether it is pre-stored according to the consumption code information There is a corresponding service key for subsequent related operations.

In the above step S13, if the service party checks that it has a corresponding service key pre-stored, it can directly use the service key to decrypt the authorization relationship encryption information to obtain consumption code-service code call relationship information for subsequent correlation Operation, and if the service party checks that it does not have the corresponding service key pre-stored, it indicates that the service party authenticates the current consumer for the first time. Therefore, it needs to obtain the corresponding service key from the service registry first. Specifically, When the service party checks that it does not have the corresponding service key pre-stored, the service party sends a key acquisition request to the service registration center, where the key acquisition request includes the consumption code information of the current consumer. When the service registration center When receiving the key acquisition request, the service registration center will obtain multiple service keys from the saved service keys according to the consumption code information (when different consumers register the services of different service parties through the service registration center, the service registration center will The service registration request of the party generates and saves different service keys. Therefore, there are multiple service keys stored in the service registry). The service key corresponding to the consumption code information is searched out and returned to the service party, and the service party receives the service. The key is saved, and the service key is used to decrypt the encrypted information of the authorization relationship to obtain the consumption code-service code call relationship information. In this way, when the subsequent service party needs to authenticate the current consumer again, it only needs to be based on The current consumption code information of the consumer can find the corresponding service key from the multiple pre-stored service keys, without obtaining the corresponding service key from the service registration center again.

In the above step S14, after using the corresponding service key to decrypt the consumption code-service code invocation relationship information from the authorization relationship encryption information, then further use its own service code information and the received consumption code information to determine the consumption code-service The code call relationship information is verified to determine whether the consumption code-service code call relationship information is legal. For example, suppose the consumption code information sent by the current consumer to the server is C1 (that is, the current consumer is consumer 1), The service code information of the server is P1, and the consumer code-service code call relationship information obtained by decryption is C1-P1. During verification, the server will match P1 and C1 with C1-P1 to determine whether there is a match , If there is only one of the matching items (C1 or P1) or there is no matching item (that is, neither C1 nor P1 match), it means that the consumption code-service code call relationship information provided by the current consumer is illegal, and the current consumption The party does not have the authority to access the service resources of the service party 1. On the contrary, if there are matching items C1 and P1 at the same time, it means that the consumption code-service code call relationship information provided by the current consumer is legal, and the current consumer has access to the service party 1. In this example, since the consumption code information is C1, the service code information is P1, and the consumption code-service code call relationship information obtained by decryption is C1-P1, so when verifying, you will finally get At the same time there is a matching result of the matching items C1 and P1, so the server 1 can determine that the current consumer 1 has the right to access its own service resources, and in other examples, such as the consumption code information sent by the current consumer to the server Is C1, the service code information of the server is P1, and the consumer code-service code call relationship information obtained by decryption is C2-P1. When verification is performed, the matching result that there is only one matching item P1 will eventually be obtained, and then the server 1 Based on this, it can be judged that the current consumer 1 does not have the authority to access its own service resources. At the same time, this also shows that the consumer 2 has the authority to access the service resources of the server 1, and the authorization relationship encryption information of the consumer 2 is likely to be Misappropriated by consumer 1.

In the above step S15, if the consumer code-service code call relationship information is legal, the service party can determine that the current consumer has the right to access its own service resources, and then respond to the service call request sent by the current consumer to the consumer Return the corresponding service resource.

In this embodiment, the identity verification of the consumer by the service party is implemented through an algorithm. Except in the first identity authentication process, the consumer needs to obtain the authorization relationship encryption information from the service registry, and the service party needs to obtain the encryption information from the service registry. Obtain the service key. After that, every time the service party authenticates the consumer, it only needs to decrypt and verify the authorization relationship encrypted information sent by the consumer, instead of relying on a third-party authentication data source. Reduce the consumption of network queries, and the service party’s authentication of the consumer’s identity is achieved through a symmetric encryption algorithm. It only uses the service key to encrypt the consumer code-service code call relationship information, so that the generated encrypted data (ie authorization The relationship encryption information) is shorter, so that when the service party authenticates the consumer, it helps to shorten the decryption time, thereby reducing the time-consuming authentication of the right and improving the performance of the system.

In addition, in this embodiment, it should be noted that when the consumer has the consumption code-service code call relationship information, the consumer does not have the right to access the service party at this time, and only after obtaining the authorization relationship encrypted information (ie The consumer code-service code call relationship information needs to be encrypted by the service key), so that the consumer has the authority to access the service party. This prevents the consumer from tampering with the consumer code-service code call relationship information (because the consumer does not have the service secret Key), freely call the service resources of different service parties to ensure the security and reliability of service resource acquisition.

In a preferred embodiment, the encrypted information of the authorization relationship is accompanied by a timestamp, and after the step of receiving the service invocation request sent by the consumer, the method further includes:

S11A: Determine whether the encrypted information of the authorization relationship expires according to the timestamp;

If the encrypted information of the authorization relationship has not expired, the above S12 is executed to check whether the service key corresponding to the consumption code information is pre-stored according to the consumption code information.

In this embodiment, since the longer the storage time of the encrypted information of the authorization relationship, the greater the risk of leakage. Therefore, the service registry can put a time stamp on the encrypted information of the authorization relationship when it generates the encrypted information of the authorization relationship, so that the encrypted information of the authorization relationship has timeliness. The consumer needs to use the authorization relationship to encrypt the information within the valid time to obtain the service resource of the service party. In this way, the security of the service resource acquisition can be guaranteed to a certain extent. Specifically, because the timestamp can uniquely identify a certain The time of the time, and the timeliness of the time stamp and the encrypted information of the authorization relationship are the time attributes of the message. Therefore, it can be judged whether the encrypted information of the authorization relationship expires according to whether the time identified by the timestamp is within the valid time of the message, for example, The time indicated by the timestamp is 13:14:52 on January 1, 2019 (that is, the generation time of the authorization relationship encrypted information + the preset effective time, if the preset effective time is 7 days, the authorization relationship encrypted information is generated The time is 13:14:52 on December 25, 2019, where the preset effective time can be determined according to the needs of use), and the time when the encrypted information of the authorization relationship reaches the service party is 13:14:50 on January 1, 2019 Since 13:14:50 on January 1, 2019 is before 13:14:52 on January 1, 2019, the service party can determine that the encrypted information of the authorization relationship has not expired. For example, the time stamp The time of identification is 13:14:52 on January 1, 2019, and the time at which the encrypted information of the authorization relationship reaches the service party is 13:14:56 on January 1, 2019, due to 13:14 on January 1, 2019 Minutes and 56 seconds are after 13:14:52 on January 1, 2019, so the service party can determine that the encryption information of the authorization relationship has expired; if the encryption information of the authorization relationship has not expired, the above step S12 can be performed at this time; and If the encrypted information of the authorization relationship has expired, step S11B can be executed at this time.

In a preferred embodiment, after the step of judging whether the consumption code-service code call relationship information is legal, the method further includes:

If the consumption code-service code call relationship information is legal, execute S14A, use the preset MD5 algorithm to calculate the consumption code-service code call relationship information, obtain the corresponding MD5 value and save;

S14B: Send the MD5 value to the consumer for storage.

In this embodiment, if the consumption code-service code call relationship information is legal, it indicates that the current consumer has the right to access the service resource of the service party. At this time, the service party can respond to the service call request sent by the current consumer to the consumer Return the corresponding service resource. At the same time, the service party can use the preset MD5 algorithm to calculate the consumption code-service code call relationship information, obtain and save the corresponding MD5 value, and send the MD5 value to the consumer, and the consumer receives Save the MD5 value after reaching the MD5 value. Because the MD5 value is unique (one-to-one correspondence with the consumer code-service code call relationship information) and cannot be tampered with (once it is tampered, the MD5 value will change), so the MD5 value It can replace the authorization relationship to encrypt information to realize the security authentication of the consumer's identity by the server. In this way, the subsequent consumer can apply for calling the service resource of the server by sending the MD5 value to the server. The received MD5 value is compared with the pre-stored MD5 value to determine whether the current consumer has the access authority. In this way, the process of using the service key to decrypt the authorization relationship encrypted information can be omitted, which is beneficial to further reduce the authority verification Time-consuming to further improve the performance of the system.

In another preferred embodiment, after the step of judging whether the encrypted information of the authorization relationship expires according to the timestamp, the method further includes:

If the encrypted information of the authorization relationship has expired, execute S11B to send a prompt message indicating that the identity has expired to the consumer to prompt the consumer to re-authenticate;

S11C: Receive the MD5 value and consumption code information returned by the consumer in response to the prompt message, and check whether there is a corresponding pre-stored MD5 value according to the consumption code information;

If there is a corresponding pre-stored MD5 value, execute S11D, compare the MD5 value with the pre-stored MD5 value, and judge whether the MD5 value is consistent with the pre-stored MD5 value;

If the MD5 value is consistent with the pre-stored MD5 value, execute S11E, respond to the service call request, and return the corresponding service resource to the consumer.

In the above step S11B, if the encrypted information of the authorization relationship has expired, it indicates that the current consumer does not have the authority to access the service resource of the service party. At this time, the service sends a prompt message indicating that the identity has expired to the consumer to prompt the consumer to re-identify verification.

In the above step S11C, when the consumer successfully invokes the service resource of the server for the first time, the MD5 value that can replace the encrypted information of the authorization relationship can be obtained from the server, so when the consumer receives the prompt message that the identity is expired sent by the server At this time, the consumer can respond to the prompt message to return the consumption code information and the previously saved MD5 value to the server, and then the server checks whether there is a corresponding pre-stored MD5 value according to the received consumption code information, so as to enter step S11D to perform related operations .

In the above step S11D, if the server detects that there is a corresponding pre-stored MD5 value, it will further compare the received MD5 value with the pre-stored MD5 value to determine whether the two are consistent. If the two are consistent, it indicates the current consumer Have access rights; if the two are inconsistent, it means that the current consumer does not have access rights. At this time, the service party can send a prompt message indicating that the identity verification failed to the consumer, and the consumer needs to obtain the authorization relationship from the service registry again. Encrypted information (the consumer will send a permission request request to the service registration center. At this time, the permission request includes the consumer's IP address information and consumer code information) to re-call the service resource of the service provider.

In the above step S11E, if the MD5 value received by the server is consistent with the pre-stored MD5 value, it indicates that the current consumer has access rights. At this time, the server can respond to the service invocation request and return the corresponding service resource to the consumer.

In this embodiment, when the authorization relationship encryption information expires, the consumer can re-apply and call the service resource by resending the MD5 value and consumption code information, without having to re-obtain the authorization relationship encryption from the service registry In this way, it can reduce the dependence on the service registration center, which is beneficial to further reduce the consumption of network queries. At the same time, the consumer sends the consumption code information at the same time as the MD5 value. The advantage of this is that it can Prevent the impersonation of the identity caused by the leakage of MD5 value. For example, due to various reasons, the MD5 value of consumer 1 is stolen by consumer 2, then consumer 2 wants to use the MD5 value to apply for the service resource of the service party Due to the predetermined authentication mechanism, the consumer 2 needs to send its own consumption code information and the MD5 value to the server, but because the consumer 1’s consumption code information is different from the consumer 2’s consumption code information, the server is in During verification, either the pre-stored MD5 value corresponding to consumer 2’s consumption code information cannot be found, or the MD5 value is inconsistent with the pre-stored MD5 value, which leads to identity verification failure, making consumer 2 unable to impersonate consumer 1’s Identity to call the service resources of the server; moreover, this also helps the server to quickly find the corresponding MD5 value for verification based on the consumption code information, without having to match one by one from multiple pre-stored MD5 values, and find the matching one. Pre-stored MD5 value (because the server can be called by different consumers with access rights, the server will store multiple different MD5 values), which helps to reduce the time-consuming verification of rights and improve the performance of the system.

In another preferred embodiment, after the step of determining whether the MD5 value is consistent with the pre-stored MD5 value, the method further includes:

If the MD5 value is consistent with the pre-stored MD5 value, execute S11F to refresh the timestamp on the encrypted information of the authorization relationship;

S11G sends the refreshed authorization relationship encryption information and the reminder information for replacing the authorization relationship encryption information to the consumer to remind the consumer to replace the expired authorization relationship encryption information with the refreshed authorization relationship encryption information.

In this embodiment, if the MD5 value is consistent with the pre-stored MD5 value, it indicates that the current consumer has access rights. At this time, it is necessary to avoid the problem of identity expiration when the current consumer applies for service resources of the service party next time For secondary identity authentication, the server can refresh the time stamp on the encrypted information of the authorization relationship. For example, the time identified by the timestamp is 13:14:52 on January 1, 2019, and the encrypted information of the authorization relationship reaches the server The time is 13:14:56 on January 1, 2019. Assuming that the preset valid time is 7 days, when the service party determines that the current consumer has access rights through the MD5 value, the service party can check the timestamp The identification time is refreshed to 13:14:52 on January 8, 2019, and then the refreshed authorization relationship encryption information is sent to the consumer, and a reminder message is sent to notify the consumer to change the authorization relationship encryption information, when the consumer receives After the refreshed authorization relationship encryption information and reminder information, the consumer replaces the expired authorization relationship encryption information with the refreshed authorization relationship encryption information, so that when the consumer next applies for the service resource of the service party, There will be no problem of identity expiration and the need to pass MD5 value for secondary identity authentication, which is beneficial to reduce the time-consuming of authentication, improve the performance of the system, and also improve the flexibility of identity authentication.

2 and 3, the embodiment of the application also proposes a permission application method, applied to an identity authentication system, the identity authentication system includes a consumer, a service party and a service registry, the consumer, a service party and a service registry three Persons can communicate with each other in the form of a network. The permission application method includes:

S21: The consumer sends a service registration request to the service registration center to register the service of the service party, where the service registration request includes the consumption code information of the consumer;

S22: Receive the service information of the service party returned by the service registration center in response to the service registration request, where the service information includes service code information;

S23: Generate consumption code-service code call relationship information according to the service code information and pre-stored consumption code information;

S24: Send a permission application request to the service registration center, where the permission application request includes consumption code-service code invocation relationship information;

S25: The receiving service registration center responds to the authorization request request and returns the authorization relationship encryption information and saves it, where the authorization relationship encryption information contains consumption code-service code invocation relationship information.

In the above step S21, when the consumer first calls the service resource of the server, the consumer first needs to register the service of the server. Specifically, the consumer logs in to the service registration center by receiving the account and password entered by the user. After the login is successful, The consumer sends a service registration request to the service registration center for registering the service provider’s service, where the service registration request includes the consumer’s consumption code information. In this way, only if a service provider’s service is registered through the service registration center, the consumption The party can then apply to call the service resource of the service party.

In the above step S22, when the server starts for the first time, the server will register its own service information in the service registration center, where the service information of the server includes the name of the server, the service code information of the server, and the server Specifically, when the service registration center receives the service registration request sent by the consumer, the service registration center will respond to the service registration request and randomly generate a service corresponding to the consumption code information The key is saved and the service information of the server is returned to the consumer.

In the above step S23, when the consumer receives the service information returned by the service registration center, the consumer will generate consumption code-service code invocation relationship information based on the service code information in the service information and its own consumption code information for subsequent follow-up Perform related operations.

In the above step S24, specifically, after the consumption code-service code call relationship information is generated, the consumer sends a permission application request to the service registration center, where the permission application request includes the consumption code-service code call relationship information, and the consumer’s The IP address information and the consumption code information of the consumer to apply for the authority to call the service resource of the server.

In the above step S25, when the service registration center receives the permission application request, the service registration center saves the consumer's IP address information, and at the same time responds to the permission application request, finds out the previously generated corresponding consumption code information based on the consumption code information And use the service key to encrypt the consumption code-service code call relationship information to generate the authorization relationship encryption information, and then return the authorization relationship encryption information to the consumer, and the consumer receives the authorization relationship encryption information And save, in this way, the convenience of consumption has the authority to access the server. When the consumer needs to call the service resource of the server later, the consumer only needs to find the request address of the server from the service information saved by itself, and then use http Just send a service invocation request to the server in the form of, where the authorization relationship encryption information and the consumer's consumption encoding information are placed in the http request header; in addition, in specific application scenarios, the consumer generally has multiple hosts, The user specifically invokes the service resource of the server by using a certain host of the consumer. Therefore, the IP address information of the consumer is the IP address corresponding to the host used by the user. In this way, when the subsequent user changes the host to apply for invoking the service For service resources of the party, the replaced host needs to re-send a permission request to the service registration center to obtain the encryption information of the authorization relationship, where the permission request request includes the host’s IP address and the consumer’s consumption code information In this way, the service registration center can learn which hosts of the consumer have obtained the encrypted information of the authorization relationship by querying the saved IP address information, so as to achieve the role of auditing changes in consumption instances.

In this embodiment, the consumer's application for permission to access the server is implemented through an algorithm. Except for the first permission application process, the consumer needs to obtain the encrypted information of the authorization relationship from the service registry. Every time thereafter, when the consumer When you need to apply for the service resource of the service party, you only need to use the authorization relationship encrypted information and consumption code saved by yourself to call, without relying on a third-party authentication data source, thereby reducing the consumption of network queries.

In a preferred embodiment, the authorization relationship encryption information is stored in the consumer's cache folder, where the cache folder is encrypted by the consumer's local hardware information (such as Mac address, model information, etc.). The above permission application method Also includes:

S26, comparing the pre-stored hardware information with the local hardware information, and judging whether the hardware information is consistent with the local hardware information, to obtain the authorization relationship encryption information in the cache folder;

If the hardware information is consistent with the local hardware information, execute S27 to send a service invocation request to the service server to obtain the service resource of the server, where the service invocation request includes consumption encoding information and authorization relationship encryption information.

In this embodiment, when the user needs to request the service resource of the service party through a certain host of the consumer, he needs to obtain the authorization relationship encryption information from the cache file, so the cache folder is decrypted first. Specifically, the The host compares its own pre-stored hardware information (such as the Mac address) with the local hardware information, and judges whether the hardware information is consistent with the local hardware information. If they are consistent, it preliminarily indicates that the current host has the authority to call the service resource of the server, and then it can Send a service call request including consumption code information and authorization relationship encryption information to the service server to obtain the service resources of the server; if they are inconsistent, the current host cannot obtain the authorization relationship encryption information from the cache file, and thus cannot call the server In this way, the consumer saves the encrypted information of the authorization relationship in the cache file encrypted by the local hardware information. When a certain host of the consumer needs to call the service resource of the server, it needs to pass its own local hardware The information decrypts the cached file, which prevents the encrypted information of the authorization relationship from being copied to another host of the consumer for use (the host of the consumer changes, and the local hardware information also changes, thereby obtaining the encrypted information of the authorization relationship), Improved data security.

3, an embodiment of the present application also proposes an identity authentication system, including:

Consumer, used to generate consumption code-service code call relationship information based on service code information and its own consumption code information, obtain and save authorization relationship encryption information and service information from the service registry, and send service call requests to service providers , Where the service invocation request includes consumption coding information and authorization relationship encryption information;

In this embodiment, the principle and process of mutual communication among the service registration center, the consumer and the service party can refer to the relevant description of the above method embodiment, which can be understood by those skilled in the art, and will not be repeated here.

Referring to FIG. 4, an embodiment of the present application also provides a computer device. The computer device may be a server, and its internal structure may be as shown in FIG. 4. The computer equipment includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the computer designed processor is used to provide calculation and control capabilities. The memory of the computer device includes a storage medium and an internal memory, where the storage medium may be a non-volatile storage medium or a volatile storage medium. The storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the storage medium. The database of the computer equipment is used to store identity authentication methods and programs. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the identity authentication method in any of the foregoing embodiments is implemented.

The embodiment of the present application also proposes a computer-readable storage medium, where the storage medium may be a non-volatile storage medium or a volatile storage medium. A computer program is stored on the storage medium, and when the computer program is executed by the processor, the identity authentication method in any of the foregoing embodiments is implemented.

Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by computer programs instructing relevant hardware. The computer programs can be stored and a non-volatile computer readable storage In the medium, when the computer program is executed, it may include the procedures of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and/or volatile memory. Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not a limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-rate data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

It should be noted that in this article, the terms "including", "including" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements not only includes those elements, It also includes other elements not explicitly listed, or elements inherent to the process, device, article, or method. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, device, article or method that includes the element.

The above are only the preferred embodiments of the present invention, and do not limit the scope of the present invention. Any equivalent structure or equivalent process transformation made by using the content of the description and drawings of the present invention, or directly or indirectly applied to other related The technical field is also included in the scope of patent protection of the present invention.

Claims

An identity authentication method, characterized in that it comprises:

The service party receives the service invocation request sent by the consumer, wherein the service invocation request includes the consumption code information of the consumer and the authorization relationship encryption information pre-stored in the consumer, and the authorization relationship encryption information contains the consumption Coding-service code calling relationship information;

According to the consumption code information, check whether the service key corresponding to the consumption code information is pre-stored in itself;

If it is checked that the service key corresponding to the consumption code information is pre-stored, the service key is used to decrypt the authorization relationship encryption information to obtain the consumption code-service code call relationship information;

Verifying the consumption code-service code invocation relationship information according to the consumption code information and the pre-stored service code information, and determine whether the consumption code-service code invocation relationship information is legal;

If the consumption code-service code invocation relationship information is valid, respond to the service invocation request and return the corresponding service resource to the consumer.
The identity authentication method according to claim 1, wherein the encrypted information of the authorization relationship is accompanied by a time stamp, and after the step of receiving the service invocation request sent by the consumer, the method further comprises:

Judging whether the encrypted information of the authorization relationship expires according to the timestamp;

If the encryption information of the authorization relationship has not expired, the step of checking whether the service key corresponding to the consumption coding information is pre-stored according to the consumption coding information is performed.
The identity authentication method according to claim 2, wherein after the step of judging whether the consumption code-service code call relationship information is legal, the method further comprises:

If the consumption code-service code calling relationship information is legal, use a preset MD5 algorithm to calculate the consumption code-service code calling relationship information to obtain the corresponding MD5 value and save it;

The MD5 value is sent to the consumer for storage.
The identity authentication method according to claim 3, wherein after the step of judging whether the encrypted information of the authorization relationship has expired according to the timestamp, the method further comprises:

If the encryption information of the authorization relationship has expired, sending a prompt message indicating that the identity has expired to the consumer to prompt the consumer to perform identity verification again;

Receiving the MD5 value and the consumption code information returned by the consumer in response to the prompt information, and check whether there is a corresponding pre-stored MD5 value according to the consumption code information;

If there is a corresponding pre-stored MD5 value, compare the MD5 value with the pre-stored MD5 value to determine whether the MD5 value is consistent with the pre-stored MD5 value;

If the MD5 value is consistent with the pre-stored MD5 value, in response to the service invocation request, the corresponding service resource is returned to the consumer.
The identity authentication method according to claim 4, wherein after the step of determining whether the MD5 value is consistent with the pre-stored MD5 value, the method further comprises:

If the MD5 value is consistent with the pre-stored MD5 value, refresh the time stamp on the encrypted information of the authorization relationship;

Send the updated encryption information of the authorization relationship and the reminder information for replacing the encrypted information of the authorization relationship to the consumer to remind the consumer to replace the expired encrypted information of the authorization relationship with the refreshed The authorization relationship encrypts information.
A permission application method, characterized in that it includes:

The consumer sends a service registration request to the service registration center to register the service of the service party, wherein the service registration request includes the consumption code information of the consumer;

Receiving the service information of the service party returned by the service registration center in response to the service registration request, wherein the service information includes service code information;

Generate consumption code-service code call relationship information according to the service code information and the prestored consumption code information;

Sending a permission application request to the service registration center, where the permission application request includes the consumption code-service code invocation relationship information;

The service registration center returns and saves authorization relationship encryption information in response to the permission application request, wherein the authorization relationship encryption information contains the consumption code-service code invocation relationship information.
The permission application method according to claim 6, wherein the encryption information of the authorization relationship is stored in a cache folder of the consumer, wherein the cache folder is processed by the local hardware information of the consumer. Encryption, the permission application method further includes:

Comparing the pre-stored hardware information with the local hardware information to determine whether the hardware information is consistent with the local hardware information, so as to obtain the authorization relationship encryption information in the cache folder;

If the hardware information is consistent with the local hardware information, a service invocation request is sent to the service server to obtain the service resource of the server, where the service invocation request includes the consumption coding information and the The authorization relationship encrypted information.
An identity authentication system is characterized in that it comprises:

The service registration center is used to generate the service key and authorization relationship encryption information, store the service information of the service party, provide the service key for the service party, and provide the consumer with the authorization relationship encryption information and the service Information, wherein the authorization relationship encryption information contains consumption code-service code invocation relationship information, and the service information includes service code information;

The consumer is used to generate consumption code-service code call relationship information based on the service code information and its own consumption code information, obtain and save the authorization relationship encryption information and the service information from the service registration center, and Sending a service invocation request to the service server, where the service invocation request includes the consumption encoding information and the authorization relationship encryption information;

The service party is used to register its own service information to the service registration center, obtain and save the service key from the service registration center, and determine the service call request sent by the consumer Whether the consumer has the authority to call its own service resources.
A computer device includes a memory and a processor, the memory stores a computer program, and is characterized in that when the processor executes the computer program, an identity authentication method is implemented, and the identity authentication method includes:

The service party receives the service invocation request sent by the consumer, wherein the service invocation request includes the consumption code information of the consumer and the authorization relationship encryption information pre-stored in the consumer, and the authorization relationship encryption information contains the consumption Coding-service code calling relationship information;

According to the consumption code information, check whether the service key corresponding to the consumption code information is pre-stored in itself;

If it is checked that the service key corresponding to the consumption code information is pre-stored, the service key is used to decrypt the authorization relationship encryption information to obtain the consumption code-service code call relationship information;

Verifying the consumption code-service code invocation relationship information according to the consumption code information and the pre-stored service code information, and determine whether the consumption code-service code invocation relationship information is legal;

If the consumption code-service code invocation relationship information is valid, respond to the service invocation request and return the corresponding service resource to the consumer.
The computer device according to claim 9, wherein the encrypted information of the authorization relationship is attached with a time stamp, and after the step of receiving the service invocation request sent by the consumer, the method further comprises:

Judging whether the encrypted information of the authorization relationship expires according to the timestamp;

If the encryption information of the authorization relationship has not expired, the step of checking whether the service key corresponding to the consumption coding information is pre-stored according to the consumption coding information is performed.
The computer device according to claim 10, wherein after the step of judging whether the consumption code-service code call relationship information is legal, the method further comprises:

If the consumption code-service code calling relationship information is legal, use a preset MD5 algorithm to calculate the consumption code-service code calling relationship information to obtain the corresponding MD5 value and save it;

The MD5 value is sent to the consumer for storage.
The computer device according to claim 11, wherein after the step of judging whether the encrypted information of the authorization relationship has expired according to the timestamp, the method further comprises:

If the encryption information of the authorization relationship has expired, sending a prompt message indicating that the identity has expired to the consumer to prompt the consumer to perform identity verification again;

Receiving the MD5 value and the consumption code information returned by the consumer in response to the prompt information, and check whether there is a corresponding pre-stored MD5 value according to the consumption code information;

If there is a corresponding pre-stored MD5 value, compare the MD5 value with the pre-stored MD5 value to determine whether the MD5 value is consistent with the pre-stored MD5 value;

If the MD5 value is consistent with the pre-stored MD5 value, in response to the service invocation request, the corresponding service resource is returned to the consumer.
The computer device according to claim 12, wherein after the step of determining whether the MD5 value is consistent with the pre-stored MD5 value, the method further comprises:

If the MD5 value is consistent with the pre-stored MD5 value, refresh the time stamp on the encrypted information of the authorization relationship;

Send the updated encryption information of the authorization relationship and the reminder information for replacing the encrypted information of the authorization relationship to the consumer to remind the consumer to replace the expired encrypted information of the authorization relationship with the refreshed The authorization relationship encrypts information.
A computer-readable storage medium with a computer program stored thereon, wherein the computer program implements an identity authentication method when executed by a processor, and the identity authentication method includes:

The service party receives the service invocation request sent by the consumer, wherein the service invocation request includes the consumption code information of the consumer and the authorization relationship encryption information pre-stored in the consumer, and the authorization relationship encryption information contains the consumption Coding-service code calling relationship information;

According to the consumption code information, check whether the service key corresponding to the consumption code information is pre-stored in itself;

If it is checked that the service key corresponding to the consumption code information is pre-stored, the service key is used to decrypt the authorization relationship encryption information to obtain the consumption code-service code call relationship information;

Verifying the consumption code-service code invocation relationship information according to the consumption code information and the pre-stored service code information, and determine whether the consumption code-service code invocation relationship information is legal;

If the consumption code-service code invocation relationship information is valid, respond to the service invocation request and return the corresponding service resource to the consumer.
The computer-readable storage medium according to claim 14, wherein the encrypted information of the authorization relationship is accompanied by a time stamp, and after the step of receiving the service invocation request sent by the consumer, the method further comprises:

Judging whether the encrypted information of the authorization relationship expires according to the timestamp;

If the encryption information of the authorization relationship has not expired, the step of checking whether the service key corresponding to the consumption coding information is pre-stored according to the consumption coding information is performed.
The computer-readable storage medium according to claim 15, wherein after the step of determining whether the consumption code-service code call relationship information is legal, the method further comprises:

If the consumption code-service code calling relationship information is legal, use a preset MD5 algorithm to calculate the consumption code-service code calling relationship information to obtain the corresponding MD5 value and save it;

The MD5 value is sent to the consumer for storage.
The computer-readable storage medium according to claim 16, wherein after the step of judging whether the encrypted information of the authorization relationship has expired according to the timestamp, the method further comprises:

If the encryption information of the authorization relationship has expired, sending a prompt message indicating that the identity has expired to the consumer to prompt the consumer to perform identity verification again;

Receiving the MD5 value and the consumption code information returned by the consumer in response to the prompt information, and check whether there is a corresponding pre-stored MD5 value according to the consumption code information;

If there is a corresponding pre-stored MD5 value, compare the MD5 value with the pre-stored MD5 value to determine whether the MD5 value is consistent with the pre-stored MD5 value;

If the MD5 value is consistent with the pre-stored MD5 value, in response to the service invocation request, the corresponding service resource is returned to the consumer.
18. The computer-readable storage medium according to claim 17, wherein after the step of determining whether the MD5 value is consistent with the pre-stored MD5 value, the method further comprises:

If the MD5 value is consistent with the pre-stored MD5 value, refresh the time stamp on the encrypted information of the authorization relationship;

Send the refreshed encryption information of the authorization relationship and the reminder information for replacing the encrypted information of the authorization relationship to the consumer to remind the consumer to replace the expired encrypted information of the authorization relationship with the refreshed The authorization relationship encrypts information.
An identity authentication device is characterized by comprising:

The first receiving module is used for the service party to receive the service invocation request sent by the consumer, wherein the service invocation request includes the consumption code information of the consumer and the authorization relationship encryption information pre-stored in the consumer. The authorization relationship encryption information contains consumer code-service code call relationship information;

The checking module is configured to check whether the service key corresponding to the consumption coding information is pre-stored in itself according to the consumption coding information;

The decryption module is configured to, if it is checked that the service key corresponding to the consumption code information is pre-stored, the service key is used to decrypt the authorization relationship encryption information to obtain the consumption code-service code call relationship information ；

The verification module is configured to verify the consumption code-service code invocation relationship information according to the consumption code information and prestored service code information, and determine whether the consumption code-service code invocation relationship information is legal;

The return module is configured to respond to the service invocation request and return the corresponding service resource to the consumer if the consumption code-service code invocation relationship information is legal.
A permission application device, characterized in that it comprises:

The sending module is used for the consumer to send a service registration request to the service registration center to register the service of the service party, wherein the service registration request includes the consumption code information of the consumer;

The second receiving module is configured to receive the service information of the service party returned by the service registration center in response to the service registration request, wherein the service information includes service code information;

A generating module, configured to generate consumption code-service code invocation relationship information according to the service code information and the prestored consumption code information;

The request module is configured to send a permission application request to the service registration center, where the permission application request includes the consumption code-service code invocation relationship information;

The saving module is configured to receive and save the authorization relationship encryption information returned by the service registration center in response to the authorization request request, wherein the authorization relationship encryption information contains the consumption code-service code invocation relationship information.