WO2020252897A1 - 全链路数据鉴权方法、装置、设备及存储介质 - Google Patents

全链路数据鉴权方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2020252897A1
WO2020252897A1 PCT/CN2019/102497 CN2019102497W WO2020252897A1 WO 2020252897 A1 WO2020252897 A1 WO 2020252897A1 CN 2019102497 W CN2019102497 W CN 2019102497W WO 2020252897 A1 WO2020252897 A1 WO 2020252897A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
user token
user
link
agent
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/102497
Other languages
English (en)
French (fr)
Inventor
洪耿杰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ping An Technology Shenzhen Co Ltd
Original Assignee
Ping An Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ping An Technology Shenzhen Co Ltd filed Critical Ping An Technology Shenzhen Co Ltd
Publication of WO2020252897A1 publication Critical patent/WO2020252897A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Definitions

  • This application relates to the field of information security, in particular to full-link data authentication methods, devices, equipment and storage media.
  • the full link monitoring component can monitor the associated actions of the distributed system in different applications and different servers.
  • a user reporting data usually needs to call multiple service nodes.
  • the user reporting data of the service link needs to be monitored in order to detect and deal with problems in the service link in time.
  • the data reported on the whole link is simply authenticated based on the user name and password, or authentication is not performed.
  • the inventor realizes that this will bring various problems, such as some important user information, especially sensitive data, which is transmitted in clear text. It will cause the user's data to be vulnerable to attacks, and will also cause a large amount of junk data to be reported.
  • the main purpose of this application is to solve the technical problem of the user data being attacked due to un-authentication or simple authentication of data reported on the entire link, and a large amount of junk data is reported.
  • the first aspect of the present application provides a full-link data authentication method, including: receiving data reported by the link; parsing the data reported by the link to obtain a user token and a unique identification of the agent And the user IP address; perform authentication according to the user token, the unique identifier of the agent, and the user IP address; if the authentication fails, discard the data reported by the link; if the authentication succeeds, collect the Data reported by the link.
  • the second aspect of the present application provides a full-link data authentication device, including: a receiving unit for receiving data reported by a link; and a parsing unit for analyzing the data reported by the link to obtain the user order Brand token, the agent’s unique identifier and the user’s IP address; the authentication unit is used to authenticate according to the user token, the agent’s unique identifier, and the user’s IP address; the first processing unit, if the authentication fails, Used to discard the data reported by the link; the second processing unit, if the authentication succeeds, is used to collect the data reported by the link.
  • a third aspect of the present application provides a full-link data authentication device, including: a memory and at least one processor, the memory stores instructions, and the memory and the at least one processor are interconnected by wires; At least one processor invokes the instruction in the memory, so that the full-link data authentication device executes the method described in the first aspect.
  • the fourth aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores computer instructions, and when the computer instructions run on a computer, the computer executes the above-mentioned first aspect method.
  • the data reported by the link is received; the data reported by the link is analyzed to obtain the user token token, the agent unique identifier and the user IP address; according to the user token and the agent unique identifier Perform authentication with the user IP address; if the authentication fails, discard the data reported by the link; if the authentication succeeds, collect the data reported by the link.
  • the authentication is performed according to the user token, the unique identifier of the agent agent and the user IP address, and the authentication result is obtained. According to the authentication result, it is determined whether to collect the data reported by the link, so as to filter the junk data reported by the link. .
  • FIG. 1 is a schematic diagram of an embodiment of a full-link data authentication method in an embodiment of this application;
  • Figure 2 is a schematic diagram of another embodiment of a full-link data authentication method in an embodiment of this application.
  • Figure 3 is a schematic diagram of an embodiment of a full-link data authentication device in an embodiment of the application
  • FIG. 4 is a schematic diagram of another embodiment of a full-link data authentication device in an embodiment of this application.
  • Figure 5 is a schematic diagram of an embodiment of a full-link data authentication device in an embodiment of the application.
  • the embodiment of the application provides a full-link data authentication method, device, device, and storage medium, which are used to perform authentication based on the user token, the unique identifier of the proxy agent, and the user IP address to obtain the authentication result, and according to the authentication result Determine whether to collect the data reported by the link to filter the junk data reported by the link.
  • the entire link is authenticated for the data reported to prevent junk data caused by user information leakage, prevent the full link monitoring server from being attacked, and ensure the usefulness of the data reported by the link.
  • An embodiment of the full-link data authentication method in the embodiment of the present application includes:
  • the server receives the data reported by the link. Specifically, the server sends the data reported by the link through the agent agent of the full link, and receives the data reported by the link sent by the agent through the data collection module collector in the full link.
  • the data reported by the link includes the user token, The agent unique identifier and user IP address.
  • the full-link monitoring system includes an agent agent, a data collection module collector, and a display terminal.
  • Each agent has its unique user token, agent unique identifier, and user IP address.
  • the agent is deployed in a full-link distributed system to monitor network connections and report data.
  • the collector is used to receive data and authenticate the received data, and the display terminal is used to display the data collected by the collector.
  • the server parses the data reported on the link to obtain the user token, the unique identifier of the agent, and the user IP address. Specifically, the server parses the data reported on the link according to a preset method to obtain the user token, the unique identifier of the agent agent, and the user IP address. The server determines whether the user token, the unique identifier of the agent agent, and the user IP address are empty. If one of the parameters of the user token, the unique identifier of the agent agent, and the user IP address is empty, the data reported on the link is determined to be invalid data, and the data reported on the link is discarded.
  • the user token is generated according to the JWT protocol, which is an open standard protocol based on JS object notation (JSON), applicable to scenarios such as popular distributed environments. It is very suitable for cross-platform applications.
  • the user token of the link generated according to the JWT protocol includes the header of the user token, the payload of the user token and the signature of the user token. The three parts use the separator ".” in order of priority Connect in sequence.
  • the unique identifier of the agent is globally unique.
  • the server uses a field in the database with an automatic growth identifier type or a universally unique identifier (UUID) generation library to set the unique identifier of the agent, which is not limited here. .
  • the server performs authentication based on the user's token, the unique identifier of the agent, and the user's IP address. Authentication refers to verifying whether the data reported by the link has the right to access the system. Specifically, the server divides the user token according to the JWT protocol. Further, the server divides the user token by the separator ".” according to the JWT protocol to obtain the header of the user token, the payload of the user token, and the signature of the user token. The three parts are in the form of strings, including symbols such as numbers and letters; the server decrypts the header of the user token with base64 to obtain the encryption algorithm declared by the header; the server performs the encryption algorithm on the header of the user token according to the encryption algorithm declared by the header.
  • the payload of the user token is combined and encrypted to obtain the signature to be verified; the server judges whether the signature to be verified is the same as the signature of the user token; if the signature to be verified is the same as the signature of the user token, the server will base64 decrypt the payload of the user token to obtain the user Token authentication information.
  • the server judges whether the authentication information of the user token is abnormal; if the authentication information of the user token is abnormal, it is determined that the authentication has failed, and step 104 is executed. For example, if the authentication information of the user token is empty, it is determined that the authentication has failed; If there is no abnormality in the authentication information of the user token, the server determines whether the authentication information of the user token includes the unique identifier of the agent; if the authentication information of the user token does not include the unique identifier of the agent, the server determines that the authentication has failed and executes step 104, For example, if the unique identifier of the agent is 1000 and the unique identifier of the agent in the authentication information of the user token is 1001, the two do not match, and the authentication is determined to fail; if the authentication information of the user token includes the unique identifier of the agent, the server judges the user token If the authentication information of the user token does not include the user IP address, it is determined that the authentication has failed, and step 104 is executed.
  • the user IP address is A
  • the user in the authentication information of the user token If the IP address is B, the two do not match, it is determined that the authentication fails, and both A and B conform to the format of the IP address; if the authentication information of the user token includes the user IP address, it is determined that the authentication is successful, and step 105 is executed.
  • the server discards the data reported by the link.
  • Authentication failure means that the data sent by the agent does not pass the link's identity verification. It is invalid junk data. It refuses to collect, and waits for the next link to report the data cycle, and then re-authenticate the link data.
  • the server presets the authentication failure reason value according to the authentication failure. Once the authentication fails, the server sends the authentication failure reason value; obtains the authentication time; records the authentication failure reason value, the unique agent ID, and the user IP Address and authentication time; the server deletes the data reported by the link. For example, if the authentication information of the user token does not include the unique identifier of the agent, it is determined that the authentication fails, and the reason for the authentication failure is set to 501; if the authentication information of the user token does not include the user IP address, confirm the authentication If the authentication fails, set the reason for authentication failure to 502, which is not limited here.
  • the recording method can be in the form of a log or a database table, which is not specifically limited here.
  • the server collects the reported data. Specifically, the server sends the value of the reason for the successful authentication to notify the link to report that the data collection is successful. For example, set the reason for successful authentication to 200, and the agent receives the value. Value, confirm that the reported data is collected; at the same time, the server records the data reported by the link in the HBase database.
  • HBase is a highly reliable, high-performance, column-oriented and scalable distributed storage system. Large-scale structured storage clusters can be built using HBase technology. The goal of HBase is to store and process large-scale data. More specifically, it is only Need to use ordinary hardware configuration, can process large-scale data composed of thousands of rows and columns, suitable for full-link monitoring system.
  • the entire link is deployed through the agent agent non-invasively, which completely separates performance measurement and business logic, and is used to collect application-side monitoring data.
  • Set some parameters in the startup command such as the unique identification of the agent agent and data collection
  • the address of the module collector This method greatly improves collection efficiency and reduces operation and maintenance costs.
  • the authentication is performed according to the user token, the unique identifier of the agent agent and the user IP address, and the authentication result is obtained. According to the authentication result, it is determined whether to collect the data reported by the link, so as to filter the junk data reported by the link. . Based on the JWT protocol, the entire link is authenticated for the data reported to prevent junk data caused by user information leakage, prevent the full link monitoring server from being attacked, and ensure the usefulness of the data reported by the link.
  • FIG. 2 another embodiment of the full-link data authentication method in the embodiment of the present application includes:
  • the server receives the data reported by the link. Specifically, the server sends the data reported by the link through the agent agent of the full link, and receives the data reported by the link sent by the agent through the data collection module collector in the full link.
  • the data reported by the link includes the user token, The agent unique identifier and user IP address.
  • the full-link monitoring system includes an agent agent, a data collection module collector, and a display terminal.
  • Each agent has its unique user token, agent unique identifier, and user IP address.
  • the agent is deployed in a full-link distributed system to monitor network connections and report data.
  • the collector is used to receive data and authenticate the received data, and the display terminal is used to display the data collected by the collector.
  • the server parses the data reported on the link to obtain the user token, the unique identifier of the agent, and the user IP address. Specifically, the server parses the data reported on the link through a preset method to obtain the user token token, the unique agent agent ID, and the user IP address. The server determines whether the user token token, the agent agent unique ID, and the user IP address are empty. If one of the parameters of the user token, the unique identifier of the agent agent, and the user IP address is empty, the data reported on the link is determined to be invalid data, and the data reported on the link is discarded.
  • the user token is generated according to the JWT protocol, which is an open standard protocol based on JS object notation (JSON), applicable to scenarios such as popular distributed environments. It is very suitable for cross-platform applications.
  • the user token of the link generated according to the JWT protocol includes the header of the user token, the payload of the user token and the signature of the user token. The three parts use the separator ".” in order of priority Connect in sequence.
  • the unique identifier of the agent is globally unique.
  • the server uses a field in the database with an automatically growing identifier type or a universally unique identifier (UUID) generation library to set the unique identifier of the agent.
  • UUID includes the current time and clock Serial and globally unique IEEE machine identification number, UUID refers to a number generated on a machine, it is guaranteed to be unique to all machines in the same time and space.
  • the server parses the user token according to the JWT protocol to obtain the authentication information of the user token.
  • the authentication information of the user token includes the expiration time of the user token and authentication parameters.
  • the server divides the user token according to the JWT protocol, and further, the server divides the user token by the separator ".” according to the JWT protocol to obtain the header of the user token, the payload of the user token, and the user
  • the three parts of the token signature are in the form of strings, including characters such as numbers and letters.
  • the server performs base64 decryption on the head of the user token to obtain the encryption algorithm declared by the head. For example, the server decrypts based on base64, base64UrlDecode (the head of the user token), and the decryption result obtained is as follows:
  • the parameter typ is the type of the token
  • the parameter alg is the commonly used encryption hash algorithm
  • the encryption algorithm declared by the header is HS256.
  • the server encrypts the header of the user token and the payload of the user token according to the encryption algorithm declared in the header to obtain the signature to be verified.
  • the server uses the separator ".” for the header of the user token and the payload of the user token. "Connect to form a string, and then encrypt the string and the key according to the encryption method HS256 declared in the header to obtain the signature to be verified. For example, if the key is secret, the server performs the combined encryption process according to the encryption algorithm HS256 declared in the header. for,
  • HMACSHA256 head of user token + ".” + payload of user token, secret
  • the secret is the key of the user token, which is consistent with the encryption process of the user token.
  • the server judges whether the signature to be verified is the same as the signature of the user token; if the signature to be verified is the same as the signature of the user token, the server performs base64 decryption on the payload of the user token to obtain the authentication information of the user token.
  • the payload of the user token stores valid information, including registration statement, public statement and private statement.
  • the server obtains the private statement part including the unique identifier of the agent and the user’s IP address, for example:
  • the server also obtains the parameters in the registration statement, such as the expiration time parameter exp, which is in a timestamp format.
  • the server performs authentication according to the authentication information of the user token, the unique identifier of the agent, and the user IP address. Specifically, the server determines whether the authentication information of the user token is abnormal, for example, if the authentication information of the user token is If it is empty, it is determined that the authentication has failed; if the authentication information of the user token is abnormal, it is determined that the authentication has failed, and step 205 is executed.
  • the server determines whether the authentication information of the user token includes the unique identification of the agent agent; if the authentication information of the user token does not include the unique identification of the agent, the server determines If the authentication fails, go to step 205.
  • step 206 is executed. For example, if the unique ID of the agent is 1000, and the unique ID of the agent in the authentication information of the user token is 1001, then the two do not match, and the authentication is determined to fail; if the authentication of the user token is If the authorization information includes the unique identification of the agent, the server determines whether the authentication information of the user token includes the user IP address; if the authentication information of the user token does not include the user IP address, it is determined that the authentication has failed, and step 205 is executed. For example, if the user IP address is A, and the user IP address in the authentication information of the user token is B, the two do not match, it is determined that the authentication fails, and both A and B conform to the format of the IP address. If the authentication information of the user token includes the user IP address, it is determined that the authentication is successful, and step 206 is executed.
  • the server reads the configuration information and judges whether the preset value is the target threshold.
  • the target threshold is used to indicate authentication based on the expiration time of the user token; if the preset value is the target threshold, obtain the user token The expiration time of the user token; determine whether the expiration time of the user token is less than the current time, if the expiration time of the user token is less than the current time, it is determined that the authentication has failed, and step 205 is executed; if the expiration time of the user token is greater than If it is equal to the current time, it is determined that the authentication is successful, and step 206 is executed.
  • the target threshold for obtaining the preset value is 1, it means that the authentication is performed according to the expiration time of the user token, and the expiration time of the user token is in a timestamp format.
  • the configuration information can be stored in a file or data table, which is not limited here.
  • the server discards the data reported by the link.
  • Authentication failure means that the data reported on the link sent by the agent does not pass the identity verification. It is invalid junk data and refuses to collect. Waiting for the next cycle of link reporting data, re-authenticate the link data.
  • the server presets the authentication failure reason value according to the authentication failure. Once the authentication fails, the server sends the authentication failure reason value; obtains the authentication time; records the authentication failure reason value, the unique agent ID, and the user IP Address and authentication time; the server deletes the data reported by the link. For example, if the authentication information of the user token does not include the unique identifier of the agent, it is determined that the authentication fails, and the default reason for the authentication failure is 501; if the authentication information of the user token does not include the user IP address, it is determined that the authentication failed , The default reason for authentication failure is 502, which is not specifically limited here.
  • the recording method can be in the form of a log or a database table, which is not specifically limited here.
  • the server collects the data reported by the link. Specifically, if there is no abnormality in the authentication information of the user token, and the unique identification of the agent agent and the user IP address server are included, the authentication is determined to be successful. If the authentication is successful, the server sends the value of the reason for the successful authentication to notify the chain The end of the road report data, that is, the agent data collection is successful. For example, the reason for successful authentication is set to 200. The agent receives the value and confirms that the reported data is collected; at the same time, the server records the data reported by the link in the HBase database.
  • HBase is a highly reliable, high-performance, column-oriented and scalable distributed storage system. Large-scale structured storage clusters can be built using HBase technology. The goal of HBase is to store and process large-scale data. More specifically, it is only Need to use ordinary hardware configuration, can process large-scale data composed of thousands of rows and columns, suitable for full-link monitoring system.
  • the entire link is deployed through the agent agent non-invasively, which completely separates performance measurement and business logic, and is used to collect application-side monitoring data.
  • Set some parameters in the startup command such as the unique identification of the agent agent and data collection
  • the address of the module collector This method greatly improves collection efficiency and reduces operation and maintenance costs.
  • This application adopts the above-mentioned method to perform authentication based on the user token, the unique identifier of the proxy agent and the user IP address, and the authentication result is obtained. According to the authentication result, it is determined whether to collect the data reported by the link, so as to filter the spam reported by the link. data. Based on the JWT protocol, the entire link is authenticated for the data reported to prevent junk data caused by user information leakage, to prevent the full link monitoring server from being attacked, and to ensure the usefulness of the data reported by the link.
  • the receiving unit 301 is configured to receive data reported by the link
  • the parsing unit 302 is used to analyze the data reported by the link to obtain the user token, the unique identifier of the agent and the user IP address;
  • the authentication unit 303 is configured to perform authentication according to the user token, the unique identifier of the agent, and the user IP address;
  • the first processing unit 304 if the authentication fails, is used to discard the data reported by the link;
  • the second processing unit 305 is used to collect data reported by the link if the authentication is successful.
  • This application performs authentication based on the user token, the unique identifier of the proxy agent and the user IP address, and obtains the authentication result. According to the authentication result, it is determined whether to collect the data reported by the link, so as to filter the junk data reported by the link. Based on the JWT protocol, the entire link is authenticated for the data reported to prevent junk data caused by user information leakage, to prevent the full link monitoring server from being attacked, and to ensure the usefulness of the data reported by the link.
  • another embodiment of the full-link data authentication device in the embodiment of the present application includes:
  • the receiving unit 301 is configured to receive data reported by the link
  • the parsing unit 302 is used to analyze the data reported by the link to obtain the user token, the unique identifier of the agent and the user IP address;
  • the authentication unit 303 is configured to perform authentication according to the user token, the unique identifier of the agent, and the user IP address;
  • the first processing unit 304 if the authentication fails, is used to discard the data reported by the link;
  • the second processing unit 305 is used to collect data reported by the link if the authentication is successful.
  • the authentication unit 303 may further include:
  • the parsing subunit 3031 is used to analyze the user token according to the JWT protocol to obtain authentication information of the user token;
  • the first judgment subunit 3032 is used to judge whether the authentication information of the user token is abnormal
  • the first processing subunit 3033 is used to determine that the authentication fails if the authentication information of the user token is abnormal;
  • the first authentication subunit 3034 if there is no abnormality in the authentication information of the user token, is used to perform authentication according to the authentication information of the user token, the unique identifier of the agent, and the user IP address.
  • parsing subunit 3031 may also be specifically used for:
  • the user token is divided to obtain the user token's header, the user token's payload, and the user token's signature;
  • base64 decrypts the payload of the user token to obtain the authentication information of the user token.
  • the first authentication subunit 3034 may also be specifically used for:
  • the authentication information of the user token does not include the unique identifier of the agent, it is determined that the authentication fails;
  • authentication information of the user token includes the unique identification of the agent agent, then it is determined whether the authentication information of the user token includes the user IP address;
  • the authentication information of the user token includes the user IP address, it is determined that the authentication is successful.
  • the first processing unit 304 may also be specifically configured to:
  • the second processing unit 305 may also be specifically configured to:
  • the authentication unit 303 may further include:
  • Reading subunit 3035 for reading preset values
  • the second judging subunit 3036 is used to judge whether the preset value is a target threshold, and the target threshold is used to indicate authentication according to the expiration time of the user token;
  • the second authentication subunit 3037 if the preset value is the target threshold, is used to obtain the expiration time of the user token;
  • the third judgment subunit 3038 is used to judge whether the expiration time of the user token is less than the current time
  • the second processing subunit 3039 if the expiration time of the user token is less than the current time, is used to determine that the authentication fails;
  • the third processing subunit 30310 is used to determine that the authentication is successful if the expiration time of the user token is greater than or equal to the current time.
  • This application performs authentication based on the user token, the unique identifier of the proxy agent and the user IP address, and obtains the authentication result. According to the authentication result, it is determined whether to collect the data reported by the link, so as to filter the junk data reported by the link. Based on the JWT protocol, the entire link is authenticated for the data reported to prevent junk data caused by user information leakage, to prevent the full link monitoring server from being attacked, and to ensure the usefulness of the data reported by the link.
  • FIG. 5 is a schematic structural diagram of a full-link data authentication device provided by an embodiment of the present application.
  • the full-link data authentication device 500 may have relatively large differences due to different configurations or performance, and may include one or more A processor (central processing unit, CPU) 501 (for example, one or more processors) and a memory 509, and one or more storage media 508 (for example, one or more storage devices with a large amount of storage) storing application programs 507 or data 506.
  • the memory 509 and the storage medium 508 may be short-term storage or persistent storage.
  • the program stored in the storage medium 508 may include one or more modules (not shown in the figure), and each module may include a series of command operations in the full-link data authentication.
  • the processor 501 may be configured to communicate with the storage medium 508, and execute a series of instruction operations in the storage medium 508 on the full-link data authentication device 500.
  • the full-link data authentication device 500 may also include one or more power supplies 502, one or more wired or wireless network interfaces 503, one or more input and output interfaces 504, and/or one or more operating systems 505, For example, Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc.
  • Windows Serve Windows Serve
  • Mac OS X Unix
  • Linux FreeBSD
  • FIG. 5 does not constitute a limitation on the full-link data authentication device, and may include more or less components than shown in the figure, or a combination Certain components, or different component arrangements.
  • the present application also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium.
  • the computer-readable storage medium stores computer instructions, and when the computer instructions are executed on the computer, the computer executes the following steps:
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请涉及信息安全领域，公开了全链路数据鉴权方法、装置、设备及存储介质。全链路数据鉴权方法包括：接收链路上报的数据；解析链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；根据用户token、agent唯一标识和用户IP地址进行鉴权；若鉴权失败，则丢弃链路上报的数据；若鉴权成功，则采集链路上报的数据。本申请基于JWT协议的方式对全链路上报数据进行身份验证，防止用户信息泄露导致的垃圾数据问题，防止全链路监控服务器受到攻击，确保链路上报数据的有用性。

Description

全链路数据鉴权方法、装置、设备及存储介质
本申请要求于2019年6月18日提交中国专利局、申请号为201910524196.7、发明名称为“全链路数据鉴权方法、装置、设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在申请中。
技术领域
本申请涉及信息安全领域，尤其涉及全链路数据鉴权方法、装置、设备及存储介质。
背景技术
在互联网技术高速发展的今天，需要通过集群部署来支撑日益增长的庞大业务量，同时又能根据业务需要进行灵活扩展，形成了分布式系统。
全链路监控组件可以监控分布式系统在不同应用、不同服务器的之间的关联动作。一次用户上报数据通常要调用多个服务节点，在系统运维中，需要对服务链路的用户上报数据进行监控，以便及时发现并处理服务链路中出现的问题。
目前全链路上报数据只是根据用户名和密码进行简单鉴权，或者不进行鉴权，发明人意识到这样会带来各种问题，比如一些重要的用户信息，尤其敏感数据，以明文方式传输，会导致用户的数据容易遭受攻击，也会造成大量的垃圾数据上报。
发明内容
本申请的主要目的在于解决全链路上报数据不鉴权或者简单鉴权导致的用户数据遭受攻击，大量的垃圾数据上报的技术问题。
为实现上述目的，本申请第一方面提供了一种全链路数据鉴权方法，包括：接收链路上报的数据；解析所述链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权；若鉴权失败，则丢弃所述链路上报的数据；若鉴权成功，则采集所述链路上报的数据。
本申请第二方面提供了一种全链路数据鉴权装置，包括：接收单元，用于接收链路上报的数据；解析单元，用于解析所述链路上报的数据，得到所述用户令牌token、代理agent唯一标识和用户IP地址；鉴权单元，用于根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权；第一处理单元，若鉴权失败，则用于丢弃所述链路上报的数据；第二处理单元，若鉴权成功，则用于采集所述链路上报的数据。
本申请第三方面提供了一种全链路数据鉴权设备，包括：存储器和至少一个处理器，所述存储器中存储有指令，所述存储器和所述至少一个处理器通过线路互联；所述至少一个处理器调用所述存储器中的所述指令，以使得所述全链路数据鉴权设备执行上述第一方面所述的方法。
本申请的第四方面提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令，当所述计算机指令在计算机上运行时，使得计算机执行上述第一方面所述的方法。
本申请提供的技术方案中，接收链路上报的数据；解析所述链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权；若鉴权失败，则丢弃所述链路上报的数据；若鉴权成功，则采集所述链路上报的数据。本申请实施例中，根据用户令牌token与代理agent唯一标识和用户IP地址进行鉴权，得到鉴权结果，根据鉴权结果确定是否采集链路上报的数据，实现过滤链路上报的垃圾数据。
附图说明
图1为本申请实施例中全链路数据鉴权方法的一个实施例示意图；
图2为本申请实施例中全链路数据鉴权方法的另一个实施例示意图；
图3为本申请实施例中全链路数据鉴权装置的一个实施例示意图；
图4为本申请实施例中全链路数据鉴权装置的另一个实施例示意图；
图5为本申请实施例中全链路数据鉴权设备的一个实施例示意图。
具体实施方式
本申请实施例提供了全链路数据鉴权方法、装置、设备及存储介质，用于根据用户令牌token与代理agent唯一标识和用户IP地址进行鉴权，得到鉴权结果，根据鉴权结果确定是否采集链路上报的数据，实现过滤链路上报的垃圾数据。基于JWT协议的方式对全链路上报数据进行身份验证，防止用户信息泄露导致的垃圾数据问题，防止全链路监控服务器受到攻击，确保链路上报数据的有用性。
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例进行描述。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”或“具有”及其任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
为便于理解，下面对本申请实施例的具体流程进行描述，请参阅图1，本申请实施例中全链路数据鉴权方法的一个实施例包括：
101、接收链路上报的数据；
服务器接收链路上报的数据。具体的，服务器通过全链路的代理agent发送链路上报的数据，通过全链路中的数据收集模块collector接收agent发送过来的链路上报的数据，链路上报的数据包括用户令牌token、代理agent唯一标识和用户IP地址。
需要说明的是，全链路监控系统包括代理agent，数据收集模块collector以及显示终端，每个agent都有其唯一的用户token、agent唯一标识和用户IP地址。agent部署在全链路分布式系统中，用于监控网络连接情况，并上报数据，collector用于接收数据并对接收的数据进行鉴权，显示终端用来展示collector采集的数据。
102、解析链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；
服务器解析链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址。具体的，服务器按照预置方式解析该链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址，服务器判断用户令牌token、代理agent唯一标识和用户IP地址是否为空，若用户令牌token、代理agent唯一标识和用户IP地址有一个参数为空，则确定此次链路上报的数据为无效数据，丢弃此次链路上报的数据。
需要说明的是，该用户令牌token为根据JWT协议生成的，该JWT协议是一种基于JS对象简谱(javascript object notation，JSON)的开放标准协议，适用场景比如现在流行的分布式环境当中，非常适用跨平台应用程序，根据JWT协议生成的链路的用户token，包括用户token的头部header、用户token的载荷payload和用户token的签名signature， 三个部分使用分隔符“.”按照先后顺序依次进行连接。该agent唯一标识是全局唯一的，服务器使用数据库中具有自动增长标识符类型的字段或者使用通用唯一识别码(universally unique identifier，UUID)的生成库进行设置代理agent唯一标识，具体此处不做限定。
103、根据用户token、agent唯一标识和用户IP地址进行鉴权；
服务器根据用户token、agent唯一标识和用户IP地址进行鉴权。鉴权是指验证链路上报的数据是否拥有访问系统的权利。具体的，服务器根据JWT协议对用户token进行分割，进一步地，服务器根据JWT协议通过分隔符“.”将该用户token进行分割，得到用户token的头部、用户token的载荷和用户token的签名，三个部分都为字符串形式，包括数字和字母等符号；服务器对用户token的头部进行base64解密，得到头部声明的加密算法；服务器根据头部声明的加密算法对用户token的头部和用户token的载荷进行组合加密，得到待验证签名；服务器判断待验证签名与用户token的签名是否相同；若待验证签名与用户token的签名相同，则服务器对用户token的载荷进行base64解密，得到用户token的鉴权信息。
服务器判断用户token的鉴权信息是否存在异常；若用户token的鉴权信息存在异常，则确定鉴权失败，执行步骤104，例如，若用户token的鉴权信息为空，则确定鉴权失败；若用户token的鉴权信息不存在异常，则服务器判断用户token的鉴权信息是否包括agent唯一标识；若用户token的鉴权信息不包括agent唯一标识，则服务器确定鉴权失败，执行步骤104，例如，agent唯一标识为1000，用户token的鉴权信息中的agent唯一标识为1001，则两者不匹配，确定鉴权失败；若用户token的鉴权信息包括agent唯一标识，则服务器判断用户token的鉴权信息是否包括用户IP地址；若用户token的鉴权信息不包括用户IP地址，则确定鉴权失败，执行步骤104，例如，用户IP地址为A，用户token的鉴权信息中的用户IP地址为B，则两者不匹配，确定鉴权失败，A与B均为符合IP地址的格式；若用户token的鉴权信息包括用户IP地址，则确定鉴权成功，执行步骤105。
104、若鉴权失败，则丢弃链路上报的数据；
若鉴权失败，则服务器丢弃链路上报的数据。鉴权失败说明通过agent发送的数据没有通过链路的身份验证，是无效的垃圾数据，拒绝采集，等待下一个链路上报数据周期，重新进行链路数据的鉴权。
具体的，服务器根据鉴权失败预设鉴权失败的原因值，一旦鉴权失败，服务器发送鉴权失败的原因值；获取鉴权时刻；记录鉴权失败的原因值、agent唯一标识、用户IP地址和鉴权时刻；服务器删除链路上报的数据。例如，若用户令牌token的鉴权信息不包括agent唯一标识，确定鉴权失败，设置其鉴权失败的原因值为501；若用户令牌token的鉴权信息不包括用户IP地址，确定鉴权失败，设置其鉴权失败的原因值为502，具体此处不做限定。
需要说明的是，记录鉴权失败的原因值、agent唯一标识、用户IP地址和鉴权时刻，以便于查询问题，该记录方式可以通过日志或者数据库表的方式，具体此处不做限定。
105、若鉴权成功，则采集链路上报的数据。
若鉴权成功，则服务器采集上报的数据，具体的，服务器发送鉴权成功的原因值，通知链路上报数据端数据采集成功，例如，设置鉴权成功的原因值为200，agent接收到该值，确认上报数据被采集；同时服务器将链路上报的数据记录在HBase数据库中。HBase是一个高可靠性、高性能、面向列和可伸缩的分布式存储系统，利用HBase技术可搭建大规模结构化存储集群，HBase的目标是存储并处理大型的数据，更具体来说是仅需使用普通的硬件配置，就能够处理由成千上万的行和列所组成的大型数据，适用于全链路监控系统。
需要说明的是，全链路通过代理agent无侵入式部署，将性能测量与业务逻辑完全分离，用于收集应用端监控数据，在启动命令中设置部分参数，例如，代理agent唯一标识以及数据收集模块collector的地址，这种方式大大提高了采集效率，并且减少运维成本。
本申请实施例中，根据用户令牌token与代理agent唯一标识和用户IP地址进行鉴权，得到鉴权结果，根据鉴权结果确定是否采集链路上报的数据，实现过滤链路上报的垃圾数据。基于JWT协议的方式对全链路上报数据进行身份验证，防止用户信息泄露导致的垃圾数据问题，防止全链路监控服务器受到攻击，确保链路上报数据的有用性。
请参阅图2，本申请实施例中全链路数据鉴权方法的另一个实施例包括：
201、接收链路上报的数据；
服务器接收链路上报的数据。具体的，服务器通过全链路的代理agent发送链路上报的数据，通过全链路中的数据收集模块collector接收agent发送过来的链路上报的数据，链路上报的数据包括用户令牌token、代理agent唯一标识和用户IP地址。
需要说明的是，全链路监控系统包括代理agent，数据收集模块collector以及显示终端，每个agent都有其唯一的用户token、agent唯一标识和用户IP地址。agent部署在全链路分布式系统中，用于监控网络连接情况，并上报数据，collector用于接收数据并对接收的数据进行鉴权，显示终端用来展示collector采集的数据。
202、解析链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；
服务器解析链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址。具体的，服务器通过预置方式解析该链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址，服务器判断用户令牌token、代理agent唯一标识和用户IP地址是否为空，若用户令牌token、代理agent唯一标识和用户IP地址有一个参数为空，则确定此次链路上报的数据为无效数据，丢弃此次链路上报的数据。
需要说明的是，该用户令牌token为根据JWT协议生成的，该JWT协议是一种基于JS对象简谱(javascript object notation，JSON)的开放标准协议，适用场景比如现在流行的分布式环境当中，非常适用跨平台应用程序，根据JWT协议生成的链路的用户token，包括用户token的头部header、用户token的载荷payload和用户token的签名signature，三个部分使用分隔符“.”按照先后顺序依次进行连接。该agent唯一标识是全局唯一的，服务器使用数据库中具有自动增长标识符类型的字段或者使用通用唯一识别码(universally unique identifier，UUID)的生成库进行设置代理agent唯一标识，UUID包括当前时刻、时钟序列和全局唯一的IEEE机器识别号，UUID是指在一台机器上生成的数字，它保证对在同一时空中的所有机器都是唯一的。
203、根据JWT协议对用户token进行解析，得到用户token的鉴权信息；
服务器根据JWT协议对用户token进行解析，得到用户token的鉴权信息。该用户token的鉴权信息包括用户token的过期时刻和鉴权参数。
具体的，首先，服务器根据JWT协议对用户token进行分割，进一步地，服务器根据JWT协议通过分隔符“.”对用户token进行字符串的分割，得到用户token的头部、用户token的载荷和用户token的签名，三个部分都为字符串形式，包括数字和字母等字符。
其次，服务器对用户token的头部进行base64解密，得到头部声明的加密算法，例如，服务器根据base64解密，base64UrlDecode(用户token的头部)，得到的解密结果如下所示，
{
  "alg":"HS256",
  "typ":"JWT"
}
其中，参数typ为令牌的类型，参数alg为常用的加密散列算法，得到头部声明的加密算法为HS256。
然后，服务器根据头部声明的加密算法对用户token的头部和用户token的载荷进行组合加密，得到待验证签名，具体的，服务器将用户token的头部和用户token的载荷使用分隔符“.”连接组成字符串，然后根据头部声明的加密方式HS256将字符串与密钥组合加密，得到待验证签名，例如，密钥为secret，服务器根据头部声明的加密算法HS256进行组合加密的流程为，
HMACSHA256(用户token的头部+"."+用户token的载荷,secret)，
其中secret为用户token的密钥，该密钥与用户token的加密过程保持一致。
最后，服务器判断待验证签名与用户token的签名是否相同；若待验证签名与用户token的签名相同，则服务器对用户token的载荷进行base64解密，得到用户令牌token的鉴权信息。
需要说明的是，用户token的载荷存放有效信息，包含注册声明、公有声明和私有声明，服务器获取包括agent唯一标识和用户IP地址的私有声明部分，例如：
{
  "agentid":"1234",
  "agentip":"192.168.0.1"
}
，服务器还获取到注册声明中的参数，例如过期时刻参数exp，该参数exp为时间戳格式。
204、根据用户token的鉴权信息、agent唯一标识和用户IP地址进行鉴权；
服务器根据用户令牌token的鉴权信息、agent唯一标识和用户IP地址进行鉴权，具体的，服务器判断用户令牌token的鉴权信息是否存在异常，例如，若用户令牌token的鉴权信息为空，则确定鉴权失败；若用户令牌token的鉴权信息存在异常，则确定鉴权失败，执行步骤205，例如，用户令牌token的鉴权信息为空，则确定鉴权失败；若用户令牌token的鉴权信息不存在异常，则服务器判断用户令牌token的鉴权信息是否包括代理agent唯一标识；若用户令牌token的鉴权信息不包括代理agent唯一标识，则服务器确定鉴权失败，执行步骤205，例如，agent唯一标识为1000，用户令牌token的鉴权信息中的agent唯一标识为1001，则两者不匹配，确定鉴权失败；若用户令牌token的鉴权信息包括代理agent唯一标识，则服务器判断用户令牌token的鉴权信息是否包括用户IP地址；若用户令牌token的鉴权信息不包括用户IP地址，则确定鉴权失败，执行步骤205，例如，用户IP地址为A，用户令牌token的鉴权信息中的用户IP地址为B，则两者不匹配，确定鉴权失败，A与B均为符合IP地址的格式。若用户令牌token的鉴权信息包括用户IP地址，则确定鉴权成功，执行步骤206。
可选的，服务器读取配置信息，判断预置值是否为目标阈值，目标阈值用于指示根据用户令牌token的过期时刻进行鉴权；若预置值为目标阈值，则获取用户token的获取用户令牌的过期时刻；判断所述用户令牌token的过期时刻是否小于当前时刻，若用户令牌的过期时刻小于当前时刻，则确定鉴权失败，执行步骤205；若用户token的过期时刻大于或等于当前时刻，则确定鉴权成功，执行步骤206。例如，若获取预置值的目标阈值为1，则表示根据用户token的过期时刻进行鉴权，用户token的过期时刻是时间戳格式。该配置信息可通过文件方式或者数据表方式进行存储，具体此处不做限定。
205、若鉴权失败，则丢弃链路上报的数据；
若鉴权失败，则服务器丢弃链路上报的数据。鉴权失败说明通过agent发送的链路上报的数据没有通过身份验证，是无效的垃圾数据，拒绝采集，等待下一个链路上报数据周期，重新进行链路数据的鉴权。
具体的，服务器根据鉴权失败预设鉴权失败的原因值，一旦鉴权失败，服务器发送鉴权失败的原因值；获取鉴权时刻；记录鉴权失败的原因值、agent唯一标识、用户IP地址和鉴权时刻；服务器删除链路上报的数据。例如，若用户token的鉴权信息不包括agent唯一标识，确定鉴权失败，其预设的鉴权失败的原因值为501；若用户token的鉴权信息不包括用户IP地址，确定鉴权失败，起预设的鉴权失败的原因值为502，具体此处不做限定。
需要说明的是，记录鉴权失败的原因值、agent唯一标识、用户IP地址和鉴权时刻，是为了便于查询问题，该记录方式可以通过日志或者数据库表的方式，具体此处不做限定。
206、若鉴权成功，则采集链路上报的数据。
若鉴权成功，则服务器采集链路上报的数据。具体的，用户令牌token的鉴权信息不存在异常，同时包括代理agent唯一标识和用户IP地址服务器，则确定鉴权成功，若鉴权成功，则服务器发送鉴权成功的原因值，通知链路上报数据端，即agent数据采集成功，例如，设置鉴权成功的原因值为200，agent接收到该值，确认上报数据被采集；同时服务器将链路上报的数据记录在HBase数据库中。HBase是一个高可靠性、高性能、面向列和可伸缩的分布式存储系统，利用HBase技术可搭建大规模结构化存储集群，HBase的目标是存储并处理大型的数据，更具体来说是仅需使用普通的硬件配置，就能够处理由成千上万的行和列所组成的大型数据，适用于全链路监控系统。
需要说明的是，全链路通过代理agent无侵入式部署，将性能测量与业务逻辑完全分离，用于收集应用端监控数据，在启动命令中设置部分参数，例如，代理agent唯一标识以及数据收集模块collector的地址，这种方式大大提高了采集效率，并且减少运维成本。
本申请采用上述的方法，根据用户令牌token与代理agent唯一标识和用户IP地址进行鉴权，得到鉴权结果，根据鉴权结果确定是否采集链路上报的数据，实现过滤链路上报的垃圾数据。基于JWT协议的方式对全链路上报数据进行身份验证，防止用户信息泄露导致的垃圾数据问题，防止全链路监控服务器受到攻击，确保链路上报数据的有用性。
上面对本申请实施例中全链路数据鉴权方法进行了描述，下面对本申请实施例中全链路数据鉴权装置进行描述，请参阅图3，本申请实施例中全链路数据鉴权一个实施例包括：
接收单元301，用于接收链路上报的数据；
解析单元302，用于解析链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；
鉴权单元303，用于根据用户token、agent唯一标识和用户IP地址进行鉴权；
第一处理单元304，若鉴权失败，则用于丢弃链路上报的数据；
第二处理单元305，若鉴权成功，则用于采集链路上报的数据。
本申请根据用户令牌token与代理agent唯一标识和用户IP地址进行鉴权，得到鉴权结果，根据鉴权结果确定是否采集链路上报的数据，实现过滤链路上报的垃圾数据。基于JWT协议的方式对全链路上报数据进行身份验证，防止用户信息泄露导致的垃圾数据问题，防止全链路监控服务器受到攻击，确保链路上报数据的有用性。
请参阅图4，本申请实施例中全链路数据鉴权装置的另一个实施例包括：
接收单元301，用于接收链路上报的数据；
解析单元302，用于解析链路上报的数据，得到用户令牌token、代理agent唯一标识 和用户IP地址；
鉴权单元303，用于根据用户token、agent唯一标识和用户IP地址进行鉴权；
第一处理单元304，若鉴权失败，则用于丢弃链路上报的数据；
第二处理单元305，若鉴权成功，则用于采集链路上报的数据。
可选的，鉴权单元303可进一步包括：
解析子单元3031，用于根据JWT协议对用户token进行解析，得到用户token的鉴权信息；
第一判断子单元3032，用于判断用户token的鉴权信息是否存在异常；
第一处理子单元3033，若用户token的鉴权信息存在异常，则用于确定鉴权失败；
第一鉴权子单元3034，若用户token的鉴权信息不存在异常，则用于根据用户token的鉴权信息、agent唯一标识和用户IP地址进行鉴权。
可选的，解析子单元3031还可以具体用于：
根据JWT协议对用户token进行分割，得到用户token的头部、用户token的载荷和用户token的签名；
对用户token的头部进行base64解密，得到头部声明的加密算法；
根据头部声明的加密算法对用户token的头部和用户token的载荷进行组合加密，得到待验证签名；
判断待验证签名与用户token的签名是否相同；
若待验证签名与第用户token的签名相同，则对用户token的载荷进行base64解密，得到用户token的鉴权信息。
可选的，第一鉴权子单元3034还可以具体用于：
若用户token的鉴权信息不存在异常，则判断用户token的鉴权信息是否包括agent唯一标识；
若用户token的鉴权信息不包括agent唯一标识，则确定鉴权失败；
若用户token的鉴权信息包括代理agent唯一标识，则判断用户token的鉴权信息是否包括用户IP地址；
若用户token的鉴权信息不包括用户IP地址，则确定鉴权失败；
若用户token的鉴权信息包括用户IP地址，则确定鉴权成功。
可选的，第一处理单元304还可以具体用于：
发送鉴权失败的原因值；
获取鉴权时刻；
记录鉴权失败的原因值、agent唯一标识、用户IP地址和鉴权时刻；
删除所述链路上报的数据。
可选的，第二处理单元305还可以具体用于：
发送鉴权成功的原因值；
将链路上报的数据写入数据库。
可选的，鉴权单元303还可进一步包括：
读取子单元3035，用于读取预置值；
第二判断子单元3036，用于判断预置值是否为目标阈值，目标阈值用于指示根据用户token的过期时刻进行鉴权；
第二鉴权子单元3037，若预置值为目标阈值，则用于获取用户token的过期时刻；
第三判断子单元3038，用于判断用户token的过期时刻是否小于当前时刻；
第二处理子单元3039，若用户令牌token的过期时刻小于当前时刻，则用于确定鉴权 失败；
第三处理子单元30310，若用户token的过期时刻大于或等于当前时刻，则用于确定鉴权成功。
本申请根据用户令牌token与代理agent唯一标识和用户IP地址进行鉴权，得到鉴权结果，根据鉴权结果确定是否采集链路上报的数据，实现过滤链路上报的垃圾数据。基于JWT协议的方式对全链路上报数据进行身份验证，防止用户信息泄露导致的垃圾数据问题，防止全链路监控服务器受到攻击，确保链路上报数据的有用性。
上面图3和图4从模块化功能实体的角度对本申请实施例中的全链路数据鉴权装置进行详细描述，下面从硬件处理的角度对本申请实施例中全链路数据鉴权设备进行详细描述。
图5是本申请实施例提供的一种全链路数据鉴权设备的结构示意图，该全链路数据鉴权设备500可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上处理器(central processing units，CPU)501(例如，一个或一个以上处理器)和存储器509，一个或一个以上存储应用程序507或数据506的存储介质508(例如一个或一个以上海量存储设备)。其中，存储器509和存储介质508可以是短暂存储或持久存储。存储在存储介质508的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对全链路数据鉴权中的一系列指令操作。更进一步地，处理器501可以设置为与存储介质508通信，在全链路数据鉴权设备500上执行存储介质508中的一系列指令操作。
全链路数据鉴权设备500还可以包括一个或一个以上电源502，一个或一个以上有线或无线网络接口503，一个或一个以上输入输出接口504，和/或，一个或一个以上操作系统505，例如Windows Serve，Mac OS X，Unix，Linux，FreeBSD等等。本领域技术人员可以理解，图5中示出的全链路数据鉴权设备结构并不构成对全链路数据鉴权设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质可以为非易失性计算机可读存储介质。计算机可读存储介质存储有计算机指令，当所述计算机指令在计算机上运行时，使得计算机执行如下步骤：
接收链路上报的数据；
解析所述链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；
根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权；
若鉴权失败，则丢弃所述链路上报的数据；
若鉴权成功，则采集所述链路上报的数据。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可 以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (20)

  1. 一种全链路数据鉴权方法，包括：
    接收链路上报的数据；
    解析所述链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；
    根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权；
    若鉴权失败，则丢弃所述链路上报的数据；
    若鉴权成功，则采集所述链路上报的数据。
  2. 根据权利要求1所述的全链路数据鉴权方法，所述根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权包括：
    根据JWT协议对所述用户token进行解析，得到所述用户token的鉴权信息；
    判断所述用户token的鉴权信息是否存在异常；
    若所述用户token的鉴权信息存在异常，则确定鉴权失败；
    若所述用户token的鉴权信息不存在异常，则根据所述用户token的鉴权信息、所述agent唯一标识和所述用户IP地址进行鉴权。
  3. 根据权利要求2所述的全链路数据鉴权方法，所述根据JWT协议对所述用户token进行解析，得到所述用户token的鉴权信息包括：
    根据所述JWT协议对所述用户token进行分割，得到所述用户token的头部、所述用户token的载荷和所述用户token的签名；
    对所述用户token的头部进行base64解密，得到所述头部声明的加密算法；
    根据所述头部声明的加密算法对所述用户token的头部和所述用户token的载荷进行组合加密，得到待验证签名；
    判断所述待验证签名与所述用户token的签名是否相同；
    若所述待验证签名与所述用户token的签名相同，则对所述用户token的载荷进行base64解密，得到所述用户token的鉴权信息。
  4. 根据权利要求2所述的全链路数据鉴权方法，所述若所述用户token的鉴权信息不存在异常，则根据所述用户token的鉴权信息、所述agent唯一标识和所述用户IP地址进 行鉴权包括：
    若所述用户token的鉴权信息不存在异常，则判断所述用户token的鉴权信息是否包括所述agent唯一标识；
    若所述用户token的鉴权信息不包括所述agent唯一标识，则确定鉴权失败；
    若所述用户token的鉴权信息包括所述agent唯一标识，则判断所述用户token的鉴权信息是否包括所述用户IP地址；
    若所述用户token的鉴权信息不包括所述用户IP地址，则确定鉴权失败；
    若所述用户token的鉴权信息包括所述用户IP地址，则确定鉴权成功。
  5. 根据权利要求1所述的全链路数据鉴权方法，所述若鉴权失败，则丢弃所述链路上报的数据包括：
    发送鉴权失败的原因值；
    获取鉴权时刻；
    记录所述鉴权失败的原因值、所述agent唯一标识、所述用户IP地址和所述鉴权时刻；
    删除所述链路上报的数据。
  6. 根据权利要求1所述的全链路数据鉴权方法，所述若鉴权成功，则采集所述链路上报的数据包括：
    发送鉴权成功的原因值；
    将所述链路上报的数据写入数据库。
  7. 根据权利要求1至6中任一项所述的全链路数据鉴权方法，所述若所述用户token的鉴权信息不存在异常，则根据所述用户token的鉴权信息、所述agent唯一标识和所述用户IP地址进行鉴权之后，所述全链路数据鉴权方法还包括：
    读取预置值；
    判断预置值是否为目标阈值，所述目标阈值用于指示根据所述用户token的过期时刻进行鉴权；
    若所述预置值为所述目标阈值，则获取所述用户token的过期时刻；
    判断所述用户token的过期时刻是否小于当前时刻；
    若所述用户token的过期时刻小于所述当前时刻，则确定鉴权失败；
    若所述用户token的过期时刻大于或等于所述当前时刻，则确定鉴权成功。
  8. 一种全链路数据鉴权装置，所述全链路数据鉴权装置包括：
    接收单元，用于接收链路上报的数据；
    解析单元，用于解析所述链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；
    鉴权单元，用于根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权；
    第一处理单元，若鉴权失败，则用于丢弃所述链路上报的数据；
    第二处理单元，若鉴权成功，则用于采集所述链路上报的数据。
  9. 根据权利要求8所述的全链路数据鉴权装置，所述鉴权单元包括：
    解析子单元，用于根据JWT协议对所述用户token进行解析，得到所述用户token的鉴权信息；
    第一判断子单元，用于判断所述用户token的鉴权信息是否存在异常；
    第一处理子单元，若所述用户token的鉴权信息存在异常，则用于确定鉴权失败；
    第一鉴权子单元，若所述用户token的鉴权信息不存在异常，则用于根据所述用户token的鉴权信息、所述agent唯一标识和所述用户IP地址进行鉴权。
  10. 根据权利要求9所述的全链路数据鉴权装置，所述解析子单元具体用于：
    根据所述JWT协议对所述用户token进行分割，得到所述用户token的头部、所述用户token的载荷和所述用户token的签名；
    对所述用户token的头部进行base64解密，得到所述头部声明的加密算法；
    根据所述头部声明的加密算法对所述用户token的头部和所述用户token的载荷进行组合加密，得到待验证签名；
    判断所述待验证签名与所述用户token的签名是否相同；
    若所述待验证签名与所述用户token的签名相同，则对所述用户token的载荷进行base64解密，得到所述用户token的鉴权信息。
  11. 根据权利要求9所述的全链路数据鉴权装置，所述第一鉴权子单元具体用于：
    若所述用户token的鉴权信息不存在异常，则判断所述用户token的鉴权信息是否包括所述agent唯一标识；
    若所述用户token的鉴权信息不包括所述agent唯一标识，则确定鉴权失败；
    若所述用户token的鉴权信息包括所述agent唯一标识，则判断所述用户token的鉴权信息是否包括所述用户IP地址；
    若所述用户token的鉴权信息不包括所述用户IP地址，则确定鉴权失败；
    若所述用户token的鉴权信息包括所述用户IP地址，则确定鉴权成功。
  12. 根据权利要求8所述的全链路数据鉴权装置，所述第一处理单元具体用于：
    发送鉴权失败的原因值；
    获取鉴权时刻；
    记录所述鉴权失败的原因值、所述agent唯一标识、所述用户IP地址和所述鉴权时刻；
    删除所述链路上报的数据。
  13. 根据权利要求8所述的全链路数据鉴权装置，所述第二处理单元具体用于：
    发送鉴权成功的原因值；
    将所述链路上报的数据写入数据库。
  14. 根据权利要求8至13中任一项所述的全链路数据鉴权装置，所述鉴权单元还包括：
    读取子单元，用于读取预置值；
    第二判断子单元，用于判断所述预置值是否为目标阈值，所述目标阈值指示根据所述用户token的过期时刻进行鉴权；
    第二鉴权子单元，若所述预置值为根据所述用户token的过期时刻进行鉴权，则用于获取所述用户token的过期时刻；
    第三判断子单元，用于判断所述用户token的过期时刻是否小于当前时刻；
    第二处理子单元，若所述用户token的过期时刻小于所述当前时刻，则用于确定鉴权单元；
    第三处理子单元，若所述用户token的过期时刻大于或等于所述当前时刻，则用于确定鉴权成功。
  15. 一种基于全链路数据鉴权设备，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如下步骤：
    接收链路上报的数据；
    解析所述链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；
    根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权；
    若鉴权失败，则丢弃所述链路上报的数据；
    若鉴权成功，则采集所述链路上报的数据。
  16. 根据权利要求15所述的全链路数据鉴权设备，所述处理器执行所述计算机程序实现所述根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权时，包括以下步骤：
    根据JWT协议对所述用户token进行解析，得到所述用户token的鉴权信息；
    判断所述用户token的鉴权信息是否存在异常；
    若所述用户token的鉴权信息存在异常，则确定鉴权失败；
    若所述用户token的鉴权信息不存在异常，则根据所述用户token的鉴权信息、所述agent唯一标识和所述用户IP地址进行鉴权。
  17. 根据权利要求16所述的全链路数据鉴权设备，所述处理器执行所述计算机程序实现所述根据JWT协议对所述用户token进行解析，得到所述用户token的鉴权信息时，包括以下步骤：
    根据所述JWT协议对所述用户token进行分割，得到所述用户token的头部、所述用户token的载荷和所述用户token的签名；
    对所述用户token的头部进行base64解密，得到所述头部声明的加密算法；
    根据所述头部声明的加密算法对所述用户token的头部和所述用户token的载荷进行组合加密，得到待验证签名；
    判断所述待验证签名与所述用户token的签名是否相同；
    若所述待验证签名与所述用户token的签名相同，则对所述用户token的载荷进行base64解密，得到所述用户token的鉴权信息。
  18. 根据权利要求16所述的全链路数据鉴权设备，所述处理器执行所述计算机程序实现所述若所述用户token的鉴权信息不存在异常，则根据所述用户token的鉴权信息、所述agent唯一标识和所述用户IP地址进行鉴权时，包括以下步骤：
    若所述用户token的鉴权信息不存在异常，则判断所述用户token的鉴权信息是否包括所述agent唯一标识；
    若所述用户token的鉴权信息不包括所述agent唯一标识，则确定鉴权失败；
    若所述用户token的鉴权信息包括所述agent唯一标识，则判断所述用户token的鉴权信息是否包括所述用户IP地址；
    若所述用户token的鉴权信息不包括所述用户IP地址，则确定鉴权失败；
    若所述用户token的鉴权信息包括所述用户IP地址，则确定鉴权成功。
  19. 根据权利要求15所述的全链路数据鉴权设备，所述处理器执行所述计算机程序实现所述若鉴权失败，则丢弃所述链路上报的数据时，包括以下步骤：
    发送鉴权失败的原因值；
    获取鉴权时刻；
    记录所述鉴权失败的原因值、所述agent唯一标识、所述用户IP地址和所述鉴权时刻；
    删除所述链路上报的数据。
  20. 一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令，当所述计算机指令在计算机上运行时，使得计算机执行如下步骤：
    接收链路上报的数据；
    解析所述链路上报的数据，得到用户令牌token、代理agent唯一标识和用户IP地址；
    根据所述用户token、所述agent唯一标识和所述用户IP地址进行鉴权；
    若鉴权失败，则丢弃所述链路上报的数据；
    若鉴权成功，则采集所述链路上报的数据。
PCT/CN2019/102497 2019-06-18 2019-08-26 全链路数据鉴权方法、装置、设备及存储介质 Ceased WO2020252897A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910524196.7A CN110225045A (zh) 2019-06-18 2019-06-18 全链路数据鉴权方法、装置、设备及存储介质
CN201910524196.7 2019-06-18

Publications (1)

Publication Number Publication Date
WO2020252897A1 true WO2020252897A1 (zh) 2020-12-24

Family

ID=67817595

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/102497 Ceased WO2020252897A1 (zh) 2019-06-18 2019-08-26 全链路数据鉴权方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN110225045A (zh)
WO (1) WO2020252897A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12294573B2 (en) 2021-12-10 2025-05-06 International Business Machines Corporation Securely preserving prior security tokens for recall

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111148102B (zh) * 2019-12-31 2024-01-30 京信网络系统股份有限公司 网络鉴权方法、装置、计算机设备和存储介质
CN114173336B (zh) * 2020-08-21 2024-06-11 维沃移动通信有限公司 鉴权失败的处理方法、装置、终端及网络侧设备
CN112487502B (zh) * 2020-12-15 2024-09-10 深圳平安智慧医健科技有限公司 设备鉴权方法、装置、电子设备及存储介质
CN113157999A (zh) * 2021-04-09 2021-07-23 杭州电子科技大学 基于Filter与知识图谱的鉴权认证方法
CN113938323B (zh) * 2021-12-16 2022-03-25 深圳竹云科技有限公司 基于jwt的防重放攻击方法、装置、设备以及存储介质
CN114301708B (zh) * 2021-12-30 2024-08-09 金蝶智慧科技(深圳)有限公司 身份认证方法、身份认证服务器及相关装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150341176A1 (en) * 2014-05-20 2015-11-26 Vmware, Inc. Digitally Signing JSON Messages
CN107925668A (zh) * 2015-07-02 2018-04-17 康维达无线有限责任公司 资源驱动的动态授权框架
CN109104432A (zh) * 2018-09-26 2018-12-28 深圳竹云科技有限公司 一种基于jwt协议的信息传递安全方法
CN109446769A (zh) * 2018-10-18 2019-03-08 北京计算机技术及应用研究所 统计身份认证及日志处理微服务系统及其实现方法
CN109660343A (zh) * 2019-01-17 2019-04-19 平安科技（深圳）有限公司 令牌更新方法、装置、计算机设备及存储介质

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2392155B1 (en) * 2009-01-28 2016-03-30 Headwater Partners I LLC Adaptive ambient services
JP2019046059A (ja) * 2017-08-31 2019-03-22 キヤノン株式会社 権限委譲システム、制御方法、およびプログラム
CN109672580B (zh) * 2018-09-21 2022-01-18 平安科技（深圳）有限公司 全链路监控方法、装置、终端设备及存储介质
CN109309683B (zh) * 2018-10-30 2021-09-14 泰华智慧产业集团股份有限公司 基于token的客户端身份验证的方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150341176A1 (en) * 2014-05-20 2015-11-26 Vmware, Inc. Digitally Signing JSON Messages
CN107925668A (zh) * 2015-07-02 2018-04-17 康维达无线有限责任公司 资源驱动的动态授权框架
CN109104432A (zh) * 2018-09-26 2018-12-28 深圳竹云科技有限公司 一种基于jwt协议的信息传递安全方法
CN109446769A (zh) * 2018-10-18 2019-03-08 北京计算机技术及应用研究所 统计身份认证及日志处理微服务系统及其实现方法
CN109660343A (zh) * 2019-01-17 2019-04-19 平安科技（深圳）有限公司 令牌更新方法、装置、计算机设备及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
XIANG, WUMING ET AL.: "Design of Role Authentication Scheme for RESTful API Based on JWT", MODERN COMPUTER, 5 December 2018 (2018-12-05), DOI: 20200306162941X *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12294573B2 (en) 2021-12-10 2025-05-06 International Business Machines Corporation Securely preserving prior security tokens for recall

Also Published As

Publication number Publication date
CN110225045A (zh) 2019-09-10

Similar Documents

Publication Publication Date Title
WO2020252897A1 (zh) 全链路数据鉴权方法、装置、设备及存储介质
US11477548B2 (en) Network telemetry with byte distribution and cryptographic protocol data elements
US20240089301A1 (en) Method and system for capture of visited links from encrypted and non-encrypted network traffic
US11223639B2 (en) Endpoint network traffic analysis
EP3405902B1 (en) Pattern matching based dataset extraction
RU2634209C1 (ru) Система и способ автогенерации решающих правил для систем обнаружения вторжений с обратной связью
EP3200390B1 (en) Analysis system, analysis device, analysis method, and storage medium having analysis program recorded therein
CN114401112B (zh) 旁路部署针对tls加密的恶意流量实时深度包检测方法
CN114915442B (zh) 高级持续性威胁攻击检测方法及装置
CN119854046B (zh) 会话秘钥捕获与安全事件分析方法、装置、设备及介质
CN116723238B (zh) 一种基于中间人代理的api加密流量采集与标注方法
CN121217814B (zh) 基于虚拟网卡的流量处理方法、设备及存储介质
CN121125367B (zh) 基于密钥注入的安全外壳协议流量取证解密方法及系统
Zhu et al. Encrypted Mining Traffic Detection Mechanism Based on TLS Handshake Message and Machine Learning
US8995271B2 (en) Communications flow analysis
Goodgion Active Response Using Host Based Intrusion Detection System and Software Defined Networking
ES2812152T3 (es) Un método y un sistema para habilitar una (re)configuración de una red de telecomunicaciones
CN121151130A (zh) 一种服务器安全档案分析方法、系统、设备及介质
CN115941245A (zh) 一种基于容器的ios-xe系统的入侵检测方法
KOČÍ MOBILE APPLICATION MONITORING USING TLS FINGERPRINTS
HK1237138B (zh) 分析系统、分析装置、分析方法、以及记录分析程序的存储介质
HK1237138A1 (zh) 分析系统、分析装置、分析方法、以及记录分析程序的存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19933547

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19933547

Country of ref document: EP

Kind code of ref document: A1