WO2021139244A1

WO2021139244A1 - Permissions request verification method and apparatus, device, and storage medium

Info

Publication number: WO2021139244A1
Application number: PCT/CN2020/118444
Authority: WO
Inventors: 顾青成
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-07-28
Filing date: 2020-09-28
Publication date: 2021-07-15
Also published as: CN111901342A; CN111901342B

Abstract

The present application sets forth a permissions request verification method. The permissions request verification method comprises: receiving a first token requesting permissions, said first token including a user ID, a permissions calling interface parameter, and a time stamp; obtaining a user key according to the user ID; obtaining a temporary verification key according to the user key and the permissions calling interface parameter; generating a second token according to the user ID, the temporary verification key, the permissions calling interface parameter, and the time stamp; comparing the first token and the second token and determining if the two are consistent; if consistent, the permissions request verification is deemed successful, and authorization is performed according to the permissions calling interface parameter. The present application enhances the security of inter-system permissions authorization.

Description

Authorization application verification method, device, equipment and storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on July 28, 2020, the application number is 202010738614. 5, and the invention title is "Authorization Application Verification Method, Apparatus, Equipment, and Storage Medium". The entire content of the application is approved The reference is incorporated in this application.

Technical field

This application relates to the field of cryptography\information encryption and decryption technology, and in particular to a method, device, device, and storage medium for verifying permission application.

Background technique

For non-closed software systems, such as back-end systems and middle-office systems, in order to support the docking of other systems, the interaction between systems usually adopts the way that users log in to multiple systems and operate separately, or the way that users can call between systems through api through authorization .

For the user to log in to multiple systems and operate separately, human intervention is required. The user needs to participate in the whole process of the operation of multiple systems. When the system is called, the operation is performed on multiple systems. The operation is cumbersome and takes a lot of user time. Poor user experience.

For users through authorization, the way to call between systems through api is usually that the system applying for permission uses the user key stored in the system, the permission to be applied for, the api call parameter, and the current timestamp to generate a token and send it to the issuing permission. The system that issues permissions uses the same key to generate a token, and compares whether the received token is the same as the generated token. If the same is the same, the verification is passed. In this way, the inventor found After the verification is passed, the system permissions are fully developed, but usually api calls do not require all permissions, and there is a certain security risk, and the user key is the same in multiple systems, and there is also a certain security risk.

Therefore, how to make secure permission calls between systems is an urgent need for users.

technical problem

This application provides a permission application verification method, device, equipment and storage medium, which can achieve the purpose of improving the security of permission authorization between systems.

Technical solutions

In order to solve the above technical problems, a technical solution adopted in this application is to provide a permission application verification method, and the permission application verification method includes:

Receiving a first token for applying for permission, where the first token includes a user ID, permission calling interface parameters, and a timestamp;

Obtaining a user key according to the user ID;

Obtaining a temporary verification key according to the user key and the permission call interface parameters;

Generate a second token according to the user ID, the temporary verification key, the authority calling interface parameter, and the timestamp;

Compare whether the first token and the second token are consistent. If they are consistent, the authorization application is verified and authorization is performed according to the authorization call interface parameters.

In addition, in order to solve the above technical problems, a technical solution adopted in this application is to provide a permission application verification device, the permission application verification device including:

An obtaining module, configured to receive a first token for applying for permission, the first token including a user ID, permission calling interface parameters, and a time stamp; obtaining a user key according to the user ID;

A key generation module, configured to obtain a temporary verification key according to the user key and the authority call interface parameters;

The verification module is configured to generate a second token according to the user ID, the temporary verification key, the authority calling interface parameter, and the time stamp; compare whether the first token and the second token are If they are consistent, the authorization application is verified and authorized according to the authorization call interface parameters.

In addition, in order to solve the above technical problems, a technical solution adopted by this application is to provide a permission application verification device, the permission application verification device including a processor and a memory coupled to the processor, wherein the Computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the processor, the processor is caused to execute the steps of the permission application verification method described in any one of the foregoing items.

In addition, in order to solve the above-mentioned technical problems, a technical solution adopted by this application is to provide a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, one or The multiple processors execute the steps of the permission application verification method described in any one of the above.

Beneficial effect

The authorization application verification method, device, device, and storage medium proposed in this application verify the first token by generating the second token using the temporary verification key, which protects the security of the user key and further protects the security of the system.

Description of the drawings

FIG. 1 is a schematic flowchart of a permission application verification method according to an embodiment of the present application;

FIG. 2 is a schematic structural diagram of a permission application verification device according to an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a permission application verification device according to an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a storage medium according to an embodiment of the present application.

Embodiments of the present invention

The following will clearly and completely describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

The terms "first", "second", and "third" in this application are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined with “first”, “second”, and “third” may explicitly or implicitly include at least one of the features. In the description of this application, "a plurality of" means at least two, such as two, three, etc., unless otherwise specifically defined. All directional indications (such as up, down, left, right, front, back...) in the embodiments of this application are only used to explain the relative positional relationship between the components in a specific posture (as shown in the figure) , Movement status, etc., if the specific posture changes, the directional indication will also change accordingly. In addition, the terms "including" and "having" and any variations of them are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes unlisted steps or units, or optionally also includes Other steps or units inherent to these processes, methods, products or equipment.

The reference to "embodiments" herein means that a specific feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art clearly and implicitly understand that the embodiments described herein can be combined with other embodiments.

Please refer to FIG. 1. FIG. 1 is a schematic flowchart of a permission application verification method according to an embodiment of the present application. According to an embodiment of the present application, the authorization application verification method is used for two first system and second system that need to interact. The first system applies authorization authorization from the second system, and the second system The system verifies whether the application of the first system complies with the authorization through the authorization application verification method, and if complies, authorizes the first system. In this embodiment, the first system and the second system may be a client and a server, a cloud client and a cloud platform, etc., respectively. It should be noted that if there is substantially the same result, the method of the present application is not limited to the sequence of the process shown in FIG. 1. As shown in Figure 1, the authorization application verification method includes the following steps:

Step S101: Receive a first token for permission application, where the first token includes a user ID, permission call interface parameters, and a timestamp.

It should be noted that the first token is a permission application instruction sent by the first system to the second system to be applied for permission, and includes the user ID, the permission call interface parameter, and the time stamp The user ID is the identity of the user applying for the permission, the permission call interface parameter is a parameter defined by the inter-system api interface call, and the timestamp is the system time when the permission call application is initiated. In order to better understand the verification process of the first token by the second system, the process of generating the first token will be described below.

According to an embodiment of the present application, the first token includes a temporary application key, wherein the temporary application key is obtained by the following method:

Step S1: Obtain a user key and at least one authorization ID to be authorized.

According to an embodiment of the present application, the system user can configure the user key in the system when configuring the system. Usually, the user key of the same user can be obtained by multiple systems that perform authorization calls through user authorization. the same. In order to make the authorization scope controllable, in this embodiment, at least one authorization ID corresponding to the authorization name can be obtained from a database storing the corresponding relationship between multiple authorization names and multiple authorization IDs by acquiring the authorization name to be authorized. It can be understood that the authority ID in the database is obtained after the authority is refined according to the preset scope. For example, the authority with authority ID of 001 can be set to represent the user name, and the authority with authority ID of 002 to represent the user's phone number and authority. The authority with ID 003 represents the user address, one authority name to be authorized may correspond to multiple authority IDs, and the authority of different authority names to be authorized may have at least part of the same authority ID, or it may be A completely different authority ID. For example, when the authority name to be authorized is a registration system, the corresponding authority ID can be 001, 002, 003, and when the authority name to be authorized is a login system, it The corresponding permission ID can be 001 or 002. Through the correspondence between the authority name and the authority ID, the authority to be authorized can be refined, instead of opening all the authority for each authorization, the authority is authorized according to the scope, and the authority scope can be accurately limited to protect the security of the system.

Step S2: Calculate the permission termination period according to the permission ID, and the permission termination period is the time for terminating the permission authorization.

According to an embodiment of the present application, the authorization time corresponding to the authorization ID may also be stored in the database. After the authorization ID to be authorized is obtained, the number of authorization IDs and their corresponding Calculate the overall authorization time for the authorization, and thus calculate the authorization termination period. It can be understood that in order to ensure that the corresponding temporary keys are different for the different permissions to be authorized, the length of the authorization time corresponding to the authorization ID can be accurate to milliseconds, for example, the authorization time for the authorization ID of 001 is 1 minute. 21 seconds and 450 milliseconds, the authorization time for the authorization ID 002 is 0 minutes 45 seconds and 120 milliseconds, and the authorization time for the authorization ID 003 is 1 minute, 0 seconds and 250 milliseconds. Then, when the authorization name to be authorized is the registration system, you can Calculate according to the authorization time of authorization ID 001, 002, 003, obtain the overall authorization time 1, and then calculate the authorization expiration period based on the current timestamp plus authorization time 1, when the authorization name to be authorized is When logging in to the system, you can calculate the authorization time based on authorization IDs 001 and 002 to obtain the overall authorization time 2, and then calculate the authorization termination period based on the current timestamp plus authorization time 2. Through the authorization termination period, the authorization issuance time of the authorization can be effectively controlled, so that the authorization time range is controllable, thereby protecting the security of the system.

Step S3: Generate authority information according to the authority ID and the authority termination period.

In step S3, the authorization ID and the authorization termination period can be spliced into a string according to preset rules to generate authorization information. For example, when the authorization name to be authorized is a registration system, the authorization IDs are 001, 002, 003, the permission termination period is 2:01:00 and 531 milliseconds, then the permission information is "001, 002, 003->20100531"

Step S4: Use the user key to encrypt the authority information to generate first information.

Specifically, first information can be generated after symmetrically encrypting the authority information using the user key. According to an embodiment of the present application, the encryption algorithm may use the AES128 algorithm with higher strength.

Step S5: Generate the temporary application key according to the first information and the user key.

Specifically, in step S5, the first information and the user key are first signed. In this embodiment, the MD5 algorithm may be used to perform the combined character string of the first information and the user key. Sign to obtain the first digital signature, and then append the first digital signature to the first information to form the temporary application key.

The first token is generated after being encrypted according to the user ID, the permission call interface parameters, the timestamp, and the temporary application key. For example, for the user in the first token token1 ID, the authorization call interface parameters, the time stamp, and the temporary application key are sorted to form a specific string "user id+temporary application private key + authorization call interface parameters sorted by parameter name + time stamp", Then MD5 encryption is performed, where the authority calling interface parameters include authority range parameters. According to an embodiment of the present application, the first information may be used as the authority range parameters. If the authority range parameter can be defined as "AuthorityRange", the url of the calling interface can be "

".

By using the temporary application key to generate the first token, and using the first token to apply for permission, the scope and time limit of authorization can be limited, and the security of the user key is protected, thereby protecting the security of the system.

Step S102: Obtain a user key according to the user ID.

After the second system receives the first token token1 for which the first system applies for permission, it can obtain the user ID from the first token token1, and find the corresponding user ID according to the user ID. The user and the user key installed in the second system.

Step S103: Obtain a temporary verification key according to the user key and the permission call interface parameters.

According to an embodiment of the present application, the authority calling interface parameter includes a authority scope parameter, and the first information serves as the authority scope parameter. That is, the first information can be obtained from the permission call interface parameters of the first token, the first information and the user key can be signed to generate a second digital signature, and the second digital signature can be generated according to the second The digital signature and the first information generate the temporary verification key. In this embodiment, the combined character string of the first information and the user key may be signed using the MD5 algorithm to obtain the second digital Signing, and then appending the second digital signature to the first information to form the temporary verification key.

Step S104: Generate a second token according to the user ID, the temporary verification key, the authority calling interface parameter, and the timestamp;

Specifically, the second token is generated after being encrypted according to the user ID, the authority calling interface parameters, the time stamp, and the temporary verification key. It can be understood that the process of generating the second token Same as the first token, such as sorting the user ID, the authority calling interface parameter, the time stamp, and the temporary verification key in the second token token2 to form a specific string "User id+temporary verification private key+authorization calling interface parameters sorted by parameter name+time stamp", and then MD5 encryption, wherein the authority calling interface parameters include authority range parameters. According to an embodiment of the present application, The first information may be used as the permission range parameter. If the authority range parameter can be defined as "AuthorityRange", the url of the calling interface can be "

".

Step S105: Compare whether the first token and the second token are consistent. If they are consistent, the authorization application is verified and authorization is performed according to the authorization call interface parameters.

Specifically, after the second system uses the user key to decrypt the first information, the authorization ID to be authorized and the authorization expiration period can be obtained, and based on the authorization expiration period and Calculate at the current time whether the authorization expiration period in the first token token1 exceeds the authorization time limit. If the authorization time limit is exceeded, the authorization application verification fails; if it is within the authorization time limit, it will be based on the authorization ID, The user ID and the authorization call interface parameters determine whether the first token token1 exceeds the authorization scope; if it exceeds the authorization scope, the authorization application verification fails. After all the above verifications are passed, compare whether the first token token1 and the second token token2 are consistent. When the first token token1 and the second token token2 are consistent, the authorization application verification is passed And call the interface parameters for authorization according to the authority.

The authorization application verification method proposed in this embodiment uses a temporary verification key to generate a second token to verify the first token, which protects the security of the user key and further protects the security of the system.

Further, the first token uses the user key to sign and encrypt the authorization ID of the authorization to be applied for and the authorization expiration period to generate a temporary application key, which protects the security of the user key while keeping the authorization within a certain range and time limit. Protect the system security.

Further, through the correspondence between the authority name and the authority ID, the authority is refined, and the authority scope is accurately limited to protect the security of the system authority.

Furthermore, through the permission termination period, the usage time of the permission can be effectively controlled, thereby protecting the security of the system.

Further, the authorization application verification method, device, device and storage medium proposed by the application verify the first token by generating the second token using the temporary verification key, and pass the authorization ID and the authorization termination period to protect the system At the same time of security, it can effectively control the scope of authority and usage time, so it is also suitable for smart cities, big data, financial technology and other related fields involving authority management.

FIG. 2 is a schematic structural diagram of a permission application verification device 1 according to an embodiment of the present application. As shown in FIG. 4, the authorization application verification device 1 includes an acquisition module 10, a key generation module 11, and a verification module 12.

The obtaining module 10 is configured to receive a first token for applying for permission, where the first token includes a user ID, permission calling interface parameters, and a time stamp; obtaining a user key according to the user ID;

The key generation module 11 is configured to obtain a temporary verification key according to the user key and the permission call interface parameters;

The verification module 12 is configured to generate a second token according to the user ID, the temporary verification key, the authority calling interface parameter, and the time stamp; compare the first token with the second token Whether they are consistent or not, if they are consistent, the authorization application is verified and authorized according to the authorization call interface parameters.

It can be understood that the specific manners for implementing each function of each module of the above-mentioned device can refer to the specific steps corresponding to the above-mentioned embodiment, so it will not be repeated here.

Please refer to FIG. 3, which is a schematic structural diagram of a permission application verification device 30 according to an embodiment of the present application. As shown in FIG. 3, the authorization application verification device 30 includes a memory 32, a processor 31, and a computer program stored on the memory 32 and running on the processor 31, and the processor 31 executes the The computer program realizes the above authorization application verification method.

Refer to FIG. 4, which is a schematic structural diagram of a storage medium according to an embodiment of the present application. As shown in FIG. 4, a storage medium storing computer-readable instructions 41, when the computer-readable instructions 41 are executed by one or more processors, cause one or more processors to execute the above authorization application verification method.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer program. The computer program can be stored in a computer readable storage medium, and the program can be stored in a computer readable storage medium. When executed, it may include the procedures of the above-mentioned method embodiments. Among them, the aforementioned storage medium may be a magnetic disk, an optical disk, or a read-only storage memory (Read-Only Memory, ROM) and other non-volatile storage media, or random storage memory (Random Access Memory, RAM) and other volatile storage media.

The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the various technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, All should be considered as the scope of this specification.

The above-mentioned embodiments only express several implementation manners of the present application, and their description is relatively specific and detailed, but they should not be understood as a limitation to the patent scope of the present application. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of this application, several modifications and improvements can be made, and these all fall within the protection scope of this application. Therefore, the scope of protection of the patent of this application shall be subject to the appended claims.

Claims

1. A permission application verification method, wherein the permission application verification method includes:

Obtaining a user key according to the user ID;

2. The authorization application verification method according to claim 1, wherein the first token further includes a temporary application key, and the temporary application key is obtained by the following method:

Obtaining the user key and at least one authorization ID to be authorized;

Calculate the permission termination period according to the permission ID, and the permission termination period is the time for terminating the permission authorization;

Generating authority information according to the authority ID and the authority termination period;

Encrypting the authority information by using the user key to generate first information;

The temporary application key is generated according to the first information and the user key.

3. The authorization application verification method according to claim 2, wherein the obtaining at least one authorization ID to be authorized according to the authorization name to be authorized includes:

According to the authority name, at least one authority ID corresponding to the authority ID is obtained from a database storing a plurality of authority names and a plurality of authority IDs.

4. The permission application verification method according to claim 3, wherein the calculating the permission termination period according to the permission ID includes:

The right termination period is calculated according to the number of the right ID and the corresponding right.

5. The authorization application verification method according to claim 2, wherein said generating said temporary application key based on said first information and said user key includes;

Generate a first digital signature according to the first information and the user key; and

The temporary application key is generated according to the first digital signature and the first information.

6. The permission application verification method according to claim 2, wherein the permission calling interface parameter in the first token includes a permission range parameter, the permission range parameter includes the first information, and the basis The user key and the authorization call interface parameters to obtain the temporary verification key include:

Generate a second digital signature according to the first information and the user key; and

The temporary verification key is generated according to the second digital signature and the first information.

7. The permission application verification method according to claim 2, wherein the permission application verification method further comprises:

Use the user key to decrypt the first information to obtain the permission ID to be authorized and the permission termination period;

Judging whether the first token exceeds the authorization time limit according to the authority termination period and the current time;

If the authorization time limit is exceeded, the authorization application verification will not pass;

If it is within the authorization time limit, determine whether the first token exceeds the authorization range according to the authorization ID to be authorized, the user ID, and the authorization call interface parameters;

If it exceeds the authorization scope, the authorization application verification will not pass;

If it is within the authorization range, compare whether the first token and the second token are consistent.

8. A permission application verification device, wherein the permission application verification device includes:

The key generation module is used to obtain a temporary verification key according to the user key and the permission call interface parameters;

9. A permission application verification device, wherein the permission application verification device includes a processor and a memory coupled to the processor, wherein:

The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the following steps:

Obtaining a user key according to the user ID;

10. The authorization application verification device according to claim 9, wherein the first token further includes a temporary application key, and the temporary application key is obtained by the following method:

Obtaining the user key and at least one authorization ID to be authorized;

11. The permission application verification device according to claim 10, wherein the obtaining at least one permission ID to be authorized according to the name of the permission to be authorized includes:

12. The authorization application verification device according to claim 11, wherein the calculating the authorization termination period according to the authorization ID includes:

13. The authorization application verification device according to claim 10, wherein said generating said temporary application key based on said first information and said user key includes;

14. The permission application verification device according to claim 10, wherein the permission call interface parameter in the first token includes a permission range parameter, the permission range parameter includes the first information, and the basis The user key and the authorization call interface parameters to obtain the temporary verification key include:

15. A storage medium storing computer-readable instructions that, when executed by one or more processors, cause one or more processors to perform the following steps:

Obtaining a user key according to the user ID;

16. The storage medium storing computer-readable instructions according to claim 15, wherein the first token further comprises a temporary application key, and the temporary application key is obtained by the following method:

Obtaining the user key and at least one authorization ID to be authorized;

17. The storage medium storing computer-readable instructions according to claim 16, wherein the obtaining at least one right ID to be authorized according to the name of the right to be authorized includes:

18. The storage medium storing computer-readable instructions according to claim 17, wherein said calculating the permission expiration period according to the permission ID comprises:

19. The storage medium storing computer-readable instructions according to claim 16, wherein said generating said temporary application key based on said first information and said user key includes;

20. The storage medium storing computer-readable instructions according to claim 16, wherein the permission calling interface parameter in the first token includes a permission range parameter, and the permission range parameter includes the first information , Said obtaining a temporary verification key according to the user key and the permission call interface parameter includes: