WO2022121221A1

WO2022121221A1 - Token-based application access method and apparatus, computer device, and medium

Info

Publication number: WO2022121221A1
Application number: PCT/CN2021/090948
Authority: WO
Inventors: 彭康康
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-12-10
Filing date: 2021-04-29
Publication date: 2022-06-16
Also published as: CN112528262A

Abstract

A token-based application access method and apparatus, a computer device, and a medium, applied to the field of authentication in financial science and technology. The method comprises: randomly determining a target token generation algorithm; generating a first token for a target user by using the target token generation algorithm and at least on the basis of association information of the target user, and sending the first token to the target user, the validity period of the first token being a first validity period; receiving an access request initiated by the target user, and obtaining a second token carried in the access request; if the second token is consistent with the first token and the current time is within the first validity period, passing the access request; and when the current time reaches a deadline range, extending the first validity period corresponding to the first token, the deadline range being a time range corresponding to the first validity period. The method improves the security and reliability of tokens, reduces the possibility that the expiring of a token interrupts the operation of a user, and improves the user experience.

Description

Token-based application access method, apparatus, computer device and medium

This application claims the priority of the Chinese patent application filed on December 10, 2020 with the application number CN 202011458074.1 and the invention title is "Token-based application access method, device, medium and electronic device", which The entire contents of this application are incorporated by reference.

technical field

The present application relates to the technical field of identity verification, and in particular, to a token-based application program access method, apparatus, computer device and computer-readable storage medium.

Background technique

With the vigorous development of the Internet, we will use all kinds of apps. In the process of using APP, there is generally an authentication mechanism to check the validity of the visitor. At present, the token (TOKEN) mechanism is generally used for authentication. After the user logs in successfully, the server will generate a unique value based on the user information, which is the token.

The general process of the token mechanism is as follows: when the client logs in for the first time, the server randomly generates a random string as a token and returns it to the client, and the server saves it. Each subsequent request of the client needs to carry the token returned by the server. The server compares the token saved by the server at the unified entrance. If the comparison is successful, subsequent business processing can be performed. If the comparison fails, it will be directly processed. return. The inventor realized that, on the one hand, under the traditional token mechanism, the use of a single token generation algorithm will lead to the token being cracked, and there is a security risk; You need to log out of the app and log in again, which will interrupt the user's operation process, make the operation troublesome, and reduce the user experience.

SUMMARY OF THE INVENTION

In the field of identity verification technology of financial technology, in order to solve the above technical problems, the purpose of this application is to provide a token-based application program access method, apparatus, computer equipment and computer-readable storage medium.

In a first aspect, a token-based application access method is provided, including:

Randomly determine the target token generation algorithm corresponding to the target user according to multiple token generation algorithms;

Using the target token generation algorithm and at least based on the associated information of the target user to generate a first token for the target user, and sending the first token to the application client where the target user is located, Wherein, the validity period of the first token is the first validity period;

Receive an access request initiated by the target user through the application client, and obtain the second token carried in the access request;

If the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token, pass the access request;

When the current time reaches the deadline range corresponding to the target token generation algorithm, the first validity period corresponding to the first token is extended, wherein the deadline range belongs to the first validity period The time range corresponding to the period.

In a second aspect, a token-based application access device is provided, including:

a random determination module, configured to randomly determine a target token generation algorithm corresponding to the target user according to a plurality of token generation algorithms;

A generating module, configured to generate a first token for the target user by using the target token generation algorithm and at least based on the associated information of the target user, and send the first token to the location where the target user is located The application client, wherein the validity period of the first token is the first validity period;

an acquisition module, configured to receive an access request initiated by the target user through the application client, and acquire the second token carried in the access request;

The passing module is configured to pass the access request if the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token;

an extension module, configured to extend the first validity period corresponding to the first token when the current time reaches a deadline range corresponding to the target token generation algorithm, wherein the deadline range It belongs to the time range corresponding to the first validity period.

In a third aspect, there is provided a computer device comprising a memory for storing a program accessed by a token-based application program of the processor and a processor, the processor configured to execute the command-based A program accessed by the application program of the card to perform the following processing: randomly determine a target token generation algorithm corresponding to a target user according to a plurality of token generation algorithms; utilize the target token generation algorithm and at least based on the associated information of the target user generating a first token for the target user, and sending the first token to the application client where the target user is located, wherein the validity period of the first token is the first validity period; receiving The target user obtains the second token carried in the access request through the access request initiated by the application client; if the second token is consistent with the first token and the current time is in the Within the first validity period corresponding to the first token, the access request is passed; when the current time reaches the deadline range corresponding to the target token generation algorithm, the first token corresponding to the first token is processed. A validity period is extended, wherein the deadline range belongs to the time range corresponding to the first validity period.

In a fourth aspect, a computer-readable storage medium storing computer-readable instructions is provided, and a program accessed by a token-based application program is stored thereon, and the program accessed by the token-based application program is executed by a processor The following processing is implemented when the target token generation algorithm is used: randomly determine the target token generation algorithm corresponding to the target user according to multiple token generation algorithms; a token, and send the first token to the application client where the target user is located, wherein the validity period of the first token is the first validity period; receiving the target user through the For the access request initiated by the application client, obtain the second token carried in the access request; if the second token is consistent with the first token and the current time is in the first token corresponding to the first token Within a valid period, the access request is passed; when the current time reaches the deadline range corresponding to the target token generation algorithm, the first valid period corresponding to the first token is extended, wherein , the deadline range belongs to the time range corresponding to the first validity period.

The above token-based application access method, device, computer equipment and computer-readable storage medium randomly determine a target token generation algorithm based on multiple token generation algorithms, and use the target token generation algorithm to generate tokens, therefore, The security and reliability of the token are effectively improved; at the same time, when the current time reaches the deadline range corresponding to the target token generation algorithm, the first validity period corresponding to the first token is also extended. Therefore, It greatly reduces the possibility that the token expiration will interrupt the user's operation, and improves the user experience.

It is to be understood that the foregoing general description and the following detailed description are exemplary only and do not limit the application.

Description of drawings

FIG. 1 is a schematic diagram of a system architecture of a token-based application program access method according to an exemplary embodiment.

Fig. 2 is a flowchart of a token-based application access method according to an exemplary embodiment.

FIG. 3 is a flowchart showing details of step 210 of an embodiment according to the embodiment of FIG. 2 .

Fig. 4 is a schematic flowchart of a basic flow of a token-based application access method according to an exemplary embodiment.

Fig. 5 is a block diagram of a token-based application access device according to an exemplary embodiment.

FIG. 6 is an exemplary block diagram of a computer device implementing the above token-based application access method according to an exemplary embodiment.

FIG. 7 is a computer-readable storage medium for implementing the above token-based application access method according to an exemplary embodiment.

Detailed ways

Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. Where the following description refers to the drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the illustrative examples below are not intended to represent all implementations consistent with this application. Rather, they are merely examples of apparatus and methods consistent with some aspects of the present application as recited in the appended claims.

Furthermore, the drawings are merely schematic illustrations of the present application and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repeated descriptions will be omitted. Some of the block diagrams shown in the figures are functional entities that do not necessarily necessarily correspond to physically or logically separate entities.

The present application first provides a token-based application access method. A token is a valid credential that allows a user to log in to an application in a certain way. In the traditional way, the server generates and assigns a token to the user's client. During the validity period, the user can directly access the application by virtue of the token without logging in. Once the token expires, even if the user is operating and using the application, The user also needs to re-use the password to log in to gain access, which is not only less secure, but also interrupts the user's operations while using the application, thereby degrading the user experience. The token-based application access method provided by the present application can not only improve security, but also reduce the possibility of interrupting user operations and ensure user experience.

The implementation terminal of this application can be any device with computing, processing and communication functions, which can be connected to an external device for receiving or sending data, and specifically can be a portable mobile device, such as a smart phone, tablet computer, notebook computer, PDA (Personal Digital Assistant), etc., can also be fixed devices, such as computer equipment, field terminals, desktop computers, servers, workstations, etc., or a collection of multiple devices, such as cloud computing physical infrastructure or server clusters .

Optionally, the implementation terminal of the present application may be a server or a physical infrastructure of cloud computing.

FIG. 1 is a schematic diagram of a system architecture of a token-based application program access method according to an exemplary embodiment. As shown in FIG. 1 , the system architecture includes a server 110 and a user terminal 120 . The user terminal 120 is connected with the server 110 through a wired or wireless communication link. Therefore, the user terminal 120 can send data to the server 110 or receive data from the server 110. The server 110 is provided with a server, and the user terminal 120 is provided with a server. There is a corresponding client, the server 110 is the implementation terminal in this embodiment, and the server 110 stores a plurality of token generation algorithms. When the token-based application access method provided by this application is applied to the system architecture shown in FIG. 1, a specific process may be as follows: the user initiates a registration request to the server 110 through the client on the user terminal 120, and Submit the associated information of the user to the server 110, and the server 110 generates a user ID for the user; then, the server 110 randomly determines the target token generation algorithm by using the stored multiple token generation algorithms, and determines the corresponding deadline range; Then, based on the target token generation algorithm and the associated information, a first token with an expiration date is generated for the target user, and the first token is sent to the client on the user terminal 120, and the user ID, first token, The validity period and the deadline range are correspondingly stored; next, the user initiates an access request to the server 110 through the client on the user terminal 120, and the server 110 will obtain the second token and user ID carried in the access request, where the first The second token does not refer to a token different from the first token, but refers specifically to the token sent by the user; then, the server 110 will find the corresponding first token according to the user ID, and finally find the first token that is found. A token is compared with a second token, and it is judged whether the second token is within the validity period, and if the comparison is consistent and the second token is within the validity period, the access request will be passed; after that, the server 110 will respond to the It is judged whether the current time is within the deadline. If the current time is within the deadline, the first validity period will be extended. In this way, it is possible to avoid interruption of user operations due to the expiration of the token validity period. user experience.

Fig. 2 is a flowchart of a token-based application access method according to an exemplary embodiment. This embodiment can be executed by a server, as shown in FIG. 2 , and includes the following steps:

Step 210: Randomly determine a target token generation algorithm corresponding to the target user according to multiple token generation algorithms.

In one embodiment, the target token generation algorithm corresponding to the target user is randomly determined according to a plurality of token generation algorithms and the subsequent steps are to log in to the application program again when the target user logs in to the application for the first time or the token provided by the target user becomes invalid. executed when.

This step may be performed when the target user logs in to the application for the first time, or may be performed when the target user's token expires, that is, when the token expires and the user logs in to the application again.

The login here is generally to log in with an account number and password.

Token generation algorithms can be of various kinds, and thus, the generated tokens can be strings of various forms. For example, a Universal Unique Identifier (UUID, Universally Unique Identifier) with a fixed number of digits and a random number can be generated, a long string based on the MD5 algorithm can be generated, and a long string based on the SHA-256 algorithm can also be generated.

In one embodiment, the random determination of the target token generation algorithm corresponding to the target user according to multiple token generation algorithms includes:

A token generation algorithm is randomly selected among multiple token generation algorithms as the target token generation algorithm corresponding to the target user.

In one embodiment, the specific steps of step 210 may be as shown in FIG. 3 . Fig. 3 is a flowchart showing the details of step 210 of an embodiment according to the embodiment of Fig. 2, please refer to Fig. 3, including the following steps:

Step 211: Randomly select a first predetermined number of token generation algorithms from a plurality of preset token generation algorithms.

The preset multiple token generation algorithms may be pre-stored in the token generation algorithm library, and the number of randomly selected token generation algorithms, that is, the first predetermined number, is smaller than the preset number of multiple token generation algorithms.

Step 212: Randomly select a token generation algorithm merging rule from a preset algorithm rule library, and integrate the first predetermined number of token generation algorithms according to the token generation algorithm merging rule, to obtain a combination with the target user. The corresponding target token generation algorithm.

For example, a token generation algorithm merging rule in the preset algorithm rule base may be to randomly select a token generation algorithm from a first predetermined number of token generation algorithms as a combination algorithm, and use the token generation algorithm in the first predetermined number of token generation algorithms. Other token generation algorithms except the merging algorithm generate tokens respectively, then each token is spliced into a string according to the order in which each token generation algorithm is selected, and finally the merging algorithm is used to generate tokens for the string. operation.

In this embodiment, the token generation algorithm is integrated by randomly selecting the token generation algorithm merging rule on the basis of randomly selecting the token generating algorithm. Therefore, the finally obtained target token generating algorithm is based on the randomly selected multiple A token generation algorithm is established, which improves the complexity of the target token generation algorithm, thereby ensuring the security of the generated token.

Step 220: Generate a first token for the target user by using the target token generation algorithm and at least based on the associated information of the target user, and send the first token to the application where the target user is located client.

Wherein, the validity period of the first token is the first validity period.

The associated information of the target user may be any information related to the target user, for example, the associated information of the target user may be the personal information of the target user.

When the target user uses the application client to initiate an access request again, the token generated for the target user will be carried.

The first validity period of the first token may be a preset fixed period, or may be a not always constant period generated based on certain elements each time a token is generated.

In one embodiment, the associated information of the target user includes a user type, and the validity period of the first token is determined according to the user type.

For example, the user types may include blacklisted suspect users, ordinary users, VIP users, etc., and the length of the validity period of the first token corresponding to the blacklisted suspect users, ordinary users, and VIP users may be set to increase sequentially, that is, blacklisted suspect users, ordinary users, and VIP users. The validity period of the first token corresponding to the listed suspect users is the shortest, the validity period of the first token corresponding to ordinary users is second, and the validity period of the first token corresponding to VIP users is the longest. .

In one embodiment, the associated information includes a plurality of pieces of personal information, each item of personal information corresponds to an information type, and the target token generation algorithm is used for the target user based on at least the associated information of the target user. The target user generates the first token, including:

According to the information type corresponding to the at least one piece of personal information of the target user, randomly generate replacement personal information corresponding to the at least one piece of personal information and the corresponding information type is the same;

The at least one item of personal information is correspondingly replaced with the corresponding replacement personal information.

In this embodiment, the personal information of the target user is replaced by randomly generating replacement personal information of the same information type, so that the generated token is not completely based on the personal information of the target user, thereby improving security.

Randomly select at least one piece of personal information from the personal information of the target user as the target personal information;

Obtain personal information corresponding to at least one other user from a preset database as replacement personal information;

For each of the target personal information in the personal information of the target user, replace the target personal information with replacement personal information of the same information type;

A first token is generated for the target user using the target token generation algorithm and based on the replaced personal information of the target user.

For a user, there is only one item of information corresponding to the same information type. The preset database may be a database into which the corresponding user information is written when each user registers, or may be a database established separately for providing replacement personal information.

For example, one piece of personal information of target user A is "work unit: Company A", and one piece of personal information of user B is "work unit: company B", and both pieces of personal information are of the type of work unit, then The information of user B's "work unit: Company B" can be used as replacement personal information to replace the information of target user A's "work unit: Company A".

In this embodiment, by replacing some personal information items in the personal information of the target user with the personal information of other users, the confusion of the generated first token is improved, thereby ensuring the concealment and security of the token. safety.

Step 230: Receive an access request initiated by the target user through the application client, and obtain a second token carried in the access request.

When the target user initiates an access request through the application client, it will carry the token generated for it.

In one embodiment, the first validity period is a length of time, and before receiving the access request initiated by the target user through the application client, the method further includes:

determining a deadline range corresponding to the target token generation algorithm;

The time when the first token is generated, the first token, the first validity period and the deadline range are stored correspondingly.

Since the deadline range corresponds to the target token generation algorithm, and the first validity period also corresponds to the first token and the target token generation algorithm, the deadline range corresponds to the first validity period.

The actual time range corresponding to the first validity period can be determined according to the time when the first token is generated and the first validity period defined by the time length. For example, the time when the first token is generated is 8:00, and the first validity period is 60 minutes, then the actual time range corresponding to the first validity period is 8:00 to 9:00.

By storing the time when the first token is generated, the first token, the first validity period and the deadline range, data can be provided for subsequent steps.

In one embodiment, each of the token generation algorithms corresponds to a deadline range, and the determining the deadline range corresponding to the target token generation algorithm includes:

The deadline range corresponding to the target token generation algorithm is determined according to the deadline range corresponding to at least one token generation algorithm on which the target token generation algorithm is based.

For example, when the randomly selected token generation algorithm is used as the target token generation algorithm, it is determined that the token generation algorithm on which the target token generation algorithm is based is the randomly selected token generation algorithm, and the randomly selected token generation algorithm can be directly selected. The deadline range corresponding to the token generation algorithm is taken as the deadline range corresponding to the target token generation algorithm.

In one embodiment, the target token generation algorithm is determined based on a plurality of token generation algorithms, and the target token generation algorithm is determined according to a deadline range corresponding to at least one token generation algorithm on which the target token generation algorithm is based. The deadline range corresponding to the target token generation algorithm, including:

obtaining each token generation algorithm on which the target token generation algorithm is determined;

Among the determined deadline ranges corresponding to each token generation algorithm, the deadline range with the smallest time length is determined as the deadline range corresponding to the target token generation algorithm.

The deadline range corresponding to each token generation algorithm can be obtained by looking up the table.

In this embodiment, by taking the minimum deadline range corresponding to each token generation algorithm on which the target token generation algorithm is based as the deadline range corresponding to the target token generation algorithm, the time for extending the validity period of the token can be made The range should not be too large, so as to ensure the security of extending the validity period of the token to a certain extent.

Step 240: Pass the access request if the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token.

In one embodiment, the method further includes:

If the second token is inconsistent with the first token or the current time is not within the first validity period corresponding to the first token, the access request is rejected.

Specifically, the target user may include the first user identifier, and after the first token is generated, the first token, the first user identifier and the first validity period are stored locally; the access request also includes the second user identifier, When judging whether the first token is consistent with the second token, first find the first user identification that is consistent with the second user identification, then determine the first token stored corresponding to the first user identification, and determine the The first token in the access request is compared with the second token in the access request; in addition, the first valid period stored corresponding to the first token is also determined, and a judgment is made whether the current time is within the first valid period .

After passing the access request, the target user can access the required resources provided by the local end through the application client.

In one embodiment, a first token is generated for the target user using the target token generation algorithm and based at least on the associated information of the target user, and the first token is sent to the target user After the application client is located, the method further includes:

storing the first token in a cache server;

Before passing the access request if the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token, the method includes:

sending the second token to a cache server so that the cache server compares the first token with the second token;

Obtain the comparison result from the cache server.

In this embodiment, by storing the first token in the cache server and comparing the tokens in the cache server, the processing and access speed of the cache server are relatively efficient, so the execution terminal of the present application can be reduced. Manage stress and increase efficiency.

Step 250: Extend the first validity period corresponding to the first token when the current time reaches the deadline range corresponding to the target token generation algorithm, wherein the deadline range belongs to the The time range corresponding to the first validity period.

The first validity period may be a period of time length, or may be a moment, and the method of extending the first validity period is mainly to increase the time length on the basis of the first validity period.

The deadline range belongs to the time range corresponding to the first validity term, that is, the deadline range is within the first validity term range.

The deadline range can be the time range between a time within the first validity period and the time when the first validity period ends, that is, the end time of the deadline range can be the same as the end time of the first validity period, and it can be a length of time. As the deadline range, the time when the first valid term ends minus the time length can be the start time of the deadline range. Of course, the deadline range may be other time ranges within the first validity period. Therefore, the deadline range can be any period of time within the first validity period.

In one embodiment, when the current time reaches a deadline range corresponding to the target token generation algorithm, extending the first validity period corresponding to the first token includes:

In the case that the current time reaches the deadline range corresponding to the target token generation algorithm, determining the sum of the termination time of the first validity period and the time length of the deadline range;

Extending the first validity period corresponding to the first token to the sum corresponding validity period.

For example, the first validity period is 7:30-8:30, the end time of the first validity period is 8:30, the deadline range is 8:00-8:30, and the time length of the deadline range is 30 minutes. If the current time is 8:02 and the current time reaches the expiration date range, then the sum of the termination time of the first validity period and the time length of the expiration date range is 9:00.

In the case that the current time reaches the deadline range corresponding to the target token generation algorithm, determining the sum of the current time and the time length of the first validity period;

For example, the first validity period is 7:30-8:30, the length of the first validity period is 60 minutes, and the deadline range is 8:00-8:30. If the current time is 8:02, then the current time The sum of the time length with the first validity period is 9:02.

In the case that the current time reaches the deadline range corresponding to the target token generation algorithm, determining the sum of the start time of the deadline range and the time length of the first valid term;

For example, if the first validity period is 7:30-8:30, the length of the first validity period is 60 minutes, the deadline range is 8:00-8:30, and the corresponding start time is 8:00, then, The sum of the start time of the deadline range and the length of the first validity period is 9:00.

In one embodiment, the first validity period is an expiration time, and before receiving the access request initiated by the target user through the application client, the method further includes:

correspondingly storing the first token, the first validity period and the deadline range;

When the current time reaches the deadline range corresponding to the target token generation algorithm, extending the first validity period corresponding to the first token includes:

In the case that the current time reaches the deadline range corresponding to the target token generation algorithm, determining the sum of the time length of the deadline range and the first validity period;

This embodiment is similar to the previous embodiment, but in this embodiment, the first validity period is defined as the expiration time, that is, the first validity period is a moment.

It can be seen that there are various ways to extend the first validity period corresponding to the first token, and the calculation can be performed based on various factors such as the first validity period, the time length of the deadline range, and the current time. The length of time to be extended may also be arbitrary, as long as the first validity period can be extended.

When the current time reaches the deadline range corresponding to the first valid term, if the application client has not entered the background within the predetermined time range before the current time, the first token corresponding to the first token An expiration date is extended.

The fact that the application client does not enter the background means that the operation interface of the application client is always displayed on the top layer of the terminal operating system. For example, the operation interface of the mobile phone terminal has always been at the top layer of the operating system.

In this embodiment, by checking whether the application client enters the background within a predetermined time range before the current time, only if the application client has not entered the background within the predetermined time range, the first An expiration date is extended, thus ensuring security when the token expiration date is extended.

Fig. 4 is a schematic flowchart of a basic flow of a token-based application access method according to an exemplary embodiment. The basic flow of the token-based application access method provided by this application can be shown in Figure 4: the application in the figure can be various types of application client, such as a mobile App or a PC. client.

Specifically, the basic process can be as follows: first, the user logs in to the application for the first time, and provides associated information to the local end through the application; the local end accesses the token rule base, and generates the token based on multiple tokens in the token rule base. The algorithm is randomly determined to obtain the target token generation algorithm; then, the local end uses the target token generation algorithm and associated information to generate a dynamic token as the first token, where the dynamic token means that the first token is generated by using each random The determined target token generation algorithm is generated, so the generation method of the dynamic token is not fixed; then, the dynamic token of the first token will be stored in the database and sent to the user end, so that the user can The terminal obtains the token; when the application initiates an access request, it will carry the second token in the access request, and the server will receive the access request carrying the second token; and then obtain the second token from the access request , the server will also obtain the stored first token from the database; then the server will compare the first token with the second token, if the result of the comparison is inconsistent, it will deny the user's access; if they are consistent, The expiration date database will be queried according to certain rules to determine whether the current time is within the expiration date range corresponding to the target token generation algorithm, and if so, the first valid period will be extended for automatic renewal.

To sum up, according to a token-based application access method provided in the embodiment of FIG. 2 , a target token generation algorithm is randomly determined based on multiple token generation algorithms, and a token is generated by using the target token generation algorithm, Therefore, the security and reliability of the token are effectively improved; at the same time, when the current time reaches the deadline range corresponding to the target token generation algorithm, the first validity period corresponding to the first token is also extended, Therefore, the possibility that the token expiration will interrupt the user's operation is greatly reduced, and the user experience is improved.

The present application also provides a token-based application access device, and the following are device embodiments of the present application.

Fig. 5 is a block diagram of a token-based application access device according to an exemplary embodiment. As shown in Figure 5, the device 500 includes:

The random determination module 510 is configured to randomly determine the target token generation algorithm corresponding to the target user according to the plurality of token generation algorithms;

A generating module 520, configured to generate a first token for the target user by using the target token generating algorithm and at least based on the associated information of the target user, and send the first token to the target user where the client of the application program is located, wherein the validity period of the first token is the first validity period;

The obtaining module 530 is configured to receive the access request initiated by the target user through the application client, and obtain the second token carried in the access request;

The module 540 is configured to pass the access request if the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token;

The extension module 550 is configured to extend the first validity period corresponding to the first token when the current time reaches the deadline range corresponding to the target token generation algorithm, wherein the deadline The range belongs to the time range corresponding to the first validity period.

In one embodiment, the random determination module is further configured to:

Randomly selecting a first predetermined number of token generation algorithms from a plurality of preset token generation algorithms;

Randomly select a token generation algorithm merging rule from the preset algorithm rule library, and integrate the first predetermined number of token generation algorithms according to the token generation algorithm merging rule to obtain a target token corresponding to the target user Generation algorithm.

In one embodiment, the associated information includes a plurality of pieces of personal information, each piece of personal information corresponds to an information type, and the generating module is further configured to:

In one embodiment, the first validity period is a length of time, and the generating module is further configured to: before receiving an access request initiated by the target user through the application client:

In one embodiment, the generating module is further configured to generate a first token for the target user using the target token generation algorithm and at least based on the associated information of the target user, and to generate the first token for the target user. After the token is sent to the application client where the target user is located:

storing the first token in a cache server;

The passing module is further configured to pass the access request before passing the access request if the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token:

Obtain the comparison result from the cache server.

In one embodiment, the extension module is further configured to:

In one embodiment, the first validity period is an expiration time, and the generating module is further configured to: before receiving an access request initiated by the target user through the application client:

The extension module is further configured to:

According to a third aspect of the present application, a computer device is also provided, which executes all or part of the steps of any one of the token-based application access methods shown above. The computer equipment includes:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute as illustrated in any of the above-described exemplary embodiments Token-based application access method.

As will be appreciated by one skilled in the art, various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application can be embodied in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, which may be collectively referred to herein as implementations "circuit", "module" or "system".

A computer device 600 according to this embodiment of the present application is described below with reference to FIG. 6 . The computer device 600 shown in FIG. 6 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

As shown in FIG. 6, computer device 600 takes the form of a general-purpose computing device. Components of the computer device 600 may include, but are not limited to, the above-mentioned at least one processing unit 610 , the above-mentioned at least one storage unit 620 , and a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610 ).

Wherein, the storage unit stores program codes, and the program codes can be executed by the processing unit 610, so that the processing unit 610 executes various exemplary methods according to the present application described in the above-mentioned “Methods of Embodiments” of this specification. Implementation steps.

The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 621 and/or a cache storage unit 622 , and may further include a read only storage unit (ROM) 623 .

The storage unit 620 may also include a program/utility 624 having a set (at least one) of program modules 625 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, An implementation of a network environment may be included in each or some combination of these examples.

The bus 630 may be representative of one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any of a variety of bus structures. bus.

The computer device 600 may also communicate with one or more external devices 800 (eg, keyboards, pointing devices, Bluetooth devices, etc.), with one or more devices that enable a user to interact with the computer device 600, and/or with Any device (eg, router, modem, etc.) that enables the computer device 600 to communicate with one or more other computer devices. Such communication may occur through an input/output (I/O) interface 650 , such as with display unit 640 . Also, the computer device 600 may communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN), and/or a public network such as the Internet) through a network adapter 660 . As shown, network adapter 660 communicates with other modules of computer device 600 via bus 630 . It should be understood that, although not shown, other hardware and/or software modules may be used in conjunction with computer device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives and data backup storage systems.

From the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein may be implemented by software, or may be implemented by software combined with necessary hardware. Therefore, the technical solutions according to the embodiments of the present application may be embodied in the form of software products, and the software products may be stored in a non-volatile storage medium (which may be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to cause a computer device (which may be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present application.

According to a fourth aspect of the present application, there is also provided a computer-readable storage medium on which a program product capable of implementing the above-mentioned method of the present specification is stored, and the computer-readable storage medium may be non-volatile or easily accessible. loss of sex. In some possible implementations, various aspects of the present application can also be implemented in the form of a program product, which includes program code, which is used to cause the program product to run on a terminal device when the program product is executed. The terminal device performs the steps according to various exemplary embodiments of the present application described in the above-mentioned "Example Method" section of this specification.

Referring to FIG. 7 , a program product 700 for implementing the above method according to an embodiment of the present application is described, which can adopt a portable compact disk read only memory (CD-ROM) and include program codes, and can be used in a terminal device, For example running on a personal computer. However, the program product of the present application is not limited thereto, and in this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

A computer readable signal medium may include a propagated data signal in baseband or as part of a carrier wave with readable program code embodied thereon. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium can also be any readable medium, other than a readable storage medium, that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

Program code embodied on a readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural Programming Language - such as the "C" language or similar programming language. The program code may execute entirely on the user's computer device, partly on the user's computer device, as a stand-alone software package, partly on the user's computer device and partly on a remote computer device, or entirely on the remote computer device or execute on the server. Where remote computer equipment is involved, the remote computer equipment may be connected to the user computer equipment via any kind of network, including a local area network (LAN) or wide area network (WAN), or may be connected to external computer equipment (eg, using an Internet service provider business via an Internet connection).

In addition, the above-mentioned figures are only schematic illustrations of the processes included in the methods according to the exemplary embodiments of the present application, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the chronological order of these processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, for example, in multiple modules.

It should be understood that the present application is not limited to the precise structures described above and illustrated in the accompanying drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

A token-based application access method comprising:

Randomly determine the target token generation algorithm corresponding to the target user according to multiple token generation algorithms;

Using the target token generation algorithm and at least based on the associated information of the target user to generate a first token for the target user, and sending the first token to the application client where the target user is located, Wherein, the validity period of the first token is the first validity period;

Receive an access request initiated by the target user through the application client, and obtain the second token carried in the access request;

If the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token, pass the access request;

When the current time reaches the deadline range corresponding to the target token generation algorithm, the first validity period corresponding to the first token is extended, wherein the deadline range belongs to the first validity period The time range corresponding to the period.
The method according to claim 1, wherein the randomly determining the target token generation algorithm corresponding to the target user according to a plurality of token generation algorithms comprises:

Randomly selecting a first predetermined number of token generation algorithms from a plurality of preset token generation algorithms;

Randomly select a token generation algorithm merging rule from the preset algorithm rule library, and integrate the first predetermined number of token generation algorithms according to the token generation algorithm merging rule to obtain a target token corresponding to the target user Generation algorithm.
The method of claim 1, wherein the associated information includes a plurality of pieces of personal information, each piece of personal information corresponding to an information type, and wherein the use of the target token generation algorithm is based on at least the target user's The associated information generates a first token for the target user, including:

Randomly select at least one piece of personal information from the personal information of the target user as the target personal information;

Obtain personal information corresponding to at least one other user from a preset database as replacement personal information;

For each of the target personal information in the personal information of the target user, replace the target personal information with replacement personal information of the same information type;

A first token is generated for the target user using the target token generation algorithm and based on the replaced personal information of the target user.
The method according to claim 1, wherein the first validity period is a length of time, and before receiving an access request initiated by the target user through the application client, the method further comprises:

determining a deadline range corresponding to the target token generation algorithm;

The time when the first token is generated, the first token, the first validity period and the deadline range are stored correspondingly.
The method of claim 1, wherein a first token is generated for the target user based on at least the associated information of the target user by using the target token generation algorithm, and the first token is sent After reaching the application client where the target user is located, the method further includes:

storing the first token in a cache server;

Before passing the access request if the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token, the method includes:

sending the second token to a cache server so that the cache server compares the first token with the second token;

Obtain the comparison result from the cache server.
The method according to claim 4, wherein when the current time reaches a deadline range corresponding to the target token generation algorithm, the first validity period corresponding to the first token is extended, include:

In the case that the current time reaches the deadline range corresponding to the target token generation algorithm, determining the sum of the termination time of the first validity period and the time length of the deadline range;

Extending the first validity period corresponding to the first token to the sum corresponding validity period.
The method according to claim 1, wherein the first validity period is an expiration time, and before receiving an access request initiated by the target user through the application client, the method further comprises:

determining a deadline range corresponding to the target token generation algorithm;

correspondingly storing the first token, the first validity period and the deadline range;

When the current time reaches the deadline range corresponding to the target token generation algorithm, extending the first validity period corresponding to the first token includes:

In the case that the current time reaches the deadline range corresponding to the target token generation algorithm, determining the sum of the time length of the deadline range and the first validity period;

Extending the first validity period corresponding to the first token to the sum corresponding validity period.
A token-based application access device, comprising:

a random determination module, configured to randomly determine a target token generation algorithm corresponding to the target user according to a plurality of token generation algorithms;

A generating module, configured to generate a first token for the target user by using the target token generation algorithm and at least based on the associated information of the target user, and send the first token to the location where the target user is located The application client, wherein the validity period of the first token is the first validity period;

an acquisition module, configured to receive an access request initiated by the target user through the application client, and acquire the second token carried in the access request;

The passing module is configured to pass the access request if the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token;

an extension module, configured to extend the first validity period corresponding to the first token when the current time reaches a deadline range corresponding to the target token generation algorithm, wherein the deadline range It belongs to the time range corresponding to the first validity period.
A computer device, comprising a memory and a processor, wherein computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the processor, the processor is caused to execute:

Randomly determine the target token generation algorithm corresponding to the target user according to multiple token generation algorithms;

Using the target token generation algorithm and at least based on the associated information of the target user to generate a first token for the target user, and sending the first token to the application client where the target user is located, Wherein, the validity period of the first token is the first validity period;

Receive an access request initiated by the target user through the application client, and obtain the second token carried in the access request;

If the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token, pass the access request;

When the current time reaches the deadline range corresponding to the target token generation algorithm, the first validity period corresponding to the first token is extended, wherein the deadline range belongs to the first validity period The time range corresponding to the period.
The computer device according to claim 9, wherein the randomly determining the target token generation algorithm corresponding to the target user according to a plurality of token generation algorithms comprises:

Randomly selecting a first predetermined number of token generation algorithms from a plurality of preset token generation algorithms;

Randomly select a token generation algorithm merging rule from the preset algorithm rule library, and integrate the first predetermined number of token generation algorithms according to the token generation algorithm merging rule to obtain a target token corresponding to the target user Generation algorithm.
9. The computer device of claim 9, wherein the associated information includes a plurality of pieces of personal information, each piece of personal information corresponding to an information type, and wherein the target token generation algorithm is utilized and based at least on the target user The associated information of the target user generates a first token, including:

Randomly select at least one piece of personal information from the personal information of the target user as the target personal information;

Obtain personal information corresponding to at least one other user from a preset database as replacement personal information;

For each of the target personal information in the personal information of the target user, replace the target personal information with replacement personal information of the same information type;

A first token is generated for the target user using the target token generation algorithm and based on the replaced personal information of the target user.
10. The computer device of claim 9, wherein the first validity period is a length of time during which the computer-readable instructions are issued prior to receiving an access request initiated by the target user through the application client. When the processor is executed, the processor is caused to also execute:

determining a deadline range corresponding to the target token generation algorithm;

The time when the first token is generated, the first token, the first validity period and the deadline range are stored correspondingly.
9. The computer device of claim 9, wherein a first token is generated for the target user based on at least the associated information of the target user using the target token generation algorithm, and the first token is converted to the target user. After being sent to the application client where the target user is located, when the computer-readable instructions are executed by the processor, the processor further executes:

storing the first token in a cache server;

before passing the access request, the computer-readable instructions are When the processor is executed, the processor is caused to also execute:

sending the second token to a cache server so that the cache server compares the first token with the second token;

Obtain the comparison result from the cache server.
The computer device according to claim 12, wherein the first validity period corresponding to the first token is extended when the current time reaches a deadline range corresponding to the target token generation algorithm ,include:

In the case that the current time reaches the deadline range corresponding to the target token generation algorithm, determining the sum of the termination time of the first validity period and the time length of the deadline range;

Extending the first validity period corresponding to the first token to the sum corresponding validity period.
9. The computer device of claim 9, wherein the first expiration date is an expiration time, and the computer-readable instructions are executed by the computer-readable instruction prior to receiving an access request initiated by the target user through the application client. When the processor executes, the processor is caused to also execute:

determining a deadline range corresponding to the target token generation algorithm;

correspondingly storing the first token, the first validity period and the deadline range;

When the current time reaches the deadline range corresponding to the target token generation algorithm, extending the first validity period corresponding to the first token includes:

In the case that the current time reaches the deadline range corresponding to the target token generation algorithm, determining the sum of the time length of the deadline range and the first validity period;

Extending the first validity period corresponding to the first token to the sum corresponding validity period.
A computer-readable storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to execute:

Randomly determine the target token generation algorithm corresponding to the target user according to multiple token generation algorithms;

Using the target token generation algorithm and at least based on the associated information of the target user to generate a first token for the target user, and sending the first token to the application client where the target user is located, Wherein, the validity period of the first token is the first validity period;

Receive an access request initiated by the target user through the application client, and obtain the second token carried in the access request;

If the second token is consistent with the first token and the current time is within the first validity period corresponding to the first token, pass the access request;

When the current time reaches the deadline range corresponding to the target token generation algorithm, the first validity period corresponding to the first token is extended, wherein the deadline range belongs to the first validity period The time range corresponding to the period.
The computer-readable storage medium of claim 16, wherein the randomly determining a target token generation algorithm corresponding to the target user according to a plurality of token generation algorithms comprises:

Randomly selecting a first predetermined number of token generation algorithms from a plurality of preset token generation algorithms;

Randomly select a token generation algorithm merging rule from a preset algorithm rule library, and integrate the first predetermined number of token generation algorithms according to the token generation algorithm merging rule to obtain a target token corresponding to the target user Generation algorithm.
17. The computer-readable storage medium of claim 16, wherein the associated information includes a plurality of pieces of personal information, each piece of personal information corresponding to an information type, the generating algorithm using the target token and based on at least the The associated information of the target user generates a first token for the target user, including:

Randomly select at least one piece of personal information from the personal information of the target user as the target personal information;

Obtain personal information corresponding to at least one other user from a preset database as replacement personal information;

For each of the target personal information in the personal information of the target user, replace the target personal information with replacement personal information of the same information type;

A first token is generated for the target user using the target token generation algorithm and based on the replaced personal information of the target user.
The computer-readable storage medium according to claim 16, wherein the first validity period is a length of time, and before receiving an access request initiated by the target user through the application client, the computer-readable Instructions, when executed by one or more processors, cause the one or more processors to also execute:

determining a deadline range corresponding to the target token generation algorithm;

The time when the first token is generated, the first token, the first validity period and the deadline range are stored correspondingly.
17. The computer-readable storage medium of claim 16, wherein a first token is generated for the target user using the target token generation algorithm and based at least on the associated information of the target user, and the first token is generated for the target user. After a token is sent to the application client where the target user is located, when the computer-readable instructions are executed by one or more processors, the one or more processors further execute:

storing the first token in a cache server;

Before passing the access request, the computer-readable instructions are executed by a When executed by one or more processors, cause one or more processors to also execute:

sending the second token to a cache server so that the cache server compares the first token with the second token;

Obtain the comparison result from the cache server.