WO2023093500A1 - 一种访问验证方法及装置 - Google Patents

一种访问验证方法及装置 Download PDF

Info

Publication number
WO2023093500A1
WO2023093500A1 PCT/CN2022/129954 CN2022129954W WO2023093500A1 WO 2023093500 A1 WO2023093500 A1 WO 2023093500A1 CN 2022129954 W CN2022129954 W CN 2022129954W WO 2023093500 A1 WO2023093500 A1 WO 2023093500A1
Authority
WO
WIPO (PCT)
Prior art keywords
token
value
access
salt value
salt
Prior art date
Application number
PCT/CN2022/129954
Other languages
English (en)
French (fr)
Inventor
陈晓峰
邱毅
汪亚男
Original Assignee
深圳前海微众银行股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳前海微众银行股份有限公司 filed Critical 深圳前海微众银行股份有限公司
Publication of WO2023093500A1 publication Critical patent/WO2023093500A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the present application relates to the field of network technologies, in particular to an access verification method and device.
  • the OAuth (Open Authorization) protocol is an open standard that allows third-party applications to access private resources (such as photos, videos, An authorization protocol for contact lists, etc.).
  • the basic principle of the OAuth protocol After the user authorizes a third-party application, the authentication server corresponding to the website where the resource is to be accessed will issue a token (access token), and the authentication server will store the token in the database and send it to the first Three-party application storage. After the authorization is complete, the third-party application uses the token to obtain the resource to be accessed. In this way, by storing the token in the database, the authentication server can verify the resource acquisition request, ensuring the security of the resource access process.
  • the authentication server needs to store the token in the database, so that when receiving a resource acquisition request sent by a third-party application, the authentication server can obtain the stored token from the database for the third-party application The returned token is verified to determine the legitimacy of the third-party application.
  • the storage database fails, the authentication server cannot obtain the token from the database for authentication, and the stability of the authentication system is poor.
  • Embodiments of the present application provide an access verification method and device, which are used to improve the operation reliability of an authentication system.
  • the embodiment of the present application provides an access verification method, which includes:
  • the authentication server receives the resource acquisition request sent by the access user to the open server, and extracts the contained access token and user information of the access user from the resource acquisition request; wherein, the access token includes a token verification Verification value and token identification; The token verification value is generated according to the token credential;
  • the authentication server After the authentication server determines that the access token is valid according to the token expiration time in the token identifier, it obtains the salt value corresponding to the salt value number in the token identifier from the salt value record;
  • the salt value record is stored in the memory of the authentication server;
  • the authentication server generates a comparison check value according to the user information, the salt value, the salt value number and the token expiration time;
  • the authentication server After the authentication server determines that the token verification value matches the comparison verification value, it generates a resource authorization response and returns it to the open server.
  • the access token is composed of a token identifier and a token verification value, and the token verification value is generated according to the token credential.
  • the token credential in the access token being transmitted is transmitted in the form of the token verification value, so that the token credential is not in plain text during the transmission process, and even if it is obtained, no information about the token credential can be obtained, improving the Security of Information Transmission.
  • the resource acquisition request contains the access token and the user information of the accessing user.
  • the authentication server receives the resource acquisition request, it can obtain the salt value number (the value of the salt value in the token credential) according to the token identifier in the resource acquisition request. salt number) and token expiration time.
  • the salt value is obtained from the salt value record to generate a comparison check value to obtain the resource Validate the token checksum in the request.
  • the authentication server can achieve authentication without storing the token verification value in the database, that is, even if the database fails and the authentication server cannot obtain the token verification value, it can also obtain the information in the request according to the resource Generate a comparison verification value to verify the token verification value.
  • this application solves the failure of authentication caused by the failure of the authentication server to obtain the verification value of the token from the database when the database fails. problem, which improves the operational reliability of the authentication system.
  • the authentication server before the authentication server receives the resource acquisition request sent by the access user to the open server, it also includes:
  • the authentication server receives the token acquisition request sent by the open server, and the token acquisition request includes user information of the accessing user;
  • the authentication server determines a token identifier for the token acquisition request; the token identifier includes a token expiration time and a salt value number determined from the salt value record;
  • the authentication server generates a token certificate based on the user information, the salt value corresponding to the salt value number, and the token identifier;
  • the authentication server sends a token generation response carrying an access token to the open server; the access token includes the token identifier and the token credential.
  • the authentication server After the authentication server receives the token acquisition request containing the user information of the accessing user sent by the open server, it determines for the token acquisition request the token containing information such as token expiration time, salt number, and salt value.
  • the token identification and the token credential and further, obtain the token verification value according to the token credential, and return the token generation response including the token verification value and the token identification to the open server.
  • the authentication server can also obtain the comparison verification value according to the information in the resource acquisition request and the salt value record in the memory, and compare the resources according to the comparison verification value. Get the token verification value of the request for verification.
  • the token identifier further includes an extension field; the authentication server generates a token credential based on the user information, the salt value corresponding to the salt value number, and the token identifier, including:
  • the authentication server generates a token certificate based on the user information, the salt value corresponding to the salt value number, the field value in the extension field, and the token identifier;
  • the authentication server generates a comparison check value according to the user information, the salt value, the salt value number and the token expiration time, including:
  • the authentication server generates a comparison check value according to the user information, the salt value, the salt value number, the token expiration time and the field value in the extension field.
  • the token ID and the token credential may also contain extended fields.
  • more information can be set in the extension field, and corresponding verification can be performed according to the corresponding information in the extension field. For example, if you set information such as the ID of the authentication server that generated the access token and the type of the access token in the extension field, then after the authentication server receives the token ID, it can To verify whether the access token is generated by the authentication server, you can check whether the authentication server is used to authenticate this type of access token according to the access token type information in the extension field.
  • the extension field The information in is not limited, and can be set according to the required information.
  • the token verification value is generated according to the token credential, including:
  • the token verification value is the token certificate; or the token verification value is obtained by signing the token certificate and each request parameter; wherein, the resource acquisition request also includes each request parameters.
  • the token verification value is obtained by signing according to the token credential and the request parameters of the resource acquisition request.
  • the token certificate in transmission can not be "exposed", improving the security of information in the token certificate and ensuring the security of resource acquisition.
  • token credentials include:
  • the authentication server stores the access token in a token database
  • the authentication server fails to obtain the access token corresponding to the token identifier from the token database.
  • the authentication server if the authentication server fails to obtain the access token from the database, it verifies the token verification value in the resource acquisition request according to the comparison verification value to determine the legitimacy of the resource acquisition request.
  • the scheme that the authentication server generates a comparison check value according to the information in the resource acquisition request can be used as a downgrade scheme of the scheme for obtaining the token check value from the database access token. Then even if the database fails, authentication can be performed normally, ensuring the reliability of the authentication system.
  • the authentication server acquires an access token corresponding to the token identifier from the token database
  • the authentication server determines whether the access token in the resource acquisition request matches the access token obtained from the token database, so as to determine whether to generate a resource authorization response and return it to the open server.
  • the authentication server fails to obtain the access token from the database, it verifies the token verification value in the resource acquisition request according to the comparison verification value to determine the legitimacy of the resource acquisition request.
  • the access token is obtained from the database (the access token contains the token verification value generated when receiving the token acquisition request)
  • the token verification value obtained from the access token obtained from the database is directly obtained Verify with the token verification value in the resource acquisition request, and also determine from the access token of the database whether the token verification value in the resource acquisition request is one-time and whether it has been used. If it has been used, Then the resource acquisition request is not processed, and if it has not been used and the verification passes, the requested resource is returned to the accessing user terminal.
  • the scheme that the authentication server generates a comparison check value based on the information in the resource acquisition request can be used as a downgrading scheme for obtaining the token check value from the database access token, on the premise of ensuring the reliability of the authentication system Under this condition, when the database is running normally, it can also ensure that the usage information of the token verification value can be accurately obtained, further ensuring the accuracy of the token usage.
  • the authentication server configures the salt value record by adopting a gray-scale release mechanism, and the gray-scale release mechanism is used to set the salt value record in the salt value record when any authentication server has not configured the salt value record.
  • the salt value is set to be used in the token verification phase, and when each authentication server has configured the salt value record, the salt value in the salt value record is set to be used in the token generation phase and the token verification phase .
  • the gray-scale release mechanism sets the salt value in the salt value record to be used in the token verification stage when any authentication server has not configured the salt value record. In this way, it is prevented that the unconfigured authentication server uses the newly configured salt value record for token verification, resulting in the inability to obtain a new salt value and fail to complete the verification.
  • the gray release mechanism sets the salt value in the salt value record to be used in the token generation phase and the token verification phase when the salt value record is configured on each authentication server. In this way, after each authentication server has configured the salt value record, the configuration and update of the salt value record is completed, and any authentication server can perform token generation and token verification according to the new salt value record. In this way, the salt value is updated as needed to ensure the security and validity of the access token.
  • the authentication server receives the token valid time change configuration; the token valid time indicated in the token valid time change configuration has a higher priority than the token expiry time in the access token.
  • the authentication server determines the token expiration time of the invalid state in the token identification as valid based on the token validity time change configuration, or determines the valid state in the token identification to be valid based on the token validity time change configuration.
  • the token expiration time is determined as invalid.
  • the token valid time in the access token can be changed through token valid time change configuration.
  • improve the flexibility of changing the token expiration time and validity time so that even if the token expiration time information is written in the access token, the validity time and expiration time of the access token can still be flexibly changed according to the token validity time change configuration, etc. information.
  • an access verification device which includes:
  • the transceiver module is used to receive the resource acquisition request sent by the access user to the open server, so as to extract the contained access token and user information of the access user from the resource acquisition request; wherein the access token includes a token check value and token identification; the token check value is generated according to the token credential;
  • a processing module configured to obtain the salt value corresponding to the salt value number in the token ID from the salt value record after determining that the access token is valid according to the token expiration time in the token ID; the salt The value record is stored in the memory of the authentication server;
  • the processing module is also used to generate a comparison check value according to the user information, the salt value, the salt value number and the token expiration time;
  • the processing module is further configured to, after determining that the token verification value matches the comparison verification value, generate a resource authorization response and return it to the open server through the transceiver module.
  • the embodiment of the present application also provides a computing device, including: a memory for storing programs; a processor for invoking the programs stored in the memory, and executing various methods according to the first aspect according to the obtained programs. methods described in Possible Designs.
  • the embodiment of the present application also provides a computer-readable non-volatile storage medium, including a computer-readable program, and when the computer reads and executes the computer-readable program, the computer executes the computer-readable program according to the first aspect.
  • a computer-readable non-volatile storage medium including a computer-readable program
  • the computer executes the computer-readable program according to the first aspect.
  • FIG. 1 is a schematic diagram of an access verification architecture provided by an embodiment of the present application
  • FIG. 2 is a schematic flow diagram of an access verification method provided in an embodiment of the present application.
  • FIG. 3 is a schematic flow diagram of an access verification method provided in an embodiment of the present application.
  • FIG. 4 is a schematic flow diagram of an access verification method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flow diagram of an access verification method provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of an access verification device provided by an embodiment of the present application.
  • Figure 1 is a schematic diagram of an access verification system architecture provided by an embodiment of the present application, wherein the resource requester can be an access user terminal, or any requester that can initiate resource acquisition, such as a third-party platform, and is not specifically limited here .
  • the resource requester is an access user terminal
  • the user information described below may be information such as user account and user password; if the resource requester is a third-party platform, application software, etc., the user information may also be a third-party platform, Information such as the logo of the application software is not specifically limited here.
  • the resource requester is the access user terminal, and the user information is the user account and password as an example:
  • the resource requester generates an authorization address request and sends it to the business system. After the business system receives the authorization address request through the open service, it returns the authorization address to the resource requester. After receiving the authorization address, the resource requester generates a token acquisition request according to the user information entered by the user (registered user account number and password, etc. including user information that includes access user authorization information) and sends it to the business system.
  • the open service in the business system receives the token acquisition request, and sends the user information of the accessing user to the user center.
  • the user center receives the user information of the accessing user, verifies the user information in the token acquisition request according to the recorded user information of the accessing user, and sends the verification result to the open service after the verification is passed.
  • the open service After the open service determines that the accessing user of the token acquisition request is legal, the open service generates a confirmation token notification and sends it to the authentication center, so that the authentication center generates an access token for the token acquisition request.
  • the confirmation token notification contains the order The user information in the card acquisition request.
  • the authentication center After receiving the confirmation token notification, the authentication center generates a token identifier for the token acquisition request including the token expiration time, the salt value number corresponding to the salt value determined from the salt value record, etc., according to the user information, salt value, etc.
  • the value number, the salt value corresponding to the salt value number, and the token ID generate a token credential, obtain an access token including the token ID and token credential, and send the token generation response carrying the access token to the open service .
  • the open service After receiving the token generation response, the open service returns the token generation response to the resource requester. After receiving the token generation response, the resource requester obtains the access token in the token generation response, and generates a resource acquisition request based on the access token.
  • the resource acquisition request generated here can be made of two types:
  • the resource acquisition request contains relevant information such as user information, token credentials, and token identifiers;
  • the resource acquisition request includes information such as user information, signature (obtained by signing the token credential and each request parameter), token identifier, and each request parameter.
  • the open service in the business system receives a resource acquisition request including user information, token verification value (token certificate), token identification and other related information
  • the legality of the resource acquisition request through the authentication center sex is verified.
  • the authentication center determines that the access token is valid according to the token expiration time in the token identifier in the resource acquisition request (if the access token is determined to be invalid, the open service will not respond to the resource acquisition request), according to the user
  • the information and/or token identifier obtains the token verification value from the database, and if the acquisition is successful, compares the token verification value in the resource acquisition request with the token verification value obtained from the database, and if the verification passes (if If the verification fails, the open service does not respond to the resource acquisition request), and the authentication center sends a verification pass notification to the open service.
  • the open service returns the resource to the resource requester via a notification based on validation. If it fails to obtain the token verification value from the database according to the user information and/or the token identifier, the authentication center determines the salt value corresponding to the salt value number from the salt value record according to the salt value number in the token identifier, further, Generate a token credential based on the salt value number, the salt value corresponding to the salt value number, user information, and token expiration time, and obtain a comparison check value based on the token credential. The authentication center compares the token verification value in the resource acquisition request with the comparison verification value, and if the verification passes (if the verification fails, the open service will not respond to the resource acquisition request), the authentication center will pass the verification Notifications are sent to open services. The open service returns the resource to the resource requester via a notification based on validation.
  • an open service in the business system receives a resource acquisition request containing information such as user information, signature-token verification value (signed by the token certificate and each request parameter), token identifier, and each request parameter, it will pass the authentication
  • the authority center verifies the legitimacy of the resource acquisition request. After the authentication center determines that the access token is valid according to the token expiration time in the token identifier in the resource acquisition request (if the access token is determined to be invalid, the open service will not respond to the resource acquisition request), according to the user information and/or the token ID to obtain the token verification value from the database. If the acquisition is successful, compare the token verification value in the resource acquisition request with the token verification value obtained from the database.
  • the authentication center will send a verification pass notification to the open service.
  • the open service returns the resource to the resource requester via a notification based on validation. If it fails to obtain the token verification value from the database according to the user information and/or the token identifier, the authentication center determines the salt value corresponding to the salt value number from the salt value record according to the salt value number in the token identifier, further, Generate a token certificate based on the salt number, the salt value corresponding to the salt number, user information, and token expiration time, and then further sign the token certificate and each request parameter in the resource acquisition request to obtain a comparison check value.
  • the authentication center compares the signature-token verification value in the resource acquisition request with the comparison verification value. If the verification passes (if the verification fails, the open service will not respond to the resource acquisition request), the authentication center will Verification is sent to the open service via a notification. The open service returns the resource to the resource requester via a notification based on validation.
  • the token in the prior art is set as an access token containing relevant information such as salt value, salt value number, user information, token expiration time, etc. Even if the database fails, the authentication center can also obtain the resource according to the The access token in the resource acquisition request is authenticated by relevant information, which ensures the stability and reliability of the authentication system.
  • the embodiment of the present application provides a flow of an access verification method, as shown in Figure 2, including:
  • Step 201 the authentication server receives the resource acquisition request sent by the access user to the open server, so as to extract the contained access token and user information of the access user from the resource acquisition request; wherein, the access token includes Token verification value and token identification; the token verification value is generated according to the token credential;
  • the user information may be information such as a user account and a user password, or may be information such as an identifier of a third-party platform, which is not specifically limited here.
  • Step 202 After the authentication server determines that the access token is valid according to the token expiration time in the token ID, it obtains the salt value corresponding to the salt value number in the token ID from the salt value record ;
  • the salt value record is stored in the memory of the authentication server;
  • Step 203 the authentication server generates a comparison check value according to the user information, the salt value, the salt value number and the token expiration time;
  • Step 204 After determining that the verification value of the token matches the comparison verification value, the authentication server generates a resource authorization response and returns it to the open server.
  • the access token is composed of a token identifier and a token verification value, and the token verification value is generated according to the token credential.
  • the token credential in the access token being transmitted is transmitted in the form of the token verification value, so that the token credential is not in plain text during the transmission process, and even if it is obtained, no information about the token credential can be obtained, improving the Security of Information Transmission.
  • the resource acquisition request contains the access token and the user information of the accessing user.
  • the authentication server receives the resource acquisition request, it can obtain the salt value number (the value of the salt value in the token credential) according to the token identifier in the resource acquisition request. salt number) and token expiration time.
  • the authentication server After determining that the access token has not expired according to the token expiration time in the token ID, further obtain the salt value from the salt value record according to the user information and the salt value number of the token ID to generate a comparison check value against the resource acquisition request Token checksum for verification.
  • the authentication server can achieve authentication without storing the token verification value in the database, that is, even if the database fails and the authentication server cannot obtain the token verification value, it can also obtain the information in the request according to the resource Generate a comparison verification value to verify the token verification value.
  • this application solves the failure of the authentication server to obtain the token verification value from the database when the database fails, which leads to the inability to authenticate problem, which improves the operational reliability of the authentication system.
  • the embodiment of the present application provides a method for generating an access token.
  • the authentication server receives the token sent by the open server.
  • card acquisition request the token acquisition request includes the user information of the accessing user
  • the authentication server determines the token identifier for the token acquisition request
  • the token identifier includes token expiration time, from the The salt value number determined in the salt value record
  • the authentication server generates a token certificate based on the user information, the salt value corresponding to the salt value number, and the token identifier
  • the authentication server will carry A token generation response with an access token is sent to the open server;
  • the access token includes the token identifier and the token credential.
  • the open server sends the token acquisition request to the authentication server.
  • the valid time of the card can be determined according to the type of requested resource or token type, etc.
  • the salt value and salt value number determined from the salt value record to generate a token credential, and determine the token according to the salt value number and token expiration time logo. Further generate an access token containing token id and token credentials.
  • the embodiment of the present application provides yet another access token, the token identifier further includes an extension field;
  • the authentication server bases the user information, the salt value corresponding to the salt value number, and the token Generating a token credential by identification, including: the authentication server generates a token credential based on the user information, the salt value corresponding to the salt value number, the field value in the extension field, and the token identifier;
  • the authentication server generates a comparison check value according to the user information, the salt value, the salt value number, and the token expiration time, including: the authentication server generates the comparison check value according to the user information, the The salt value, the salt value number, the token expiration time and the field value in the extension field generate a comparison check value.
  • extension fields may also be included in the token ID and token credential. That is, the token ID includes the salt number, token expiration time, and extension fields, and the token credential includes the salt number, token expiration time, and extension fields, as well as the salt value and user information corresponding to the salt number.
  • the authentication server when the authentication server generates a comparison check value, it also needs to generate a corresponding comparison check value including the salt number, token expiration time and extension fields, and the salt value corresponding to the salt number and user information.
  • the field value in the extension field may include the identity of the authentication server, token type and other relevant information. In this way, adding meaningful information in the access token facilitates the authentication server to obtain more relevant information, such as troubleshooting problems in processes such as resource access, and improving the applicability of the access token.
  • the size of the token certificate can be 32 bytes: the token expiration time can occupy 8 bytes, the number of the salt value can occupy 2 bytes, and each field value in the extension field can occupy 6 bytes, user info and salt number can take up 16 bytes.
  • the size of the token identifier can be 16 bytes: the token expiration time can occupy 8 bytes, the number of the salt value can occupy 2 bytes, and each field value in the extension field can occupy 6 bytes.
  • the token expiration time can be generated by the authentication server based on the validity period of the access token plus the current time, for example, the number of seconds from 1900-01-01 00:00:00 to the present, converted into hexadecimal (8 characters Festival). Salt value number in the salt value record: according to hexadecimal, 2-byte codes can accommodate 256 codes.
  • An embodiment of the present application provides a method for generating a token verification value, the token verification value is generated according to a token certificate, including: the token verification value is the token certificate; or The token verification value is obtained by signing the token credential and each request parameter; wherein, the resource acquisition request also includes each request parameter. That is to say, the token verification value may be a token credential, or may be obtained by signing according to the token credential and each request parameter in the resource acquisition request. It is provided here that a token verification value can be obtained by calculating the salt value corresponding to the salt value number, user information, salt value number, and token expiration time through a hash algorithm.
  • the embodiment of this application provides an access verification method. After generating the token certificate, it also includes:
  • the authentication server stores the access token in a token database
  • the authentication server fails to obtain the access token corresponding to the token identifier from the token database. That is to say, after the authentication server generates the access token, it can also store the access token in the database, and during the authentication process, first obtain the access token corresponding to the token identifier from the database, if the access token cannot be obtained , a comparison check value is generated.
  • the embodiment of this application provides an access verification method, which also includes:
  • the authentication server acquires an access token corresponding to the token identifier from the token database
  • the authentication server determines whether the access token in the resource acquisition request matches the access token obtained from the token database, so as to determine whether to generate a resource authorization response and return it to the open server. That is to say, if the access token can be obtained from the database during the authentication process, there is no need for the authentication server to generate a comparison check value, which can be performed based on the access token obtained from the database and the access token in the resource acquisition request. verify.
  • An embodiment of the present application provides a method for publishing salt value records in grayscale, which further includes: the authentication server configures the salt value record by using a grayscale release mechanism, and the grayscale release mechanism is used in any authentication service
  • the salt value record has not been configured on the server end, set the salt value in the salt value record to be used in the token verification stage, and when each authentication server has configured the salt value record, set the salt value
  • the salt value in the value record is set to be used in the token generation phase and the token validation phase. That is to say, the salt value records in the authentication server are all the same.
  • the new salt value Value records MUST NOT be used in the token validation phase.
  • the salt value record can contain multiple salt values to ensure the diversity of access tokens, improve the security of the access process, and reserve other salt values for replacement.
  • the embodiment of this application provides a method for changing the valid time of the token, which also includes:
  • the authentication server receives the token valid time change configuration; the token valid time indicated in the token valid time change configuration has a higher priority than the token expiry time in the access token.
  • the authentication server determines the token expiration time of the invalid state in the token identification as valid based on the token validity time change configuration, or determines the valid state in the token identification to be valid based on the token validity time change configuration.
  • the token expiration time is determined as invalid. That is to say, the token expiration time in the access token is not subject to temporary change control, you can set the token validity time change configuration in the authentication server, so that the token validity time has a higher priority than the access token
  • the token expiration time in the access token can be implemented to change the token validity time in the access token.
  • the embodiment of the present application provides an access verification method flow, as shown in Figure 3, including:
  • Step 301 the resource request terminal/server generates an authorization address request and sends it to the open server.
  • Step 302 After receiving the authorization address request, the open server returns the authorization address to the resource requesting terminal/server.
  • Step 303 the resource request terminal/server generates a first token acquisition request according to the user account and password input by the user, and sends it to the open server.
  • Step 304 the open server receives the first token acquisition request, and sends the user information in the first token acquisition request to the user center server.
  • Step 305 The user center server verifies the user information in the first token acquisition request according to the recorded user information, and if the verification fails, it notifies the open server not to respond to the first token acquisition request. If passed, return a verification pass message to the open server.
  • Step 306 the open server sends the relevant information in the first token acquisition request to the authentication server according to the received verification message.
  • the relevant information in the first token acquisition request includes user information.
  • Step 307 the authentication server generates a temporary access token according to the relevant information in the first token acquisition request, and returns the temporary access token to the open server (the temporary access token can be included in the temporary token generation response and returned to the open server).
  • the structure of the temporary access token can include a temporary token ID and a temporary token credential, and the size of the temporary token credential can be 32 bytes: the token expiration time can take up 8 bytes, and the salt value can be The serial number can occupy 2 bytes, each field value in the extension field can occupy 6 bytes, and the user information and salt value ID can occupy 16 bytes.
  • the size of the temporary token identifier can be 16 bytes: the token expiration time can occupy 8 bytes, the number of the salt value can occupy 2 bytes, and each field value in the extension field can occupy 6 bytes.
  • the 32-byte token credentials are hashed.
  • Step 308 the open server sends the temporary access token to the resource requesting terminal/server.
  • Step 309 the resource request terminal/server generates a second token acquisition request according to the temporary access token.
  • the resource request terminal/server sends the second token acquisition request to the open server.
  • a second token acquisition request includes: the temporary access token (temporary token credential + temporary token identifier) (used for identity verification), application resource access token (used for resource acquisition) information, user information, and request parameters.
  • the token check value of the temporary token credential used for identity verification.
  • Another second token acquisition request includes: temporary token identification, signature (generated based on token credentials + various request parameters) (for identity verification), resource access token application (for resource acquisition) information, user information, and request parameters.
  • signature is the token checksum.
  • Step 310 the open server sends the relevant information of the second token acquisition request to the authentication server.
  • Step 311 the authentication server generates a temporary comparison check value according to the relevant information in the second token acquisition request, and verifies the temporary access token according to the temporary comparison check value, and generates a resource access token if the verification passes , return the resource access token to the open server.
  • the method for generating the temporary comparison check value may be: for the above-mentioned second token acquisition request, after determining that the temporary access token is still valid according to the token expiration time in the temporary token identifier in the temporary access token , according to the salt value number in the temporary token identifier, determine the salt value corresponding to the salt value number from the salt value record, further, according to the salt value, the salt value number, the user information in the second token acquisition request, and the valid time of the token Generate a temporary comparison checksum.
  • Another second token acquisition request after determining that the temporary access token is still valid according to the token expiration time in the temporary token ID, determine the salt value from the salt value record according to the salt value number in the temporary token ID The salt value corresponding to the number, and further, generate a temporary token credential based on the salt value, salt value number, user information in the second token acquisition request, and token validity time, and combine the temporary token credential and the second token acquisition request Each request parameter is signed to obtain a temporary comparison check value.
  • the structure of the resource access token can include the resource token identifier and the resource token credential.
  • the size of the resource token credential can be 32 bytes: the token expiration time can occupy 8 bytes, and the salt value can occupy 8 bytes. 2 bytes, each field value in the extension field can occupy 6 bytes, user information and salt number can occupy 16 bytes.
  • the size of the resource token identifier can be 16 bytes: the token expiration time can occupy 8 bytes, the number of the salt value can occupy 2 bytes, and each field value in the extension field can occupy 6 bytes. Among them, the 32-byte token credentials are hashed.
  • Step 312 the open server sends the resource access token to the resource requesting terminal/server.
  • Step 313 the resource request terminal/server generates a resource acquisition request according to the resource access token, and sends it to the open server.
  • a resource acquisition request includes: the resource access token (resource token credential + resource token identifier) (for identity verification), application resource information (for resource acquisition), user information and Each request parameter and other information.
  • the token check value of the resource token credential includes: the resource access token (resource token credential + resource token identifier) (for identity verification), application resource information (for resource acquisition), user information and Each request parameter and other information.
  • Another resource acquisition request includes: resource token identification, signature (generated based on token certificate + each request parameter) (used to verify identity), application resource (used to obtain resource) information, user information and Each request parameter and other information.
  • the signature is the token checksum.
  • Step 314 the open server sends the relevant information of the resource acquisition request to the authentication server.
  • Step 315 the authentication server generates a resource comparison check value according to the relevant information of the resource acquisition request. And verify the resource access token according to the resource comparison check value, if the verification is passed, generate a resource authorization response, and return the resource authorization response to the open server.
  • the method for generating the resource comparison check value may be as follows: for the above resource acquisition request, after determining that the resource access token is still valid according to the token expiration time in the resource token identifier in the resource access token, according to the resource
  • the salt value number in the token identifier determines the salt value corresponding to the salt value number from the salt value record, and further, generates a resource comparison check value based on the salt value, salt value number, user information in the resource acquisition request, and token validity time .
  • Step 316 The open server receives the resource authorization response, and returns the resources corresponding to the resource acquisition request to the resource requesting terminal/server.
  • Step 317 the resource requesting terminal/server receives the resource.
  • step 311 the process of verifying the temporary access token in step 311 is the process of obtaining a temporary access token, which may not be executed, that is, may not be obtained Temporary access token.
  • the embodiment of the present application provides an access verification method flow, as shown in Figure 4, including:
  • Step 401 the resource request terminal/server generates an authorization address request and sends it to the open server.
  • Step 402 After receiving the authorization address request, the open server returns the authorization address to the resource requesting terminal/server.
  • Step 403 the resource request terminal/server generates a first token acquisition request according to the user account and password input by the user, and sends it to the open server.
  • Step 404 the open server receives the first token acquisition request, and sends the user information in the first token acquisition request to the user center server.
  • Step 405 The user center server verifies the user information in the first token acquisition request according to the recorded user information, and if the verification fails, it notifies the open server not to respond to the first token acquisition request. If passed, return a verification pass message to the open server.
  • Step 406 the open server sends the relevant information in the first token acquisition request to the authentication server according to the received verification pass message.
  • Step 407 the authentication server generates a temporary access token according to the relevant information in the first token acquisition request, returns the temporary access token to the open server, and sends the temporary access token to the database.
  • Step 408 the open server sends the temporary access token to the resource requesting terminal/server.
  • Step 409 the resource request terminal/server generates a second token acquisition request according to the temporary access token.
  • the resource request terminal/server sends the second token acquisition request to the open server.
  • Step 410 the open server sends the relevant information of the second token acquisition request to the authentication server.
  • Step 411 the authentication server fails to obtain the temporary access token from the database, generates a temporary comparison check value according to the relevant information in the second token acquisition request, and verifies the temporary access token according to the temporary comparison check value, If the verification is passed, a resource access token is generated, and the resource access token is returned to the open server.
  • Step 412 the open server sends the resource access token to the resource requesting terminal/server.
  • Step 413 the resource request terminal/server generates a resource acquisition request according to the resource access token, and sends it to the open server.
  • Step 414 the open server sends the relevant information of the resource acquisition request to the authentication server.
  • Step 415 the authentication server generates a resource comparison check value according to the relevant information of the resource acquisition request, and verifies the resource access token according to the resource comparison check value, if the verification is passed, generates a resource authorization response, and sends the resource authorization response Return to open server.
  • Step 416 The open server receives the resource authorization response, and returns the resources corresponding to the resource acquisition request to the resource requesting terminal/server.
  • Step 417 the resource requesting terminal/server receives the resource.
  • step 406 to step 409 the process of verifying the temporary access token in step 411 is the process of obtaining a temporary access token, which may not be executed, that is, may not be obtained Temporary access token.
  • This process includes the process of storing the access token in the database. If the access token cannot be obtained from the database (database failure), the authentication server generates a comparison check value, which is compared with the token check value in the request. Verify. That is to say, the solution of generating a comparison check value for access verification is a downgrade solution of access verification.
  • the embodiment of the present application also provides another access verification method flow, which corresponds to the method flow when the authentication server can obtain the access token from the database, as shown in Figure 5 ,include:
  • Step 501 the resource request terminal/server generates an authorization address request and sends it to the open server.
  • Step 502 After receiving the authorization address request, the open server returns the authorization address to the resource requesting terminal/server.
  • Step 503 the resource request terminal/server generates a first token acquisition request according to the user account and password input by the user, and sends it to the open server.
  • Step 504 the open server receives the first token acquisition request, and sends the user information in the first token acquisition request to the user center server.
  • Step 505 the user center server verifies the user information in the first token acquisition request according to the recorded user information, and if the verification fails, informs the open server not to respond to the first token acquisition request. If the verification is passed, a verification pass message is returned to the open server.
  • Step 506 the open server sends the relevant information in the first token acquisition request to the authentication server according to the received verification message.
  • Step 507 the authentication server generates a temporary access token according to the relevant information in the first token acquisition request, returns the temporary access token to the open server and stores it in the database.
  • Step 508 the open server sends the temporary access token to the resource requesting terminal/server.
  • Step 509 the resource request terminal/server generates a second token acquisition request according to the temporary access token.
  • the resource request terminal/server sends the second token acquisition request to the open server.
  • Step 510 the open server sends the relevant information of the second token acquisition request to the authentication server.
  • Step 511 the authentication server successfully obtains the temporary access token from the database, and verifies the token verification value in the second token obtaining request and the token verification value corresponding to the temporary access token obtained from the database, After passing, the resource access token is generated and stored in the database, and the resource access token is returned to the open server.
  • Step 512 the open server sends the resource access token to the resource requesting terminal/server.
  • Step 513 the resource request terminal/server generates a resource acquisition request according to the resource access token, and sends it to the open server.
  • Step 514 the open server sends the relevant information of the resource acquisition request to the authentication server.
  • Step 515 the authentication server obtains the resource access token from the database successfully, and verifies the token verification value in the resource acquisition request and the token verification value corresponding to the resource access token obtained from the database, if the verification passes , generate a resource authorization response, and return the resource authorization response to the open server.
  • Step 516 The open server receives the resource authorization response, and returns the resources corresponding to the resource acquisition request to the resource requesting terminal/server.
  • Step 517 the resource requesting terminal/server receives the resource.
  • step 511 the process of verifying the temporary access token in step 511 is the process of obtaining a temporary access token, which may not be executed, that is, may not be obtained Temporary access token.
  • Figure 6 is a schematic diagram of an access verification device provided in the embodiment of the present application, as shown in Figure 6, including:
  • the transceiver module 601 is configured to receive the resource acquisition request sent by the access user to the open server, so as to extract the contained access token and user information of the access user from the resource acquisition request; wherein, the access token includes Card verification value and token identification; The token verification value is generated according to the token certificate;
  • the processing module 602 is configured to obtain the salt value corresponding to the salt value number in the token ID from the salt value record after determining that the access token is valid according to the token expiration time in the token ID;
  • the salt value record is stored in the memory of the authentication server;
  • the processing module 602 is further configured to generate a comparison check value according to the user information, the salt value, the salt value number and the token expiration time;
  • the processing module 602 is further configured to, after determining that the token verification value matches the comparison verification value, generate a resource authorization response and return it to the open server through the transceiver module 601 .
  • the transceiving module 601 is further configured to receive a token acquisition request sent by the open server, and the token acquisition request includes user information of the accessing user; the processing module 602 is also configured to: The token acquisition request determines a token ID; the token ID includes a token expiration time and a salt value number determined from the salt value record; the processing module 602 is further configured to, based on the user information, The salt value corresponding to the salt value number and the token identifier generate a token credential; the transceiver module 601 is also configured to send a token generation response carrying an access token to the open server; the An access token includes the token identifier and the token credential.
  • the processing module 602 is specifically configured to generate a token credential based on the user information, the salt value corresponding to the salt value number, the field value in the extension field, and the token identifier;
  • the processing module 602 is specifically configured to generate a comparison check value according to the user information, the salt value, the salt value number, the token expiration time, and the field value in the extension field.
  • the token verification value is generated according to the token credential, including:
  • the token verification value is the token certificate; or the token verification value is obtained by signing the token certificate and each request parameter; wherein, the resource acquisition request also includes each request parameters.
  • the processing module 602 is further configured to store the access token in a token database; the processing module 602 is further configured to fail to obtain the token identifier corresponding to the token from the token database. access token.
  • the processing module 602 is further configured to obtain an access token corresponding to the token identifier from the token database; Whether the access token matches, so as to determine whether to generate a resource authorization response back to the open server.
  • the processing module 602 is further configured to configure the salt value record by adopting a grayscale release mechanism, and the grayscale release mechanism is used to send The salt value in the salt value record is set to be used in the token verification phase, and when each authentication server has configured the salt value record, the salt value in the salt value record is set to be used for the token Generation phase and token validation phase.
  • the transceiver module 601 is further configured to receive a token validity time change configuration; the token validity time indicated in the token validity time change configuration has a higher priority than the token expiration time in the access token .
  • the processing module 602 is further configured to, based on the token validity time change configuration, determine the token expiration time in the invalid state in the token identification as valid, or based on the token validity time change configuration, set the token identification The token expiration time in the valid state is determined to be invalid.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Abstract

本申请实施例提供一种访问验证方法及装置，该方法包括：鉴权服务端接收访问用户针对开放服务端发送的资源获取请求，以从资源获取请求中提取出包含的访问令牌和访问用户的用户信息；其中，访问令牌包括令牌校验值和令牌标识；令牌校验值是根据令牌凭证生成的；鉴权服务端根据令牌标识中的令牌失效时间确定所述访问令牌有效后，从盐值记录中获取令牌标识中的盐值编号对应的盐值；盐值记录存储在鉴权服务端内存中；鉴权服务端根据所述用户信息、盐值、盐值编号和令牌失效时间生成比较校验值；鉴权服务端在确定令牌校验值与比较校验值相符后，生成资源授权响应返回至开放服务端。上述方法用于提高鉴权系统运行可靠性。

Description

一种访问验证方法及装置
相关申请的交叉引用
本申请要求在2021年11月26日提交中国专利局、申请号为202111419243.5、申请名称为“一种访问验证方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络技术领域，尤其涉及一种访问验证方法及装置。
背景技术
近年来，随着计算机技术的发展，越来越多的技术应用在金融领域，传统金融业正在逐步向金融科技(Fintech)转变，但由于金融行业的安全性、实时性要求，也对技术提出更高的要求。如，OAuth(Open Authorization，开放授权)协议是一个开放标准，允许第三方应用依据用户凭证(token，访问令牌)访问该用户在某一网站上存储的私密的资源(例如，照片、视频、联系人列表等)的一种授权协议。OAuth协议的基本原理：用户授权一个第三方应用后，待访问资源所在网站对应的鉴权服务端会颁发一个token(访问令牌)，鉴权服务端将该token存储在数据库，并交给第三方应用保存。授权完成后，第三方应用使用该token来获取该待访问资源。如此，通过将token存储在数据库中，使得鉴权服务端可以对资源获取请求进行校验，保证了资源访问流程的安全性。
但也因此，现有技术中鉴权服务端需要将token存储在数据库，以便后续接收第三方应用发送的资源获取请求时，鉴权服务端可以从数据库中获取存储的token，以对第三方应用返回的token进行验证，以确定第三方应用的合法性。而该方法中，若存储数据库发生故障，则会导致鉴权服务端无法从数据库中获取token进行鉴权，鉴权系统稳定性差。
因此，现在亟需一种访问验证方法及装置，用于提高鉴权系统运行可靠性。
发明内容
本申请实施例提供一种访问验证方法及装置，用于提高鉴权系统运行可靠性。
第一方面，本申请实施例提供一种访问验证方法，该方法包括：
鉴权服务端接收访问用户针对开放服务端发送的资源获取请求，以从所述资源获取请求中提取出包含的访问令牌和访问用户的用户信息；其中，所 述访问令牌包括令牌校验值和令牌标识；所述令牌校验值是根据令牌凭证生成的；
所述鉴权服务端根据所述令牌标识中的令牌失效时间确定所述访问令牌有效后，从盐值记录中获取所述令牌标识中的盐值编号对应的盐值；所述盐值记录存储在所述鉴权服务端内存中；
所述鉴权服务端根据所述用户信息、所述盐值、所述盐值编号和所述令牌失效时间生成比较校验值；
所述鉴权服务端在确定所述令牌校验值与所述比较校验值相符后，生成资源授权响应返回至所述开放服务端。
上述方法中，访问令牌由令牌标识和令牌校验值组成，令牌校验值是根据令牌凭证生成的。如此，传输中的访问令牌中的令牌凭证以令牌校验值的形式传输，使得令牌凭证在传输过程中不是明文，即使被获取，也不能得到该令牌凭证的任何信息，提高信息传输的安全性。资源获取请求中包含访问令牌和访问用户的用户信息，则鉴权服务端在接收资源获取请求时，可以根据资源获取请求中的令牌标识获取盐值编号(令牌凭证中的盐值的盐值编号)和令牌失效时间。根据令牌标识中的令牌失效时间确定访问令牌未失效后，进一步，根据该用户信息和令牌标识的盐值编号从盐值记录中获取盐值生成比较校验值，以对资源获取请求中的令牌校验值进行验证。如此，鉴权服务端无需将令牌校验值存储在数据库即可实现鉴权，即，即使数据库故障，鉴权服务端获取不到令牌校验值，也可以根据资源获取请求中的信息生成比较校验值对令牌校验值进行校验。相比于现有技术中必须将令牌存储在数据库中来说，本申请解决了数据库出现故障时，所导致的鉴权服务端无法从数据库中获取令牌校验值而导致的无法鉴权的问题，提高了鉴权系统运行可靠性。
可选的，鉴权服务端接收访问用户针对开放服务端发送的资源获取请求之前，还包括：
所述鉴权服务端接收所述开放服务端发送的令牌获取请求，所述令牌获取请求中包含访问用户的用户信息；
所述鉴权服务端为所述令牌获取请求确定令牌标识；所述令牌标识包括令牌失效时间、从所述盐值记录中确定的盐值编号；
所述鉴权服务端基于所述用户信息、所述盐值编号对应的盐值及所述令牌标识生成令牌凭证；
所述鉴权服务端将携带有访问令牌的令牌生成响应发送至所述开放服务端；所述访问令牌包括所述令牌标识及所述令牌凭证。
上述方法中，鉴权服务端接收开放服务端发送的包含访问用户的用户信息的令牌获取请求后，为该令牌获取请求确定包含令牌失效时间、盐值编号和盐值等信息的令牌标识和令牌凭证，进一步，根据令牌凭证获取令牌校验值，将包含令牌校验值和令牌标识的令牌生成响应返回至开放服务端。如此，即使数据库发生故障，鉴权服务端无法从数据库获取令牌校验值，也可以根据资源获取请求中的信息和内存中的盐值记录获取比较校验值，根据比较校验值对资源获取请求的令牌校验值进行校验。
可选的，所述令牌标识中还包括扩展字段；所述鉴权服务端基于所述用户信息、所述盐值编号对应的盐值及所述令牌标识生成令牌凭证，包括：
所述鉴权服务端基于所述用户信息、所述盐值编号对应的盐值、所述扩展字段中的字段值及所述令牌标识生成令牌凭证；
所述鉴权服务端根据所述用户信息、所述盐值、所述盐值编号和所述令牌失效时间生成比较校验值，包括：
所述鉴权服务端根据所述用户信息、所述盐值、所述盐值编号、所述令牌失效时间和所述扩展字段中的字段值生成比较校验值。
上述方法中，令牌标识和令牌凭证中还可以包含扩展字段。如此，可以在扩展字段中设置更多的信息，则可以根据扩展字段中的相应信息进行相应的校验。如，在扩展字段中设置生成访问令牌的鉴权服务端的标识和访问令牌类型等信息，则在鉴权服务端接收令牌标识后，可以根据令牌标识扩展字段中的鉴权服务端标识校验该访问令牌是否是该鉴权服务端生成的，可以根据扩展字段中访问令牌类型信息，校验鉴权服务端是否用于鉴权这类访问令牌等，这里对扩展字段中的信息具体不做限制，可以根据需要的信息设置。
可选的，所述令牌校验值是根据令牌凭证生成的，包括：
所述令牌校验值是所述令牌凭证；或所述令牌校验值是通过对所述令牌凭证和各请求参数进行签名得到的；其中，所述资源获取请求中还包含各请求参数。
上述方法中，根据令牌凭证和资源获取请求的请求参数进行签名得到令牌校验值。如此，可以使得传输中的令牌凭证不是“暴露”状态，提高令牌凭证中信息的安全性，保证资源获取的安全性。
可选的，生成令牌凭证之后，还包括：
所述鉴权服务端将所述访问令牌存储至令牌数据库；
从盐值记录中获取所述令牌标识中的盐值编号对应的盐值之前，还包括：
所述鉴权服务端未能从所述令牌数据库获取所述令牌标识对应的访问令牌。
上述方法中，鉴权服务端从数据库获取访问令牌失败，则根据比较校验值对资源获取请求中的令牌校验值进行校验，确定资源获取请求的合法性。如此，可以将鉴权服务端根据资源获取请求中的信息生成比较校验值的方案作为从数据库访问令牌中获取令牌校验值方案的降级方案。则即使数据库故障，也可以正常进行鉴权，保证鉴权系统的可靠性。
可选的，还包括：
所述鉴权服务端从所述令牌数据库获取所述令牌标识对应的访问令牌；
所述鉴权服务端确定所述资源获取请求中的访问令牌与从所述令牌数据库获取的访问令牌是否相符，从而确定是否生成资源授权响应返回至所述开放服务端。
上述方法中，鉴权服务端从数据库获取访问令牌失败，则根据比较校验值对资源获取请求中的令牌校验值进行校验，确定资源获取请求的合法性。但若从数据库中获取访问令牌(访问令牌中包含在接收令牌获取请求时生成 的令牌校验值)获取成功，直接将从数据库获取的访问令牌中得到的令牌校验值与资源获取请求中的令牌校验值进行验证，还可以从数据库的访问令牌中确定该资源获取请求中的令牌校验值是否是一次性的，以及是否使用过，若使用过，则不对资源获取请求处理，若未使用过且校验通过，则将请求的资源返回至访问用户终端。如此，可以将鉴权服务端根据资源获取请求中的信息生成比较校验值的方案作为从数据库访问令牌中获取令牌校验值方案的降级方案，在保证鉴权系统的可靠性的前提下，在数据库正常运行时，还可以保证准确获取令牌校验值的使用信息，进一步保证令牌使用的准确性。
可选的，还包括：
所述鉴权服务端采用灰度发布机制配置所述盐值记录，所述灰度发布机制用于在任一鉴权服务端未配置完所述盐值记录时，将所述盐值记录中的盐值设置为用于令牌验证阶段，在各鉴权服务端均配置完所述盐值记录时，将所述盐值记录中的盐值设置为用于令牌生成阶段和令牌验证阶段。
上述方法中，盐值记录的灰度发布，灰度发布机制在任一鉴权服务端未配置完所述盐值记录时，将盐值记录中的盐值设置为用于令牌验证阶段。如此，防止发生未配置完的鉴权服务端将该新配置的盐值记录用于令牌验证，导致不能获取新的盐值，无法完成验证的情况。灰度发布机制在各鉴权服务端均配置完盐值记录时，将盐值记录中的盐值设置为用于令牌生成阶段和令牌验证阶段。如此，在各鉴权服务端均配置完盐值记录后，则完成盐值记录的配置和更新，任一鉴权服务端都可以根据新的盐值记录进行令牌生成和令牌验证。如此，根据需要更新盐值，保证访问令牌的安全有效性。
可选的，还包括：
所述鉴权服务端接收令牌有效时间变更配置；所述令牌有效时间变更配置中指示的令牌有效时间的优先级高于访问令牌中的令牌失效时间。
所述鉴权服务端基于所述令牌有效时间变更配置，将令牌标识中失效状态的令牌失效时间确定为有效，或基于所述令牌有效时间变更配置，将令牌标识中有效状态的令牌失效时间确定为失效。
上述方法中，访问令牌中的令牌有效时间可以通过令牌有效时间变更配置进行变更。提高令牌失效时间和有效时间变更的灵活性，如此，即使将令牌失效时间信息写在访问令牌中，仍然可以根据令牌有效时间变更配置灵活改变访问令牌的有效时间和失效时间等信息。
第二方面，本申请实施例提供一种访问验证装置，该装置包括：
收发模块，用于接收访问用户针对开放服务端发送的资源获取请求，以从所述资源获取请求中提取出包含的访问令牌和访问用户的用户信息；其中，所述访问令牌包括令牌校验值和令牌标识；所述令牌校验值是根据令牌凭证生成的；
处理模块，用于根据所述令牌标识中的令牌失效时间确定所述访问令牌有效后，从盐值记录中获取所述令牌标识中的盐值编号对应的盐值；所述盐值记录存储在所述鉴权服务端内存中；
所述处理模块还用于，根据所述用户信息、所述盐值、所述盐值编号和 所述令牌失效时间生成比较校验值；
所述处理模块还用于，在确定所述令牌校验值与所述比较校验值相符后，生成资源授权响应通过所述收发模块返回至所述开放服务端。
第三方面，本申请实施例还提供一种计算设备，包括：存储器，用于存储程序；处理器，用于调用所述存储器中存储的程序，按照获得的程序执行如第一方面的各种可能的设计中所述的方法。
第四方面，本申请实施例还提供一种计算机可读非易失性存储介质，包括计算机可读程序，当计算机读取并执行所述计算机可读程序时，使得计算机执行如第一方面的各种可能的设计中所述的方法。
本申请的这些实现方式或其他实现方式在以下实施例的描述中会更加简明易懂。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种访问验证的架构示意图；
图2为本申请实施例提供的一种访问验证方法的流程示意图；
图3为本申请实施例提供的一种访问验证方法的流程示意图；
图4为本申请实施例提供的一种访问验证方法的流程示意图；
图5为本申请实施例提供的一种访问验证方法的流程示意图；
图6为本申请实施例提供的一种访问验证装置示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本申请保护的范围。
图1为本申请实施例提供的一种访问验证的系统架构示意图，其中，资源请求方可以是访问用户终端，也可以是第三方平台等任何可以发起资源获取的请求方，这里具体不做限定。另外，若资源请求方是访问用户终端，则下面所述的用户信息可以是用户账号和用户密码等信息，若资源请求方是第三方平台、应用软件等，用户信息也可以是第三方平台、应用软件的标识等信息，这里具体不做限制。以下示例中以资源请求方是访问用户终端，用户信息为用户账号和用户密码等信息为例：
资源请求方生成授权地址请求发送至业务系统。业务系统通过开放服务 接收该授权地址请求后，返回授权地址至资源请求方。资源请求方接收授权地址后，根据用户输入用户信息(为注册过的用户账号和密码等包含访问用户的授权信息的用户信息)生成令牌获取请求并发送至业务系统。业务系统中的开放服务接收该令牌获取请求，将访问用户的用户信息发送至用户中心。用户中心接收该访问用户的用户信息，根据记录的该访问用户的用户信息对令牌获取请求中的用户信息进行验证，验证通过后，将验证通过结果发送至开放服务。开放服务确定该令牌获取请求的访问用户合法后，开放服务生成确定令牌通知发送至鉴权中心，令鉴权中心为该令牌获取请求生成访问令牌，该确定令牌通知中包含令牌获取请求中的用户信息。鉴权中心接收该确定令牌通知后，为令牌获取请求生成包含令牌失效时间、从盐值记录中确定出的盐值对应的盐值编号等信息的令牌标识，根据用户信息、盐值编号、盐值编号对应的盐值及令牌标识生成令牌凭证，得到包含令牌标识和令牌凭证的访问令牌，将携带该访问令牌的令牌生成响应发送至所述开放服务。开放服务接收该令牌生成响应后，将该令牌生成响应返回至资源请求方。资源请求方接收到令牌生成响应后，获取令牌生成响应中的访问令牌，根据该访问令牌生成资源获取请求，这里生成的资源获取请求可以由两种：
一种为：资源获取请求中包含用户信息、令牌凭证、令牌标识等相关信息；
另一种为：资源获取请求中包含用户信息、签名(令牌凭证和各请求参数进行签名得到的)、令牌标识和各请求参数等信息。
则对应的，若业务系统中的开放服务接收包含用户信息、令牌校验值(令牌凭证)、令牌标识等相关信息的资源获取请求时，通过鉴权中心对该资源获取请求的合法性进行验证。鉴权中心根据该资源获取请求中的令牌标识中的令牌失效时间，确定该访问令牌有效后(若确定该访问令牌无效，则开放服务不对该资源获取请求进行响应)，根据用户信息和/或令牌标识从数据库中获取令牌校验值，若获取成功，则比较资源获取请求中的令牌校验值和从数据库中获取的令牌校验值，若验证通过(若验证不通过，则开放服务不对该资源获取请求进行响应)，则鉴权中心将验证通过通知发送至开放服务。开放服务根据验证通过通知将资源返回至资源请求方。若根据用户信息和/或令牌标识从数据库中获取令牌校验值失败，则鉴权中心根据令牌标识中的盐值编号从盐值记录中确定盐值编号对应的盐值，进一步，根据盐值编号、盐值编号对应的盐值、用户信息和令牌失效时间等信息生成令牌凭证，根据令牌凭证得到比较检验值。鉴权中心将资源获取请求中的令牌校验值和比较校验值进行比较，若验证通过(若验证不通过，则开放服务不对该资源获取请求进行响应)，则鉴权中心将验证通过通知发送至开放服务。开放服务根据验证通过通知将资源返回至资源请求方。
若业务系统中的开放服务接收包含用户信息、签名-令牌校验值(令牌凭证和各请求参数进行签名得到的)、令牌标识和各请求参数等信息的资源获取请求时，通过鉴权中心对该资源获取请求的合法性进行验证。鉴权中心根据该资源获取请求中令牌标识中的令牌失效时间，确定该访问令牌有效后(若 确定该访问令牌无效，则开放服务不对该资源获取请求进行响应)，根据用户信息和/或令牌标识从数据库中获取令牌校验值，若获取成功，则比较资源获取请求中的令牌校验值和从数据库中获取的令牌校验值，若验证通过(若验证不通过，则开放服务不对该资源获取请求进行响应)，则鉴权中心将验证通过通知发送至开放服务。开放服务根据验证通过通知将资源返回至资源请求方。若根据用户信息和/或令牌标识从数据库中获取令牌校验值失败，则鉴权中心根据令牌标识中的盐值编号从盐值记录中确定盐值编号对应的盐值，进一步，根据盐值编号、盐值编号对应的盐值、用户信息和令牌失效时间等信息生成令牌凭证，再进一步将令牌凭证和资源获取请求中的各请求参数进行签名，获取比较检验值。鉴权中心将资源获取请求中的签名-令牌校验值和比较校验值进行比较，若验证通过(若验证不通过，则开放服务不对该资源获取请求进行响应)，则鉴权中心将验证通过通知发送至开放服务。开放服务根据验证通过通知将资源返回至资源请求方。如此，将现有技术中的令牌设置为包含盐值、盐值编号、用户信息、令牌失效时间等相关信息的访问令牌，即使数据库发生故障，鉴权中心也可以根据资源获取请求中的相关信息对资源获取请求中的访问令牌进行鉴权，保证了鉴权系统的稳定性和可靠性。
基于此，本申请实施例提供了一种访问验证方法的流程，如图2所示，包括：
步骤201、鉴权服务端接收访问用户针对开放服务端发送的资源获取请求，以从所述资源获取请求中提取出包含的访问令牌和访问用户的用户信息；其中，所述访问令牌包括令牌校验值和令牌标识；所述令牌校验值是根据令牌凭证生成的；
此处，用户信息可以是用户账号和用户密码等信息，也可以是第三方平台的标识等信息，这里具体不做限制。
步骤202、所述鉴权服务端根据所述令牌标识中的令牌失效时间确定所述访问令牌有效后，从盐值记录中获取所述令牌标识中的盐值编号对应的盐值；所述盐值记录存储在所述鉴权服务端内存中；
步骤203、所述鉴权服务端根据所述用户信息、所述盐值、所述盐值编号和所述令牌失效时间生成比较校验值；
步骤204、所述鉴权服务端在确定所述令牌校验值与所述比较校验值相符后，生成资源授权响应返回至所述开放服务端。
上述方法中，访问令牌由令牌标识和令牌校验值组成，令牌校验值是根据令牌凭证生成的。如此，传输中的访问令牌中的令牌凭证以令牌校验值的形式传输，使得令牌凭证在传输过程中不是明文，即使被获取，也不能得到该令牌凭证的任何信息，提高信息传输的安全性。资源获取请求中包含访问令牌和访问用户的用户信息，则鉴权服务端在接收资源获取请求时，可以根据资源获取请求中的令牌标识获取盐值编号(令牌凭证中的盐值的盐值编号)和令牌失效时间。根据令牌标识中的令牌失效时间确定访问令牌未失效后，进一步根据该用户信息和令牌标识的盐值编号从盐值记录中获取盐值生成比较校验值对资源获取请求中的令牌校验值进行验证。如此，鉴权服务端无需 将令牌校验值存储在数据库即可实现鉴权，即，即使数据库故障，鉴权服务端获取不到令牌校验值，也可以根据资源获取请求中的信息生成比较校验值对令牌校验值进行校验。相比于现有技术中必须将令牌存储在数据库中来说，本申请解决了数据库出现故障时，所导致的鉴权服务端无法从数据库中获取令牌校验值进而导致的无法鉴权的问题，提高了鉴权系统运行可靠性。
本申请实施例提供了一种访问令牌生成方法，鉴权服务端接收访问用户针对开放服务端发送的资源获取请求之前，还包括：所述鉴权服务端接收所述开放服务端发送的令牌获取请求，所述令牌获取请求中包含访问用户的用户信息；所述鉴权服务端为所述令牌获取请求确定令牌标识；所述令牌标识包括令牌失效时间、从所述盐值记录中确定的盐值编号；所述鉴权服务端基于所述用户信息、所述盐值编号对应的盐值及所述令牌标识生成令牌凭证；所述鉴权服务端将携带有访问令牌的令牌生成响应发送至所述开放服务端；所述访问令牌包括所述令牌标识及所述令牌凭证。
也就是说，当资源请求方将令牌获取请求发送至开放服务端后，开放服务端将令牌获取请求发送至鉴权服务端，鉴权服务端根据令牌获取请求中的用户信息、令牌有效时间(可以根据请求资源的类型或令牌类型等确定)和从盐值记录中确定的盐值和盐值编号等信息生成令牌凭证，根据盐值编号、令牌失效时间确定令牌标识。进一步生成包含令牌标识和令牌凭证的访问令牌。
本申请实施例提供了又一种访问令牌，所述令牌标识中还包括扩展字段；所述鉴权服务端基于所述用户信息、所述盐值编号对应的盐值及所述令牌标识生成令牌凭证，包括：所述鉴权服务端基于所述用户信息、所述盐值编号对应的盐值、所述扩展字段中的字段值及所述令牌标识生成令牌凭证；所述鉴权服务端根据所述用户信息、所述盐值、所述盐值编号和所述令牌失效时间生成比较校验值，包括：所述鉴权服务端根据所述用户信息、所述盐值、所述盐值编号、所述令牌失效时间和所述扩展字段中的字段值生成比较校验值。也就是说，令牌标识和令牌凭证中还可以包括扩展字段。即，令牌标识中则包含盐值编号、令牌失效时间和扩展字段，令牌凭证中包含盐值编号、令牌失效时间和扩展字段，以及盐值编号对应的盐值和用户信息。相应的，鉴权服务端在生成比较校验值时，也需要生成对应的包含盐值编号、令牌失效时间和扩展字段，以及盐值编号对应的盐值和用户信息的比较校验值。其中，扩展字段中的字段值可以包含鉴权服务端的标识、令牌类型等相关信息。如此，增加访问令牌中的有意义的信息，便于鉴权服务端获取更多的相关信息，如，进行资源访问等流程中的问题排查，提高访问令牌的应用性。
在一种示例中，令牌凭证大小可以为32个字节：其中的令牌失效时间可以占用8个字节、盐值的编号可以占用2个字节、扩展字段中的各字段值可以占用6个字节、用户信息和盐值编号可以占用16个字节。令牌标识大小可以为16个字节：其中的令牌失效时间可以占用8个字节、盐值的编号可以占用2个字节、扩展字段中的各字段值可以占用6个字节。另外，令牌失效时间可以是由鉴权服务端根据访问令牌的有效期加上当前时间生成，如，从1900-01-01 00:00:00至今秒数，转换成16进制(8字节)。盐值记录中的盐值编号：按16进制，2字节的编码可以容纳256个编码。
本申请实施例提供了一种令牌校验值的生成方法，所述令牌校验值是根据令牌凭证生成的，包括：所述令牌校验值是所述令牌凭证；或所述令牌校验值是通过对所述令牌凭证和各请求参数进行签名得到的；其中，所述资源获取请求中还包含各请求参数。也就是说，令牌校验值可以是令牌凭证，还可以是根据令牌凭证和资源获取请求中的各请求参数进行签名获取的。这里提供一种令牌校验值可以是通过哈希算法对盐值编号对应的盐值、用户信息、盐值编号、令牌失效时间进行计算得到的。也可以是通过哈希算法对盐值编号对应的盐值、用户信息、盐值编号、令牌失效时间、扩展字段进行计算得到的。也可以是通过哈希算法对盐值编号对应的盐值、用户信息、盐值编号、令牌失效时间，或盐值编号对应的盐值、用户信息、盐值编号、令牌失效时间、扩展字段进行计算后，和资源获取请求中各请求参数进行签名得到的。
本申请实施例提供了一种访问验证方法，生成令牌凭证之后，还包括：
所述鉴权服务端将所述访问令牌存储至令牌数据库；
从盐值记录中获取所述令牌标识中的盐值编号对应的盐值之前，还包括：
所述鉴权服务端未能从所述令牌数据库获取所述令牌标识对应的访问令牌。也就是说，鉴权服务端生成访问令牌后，还可以将该访问令牌存储在数据库，并在鉴权过程中，先从数据库中获取令牌标识对应的访问令牌，若获取不到，则生成比较校验值。
本申请实施例提供了一种访问验证方法，还包括：
所述鉴权服务端从所述令牌数据库获取所述令牌标识对应的访问令牌；
所述鉴权服务端确定所述资源获取请求中的访问令牌与从所述令牌数据库获取的访问令牌是否相符，从而确定是否生成资源授权响应返回至所述开放服务端。也就是说，若鉴权过程中，从数据库中可以获取访问令牌，则无需鉴权服务端生成比较校验值，可以根据从数据库获取的访问令牌和资源获取请求中的访问令牌进行验证。
本申请实施例提供了一种盐值记录灰度发布方法，还包括：所述鉴权服务端采用灰度发布机制配置所述盐值记录，所述灰度发布机制用于在任一鉴权服务端未配置完所述盐值记录时，将所述盐值记录中的盐值设置为用于令牌验证阶段，在各鉴权服务端均配置完所述盐值记录时，将所述盐值记录中的盐值设置为用于令牌生成阶段和令牌验证阶段。也就是说，鉴权服务端中的盐值记录均相同，在对鉴权服务端逐个进行盐值记录配置更新时，存在任一鉴权服务端未配置完盐值记录，则该新的盐值记录不可以用于令牌验证阶段。全量配置完成后，则将更新的盐值记录用于令牌生成阶段和验证阶段。如此，有效防止鉴权服务端以旧的盐值记录验证令牌所导致的令牌验证错误，不能可靠准确的完成鉴权流程。盐值记录中可以包含多个盐值，保证访问令牌的多样性，提高访问流程的安全性，预留其它盐值可供替换。这里在访问令牌生成的实现过程中，可按需求自定义选择对应盐值。
本申请实施例提供了一种令牌有效时间变更方法，还包括：
所述鉴权服务端接收令牌有效时间变更配置；所述令牌有效时间变更配置中指示的令牌有效时间的优先级高于访问令牌中的令牌失效时间。所述鉴权服务端基于所述令牌有效时间变更配置，将令牌标识中失效状态的令牌失效时间确定为有效，或基于所述令牌有效时间变更配置，将令牌标识中有效状态的令牌失效时间确定为失效。也就是说，访问令牌中的令牌失效时间不受临时变更控制，则可以在鉴权服务端中设置令牌有效时间变更配置，令其中的令牌有效时间的优先级高于访问令牌中的令牌失效时间，则可以实现变更访问令牌中的令牌有效时间。如，可以针对某些盐值/用户信息置令牌有效时间大于令牌失效时间2时，或者针对某些盐值/用户信息设置令牌有效时间小于令牌失效时间2时等等，还可以针对所有访问令牌的令牌失效时间进行全局变更配置。这里对令牌有效时间变更配置的具体设置不做限制，可以根据需要确定。
基于上述方法流程，本申请实施例提供了一种访问验证方法流程，如图3所示，包括：
步骤301、资源请求终端/服务端生成授权地址请求发送至开放服务端。
步骤302、开放服务端接收到授权地址请求后将授权地址返回至资源请求终端/服务端。
步骤303、资源请求终端/服务端根据用户输入的用户账号和密码生成第一令牌获取请求，并发送至开放服务端。
步骤304、开放服务端接收第一令牌获取请求，将第一令牌获取请求中的用户信息发送至用户中心服务端。
步骤305、用户中心服务端根据记录的用户信息对该第一令牌获取请求中的用户信息进行验证，若验证失败，则通知开放服务端不对该第一令牌获取请求做出相应，若验证通过则返回验证通过消息至开放服务端。
步骤306、开放服务端根据接收的验证通过消息将第一令牌获取请求中的相关信息发送至鉴权服务端。
此处，第一令牌获取请求中的相关信息包括用户信息。
步骤307、鉴权服务端根据第一令牌获取请求中的相关信息生成临时访问令牌，并将临时访问令牌返回至开放服务端(临时访问令牌可以包含在临时令牌生成响应中返回至开放服务端)。
此处，临时访问令牌的结构可以为包含临时令牌标识和临时令牌凭证，临时令牌凭证大小可以为32个字节：其中的令牌失效时间可以占用8个字节、盐值的编号可以占用2个字节、扩展字段中的各字段值可以占用6个字节、用户信息和盐值编号可以占用16个字节。临时令牌标识大小可以为16个字节：其中的令牌失效时间可以占用8个字节、盐值的编号可以占用2个字节、扩展字段中的各字段值可以占用6个字节。其中，32个字节的令牌凭证为哈希计算过的。
步骤308、开放服务端将该临时访问令牌发送至资源请求终端/服务端。
步骤309、资源请求终端/服务端根据该临时访问令牌生成第二令牌获取请求。资源请求终端/服务端将第二令牌获取请求发送至开放服务端。
此处，一种第二令牌获取请求中包括：该临时访问令牌(临时令牌凭证+临时令牌标识)(用于验证身份的)、申请资源访问令牌(用于获取资源的)的信息、用户信息和各请求参数等信息。临时令牌凭证的令牌校验值。
另一种第二令牌获取请求中包括：临时令牌标识、签名(根据令牌凭证+各请求参数生成的)(用于验证身份的)、申请资源访问令牌(用于获取资源的)的信息、用户信息和各请求参数等信息。签名为令牌校验值。
步骤310、开放服务端将第二令牌获取请求的相关信息发送至鉴权服务端。
步骤311、鉴权服务端根据第二令牌获取请求中的相关信息生成临时比较校验值，并根据临时比较校验值对临时访问令牌进行验证，若验证通过，则生成资源访问令牌，将资源访问令牌返回至开放服务端。
此处，生成临时比较校验值的方法可以为：针对上述一种第二令牌获取请求，根据临时访问令牌中的临时令牌标识中的令牌失效时间确定临时访问令牌仍然有效后，根据临时令牌标识中的盐值编号从盐值记录中确定盐值编号对应的盐值，进一步，根据盐值、盐值编号、第二令牌获取请求中的用户信息、令牌有效时间生成临时比较校验值。
针对上述另一种第二令牌获取请求，根据临时令牌标识中的令牌失效时间确定临时访问令牌仍然有效后，根据临时令牌标识中的盐值编号从盐值记录中确定盐值编号对应的盐值，进一步，根据盐值、盐值编号、第二令牌获取请求中的用户信息、令牌有效时间生成临时令牌凭证，将临时令牌凭证和第二令牌获取请求中的各请求参数进行签名得到临时比较校验值。
资源访问令牌的结构可以为包含资源令牌标识和资源令牌凭证，资源令牌凭证大小可以为32个字节：其中的令牌失效时间可以占用8个字节、盐值的编号可以占用2个字节、扩展字段中的各字段值可以占用6个字节、用户信息和盐值编号可以占用16个字节。资源令牌标识大小可以为16个字节：其中的令牌失效时间可以占用8个字节、盐值的编号可以占用2个字节、扩展字段中的各字段值可以占用6个字节。其中，32个字节的令牌凭证为哈希计算过的。
步骤312、开放服务端将资源访问令牌发送至资源请求终端/服务端。
步骤313、资源请求终端/服务端根据资源访问令牌生成资源获取请求，并发送至开放服务端。
此处，一种资源获取请求中包括：该资源访问令牌(资源令牌凭证+资源令牌标识)(用于验证身份的)、申请资源(用于获取资源的)的信息、用户信息和各请求参数等信息。资源令牌凭证的令牌校验值。
另一种资源获取请求中包括：资源令牌标识、签名(根据令牌凭证+各请求参数生成的)(用于验证身份的)、申请资源(用于获取资源的)的信息、用户信息和各请求参数等信息。签名为令牌校验值。
步骤314、开放服务端将资源获取请求的相关信息发送至鉴权服务端。
步骤315、鉴权服务端根据资源获取请求的相关信息生成资源比较校验值。并根据资源比较校验值对资源访问令牌进行验证，若验证通过，则生成资源授权响应，将资源授权响应返回至开放服务端。
此处，生成资源比较校验值的方法可以为：针对上述一种资源获取请求， 根据资源访问令牌中的资源令牌标识中的令牌失效时间确定资源访问令牌仍然有效后，根据资源令牌标识中的盐值编号从盐值记录中确定盐值编号对应的盐值，进一步，根据盐值、盐值编号、资源获取请求中的用户信息、令牌有效时间生成资源比较校验值。
针对上述另一种资源获取请求，根据资源令牌标识中的令牌失效时间确定资源访问令牌仍然有效后，根据资源令牌标识中的盐值编号从盐值记录中确定盐值编号对应的盐值，进一步，根据盐值、盐值编号、资源获取请求中的用户信息、令牌有效时间生成资源令牌凭证，将资源令牌凭证和资源获取请求中的各请求参数进行签名得到资源比较校验值。
步骤316、开放服务端接收资源授权响应，将资源获取请求对应的资源返回至资源请求终端/服务端。
步骤317、资源请求终端/服务端接收该资源。
需要说明的是，上述流程步骤并不唯一，如步骤306至步骤309，以及步骤311中需要对临时访问令牌验证的流程为获取临时访问令牌的流程，可以不用执行，即，可以不获取临时访问令牌。
基于上述方法流程，本申请实施例提供了一种访问验证方法流程，如图4所示，包括：
步骤401、资源请求终端/服务端生成授权地址请求发送至开放服务端。
步骤402、开放服务端接收到授权地址请求后将授权地址返回至资源请求终端/服务端。
步骤403、资源请求终端/服务端根据用户输入的用户账号和密码生成第一令牌获取请求，并发送至开放服务端。
步骤404、开放服务端接收第一令牌获取请求，将第一令牌获取请求中的用户信息发送至用户中心服务端。
步骤405、用户中心服务端根据记录的用户信息对该第一令牌获取请求中的用户信息进行验证，若验证失败，则通知开放服务端不对该第一令牌获取请求做出相应，若验证通过则返回验证通过消息至开放服务端。
步骤406、开放服务端根据接收的验证通过消息将第一令牌获取请求中的相关信息发送至鉴权服务端。
步骤407、鉴权服务端根据第一令牌获取请求中的相关信息生成临时访问令牌，并将临时访问令牌返回至开放服务端，并将所述临时访问令牌发送至数据库。
步骤408、开放服务端将该临时访问令牌发送至资源请求终端/服务端。
步骤409、资源请求终端/服务端根据该临时访问令牌生成第二令牌获取请求。资源请求终端/服务端将第二令牌获取请求发送至开放服务端。
步骤410、开放服务端将第二令牌获取请求的相关信息发送至鉴权服务端。
步骤411、鉴权服务端从数据库中获取临时访问令牌失败，根据第二令牌获取请求中的相关信息生成临时比较校验值，并根据临时比较校验值对临时访问令牌进行验证，若验证通过，则生成资源访问令牌，将资源访问令牌返回至开放服务端。
步骤412、开放服务端将资源访问令牌发送至资源请求终端/服务端。
步骤413、资源请求终端/服务端根据资源访问令牌生成资源获取请求，并发送至开放服务端。
步骤414、开放服务端将资源获取请求的相关信息发送至鉴权服务端。
步骤415、鉴权服务端根据资源获取请求的相关信息生成资源比较校验值，并根据资源比较校验值对资源访问令牌进行验证，若验证通过，则生成资源授权响应，将资源授权响应返回至开放服务端。
步骤416、开放服务端接收资源授权响应，将资源获取请求对应的资源返回至资源请求终端/服务端。
步骤417、资源请求终端/服务端接收该资源。
需要说明的是，上述流程步骤并不唯一，如步骤406至步骤409，以及步骤411中需要对临时访问令牌验证的流程为获取临时访问令牌的流程，可以不用执行，即，可以不获取临时访问令牌。此流程中包含将访问令牌存储到数据库中的流程，若从数据库中无法获取访问令牌(数据库发生故障)，则鉴权服务端生成比较校验值，与请求中的令牌校验值进行校验。也就是说，生成比较校验值进行访问验证的方案为访问验证的降级方案。
基于此上述方法流程，本申请实施例还提供了另一种访问验证方法流程，该访问验证方法流程对应鉴权服务端从数据库中可以获取到访问令牌时的方法流程，如图5所示，包括：
步骤501、资源请求终端/服务端生成授权地址请求发送至开放服务端。
步骤502、开放服务端接收到授权地址请求后将授权地址返回至资源请求终端/服务端。
步骤503、资源请求终端/服务端根据用户输入的用户账号和密码生成第一令牌获取请求，并发送至开放服务端。
步骤504、开放服务端接收第一令牌获取请求，将第一令牌获取请求中的用户信息发送至用户中心服务端。
步骤505、用户中心服务端根据记录的用户信息对该第一令牌获取请求中的用户信息进行验证，若验证失败，则通知开放服务端不对该第一令牌获取请求做出相应。若验证通过则返回验证通过消息至开放服务端。
步骤506、开放服务端根据接收的验证通过消息将第一令牌获取请求中的相关信息发送至鉴权服务端。
步骤507、鉴权服务端根据第一令牌获取请求中的相关信息生成临时访问令牌，将临时访问令牌返回至开放服务端并存储到数据库中。
步骤508、开放服务端将该临时访问令牌发送至资源请求终端/服务端。
步骤509、资源请求终端/服务端根据该临时访问令牌生成第二令牌获取请求。资源请求终端/服务端将第二令牌获取请求发送至开放服务端。
步骤510、开放服务端将第二令牌获取请求的相关信息发送至鉴权服务端。
步骤511、鉴权服务端从数据库中获取临时访问令牌成功，将第二令牌获取请求中令牌校验值与从数据库中获取的临时访问令牌对应的令牌校验值进行验证，通过后，生成资源访问令牌并存入数据库，将资源访问令牌返回至 开放服务端。
步骤512、开放服务端将资源访问令牌发送至资源请求终端/服务端。
步骤513、资源请求终端/服务端根据资源访问令牌生成资源获取请求，并发送至开放服务端。
步骤514、开放服务端将资源获取请求的相关信息发送至鉴权服务端。
步骤515、鉴权服务端从数据库中获取资源访问令牌成功，将资源获取请求中令牌校验值与从数据库中获取的资源访问令牌对应的令牌校验值进行验证，若验证通过，则生成资源授权响应，将资源授权响应返回至开放服务端。
步骤516、开放服务端接收资源授权响应，将资源获取请求对应的资源返回至资源请求终端/服务端。
步骤517、资源请求终端/服务端接收该资源。
需要说明的是，上述流程步骤并不唯一，如步骤506至步骤509，以及步骤511中需要对临时访问令牌验证的流程为获取临时访问令牌的流程，可以不用执行，即，可以不获取临时访问令牌。
基于同样的构思，本申请实施例提供一种访问验证装置，图6为本申请实施例提供的一种访问验证装置示意图，如图6示，包括：
收发模块601，用于接收访问用户针对开放服务端发送的资源获取请求，以从所述资源获取请求中提取出包含的访问令牌和访问用户的用户信息；其中，所述访问令牌包括令牌校验值和令牌标识；所述令牌校验值是根据令牌凭证生成的；
处理模块602，用于根据所述令牌标识中的令牌失效时间确定所述访问令牌有效后，从盐值记录中获取所述令牌标识中的盐值编号对应的盐值；所述盐值记录存储在所述鉴权服务端内存中；
所述处理模块602还用于，根据所述用户信息、所述盐值、所述盐值编号和所述令牌失效时间生成比较校验值；
所述处理模块602还用于，在确定所述令牌校验值与所述比较校验值相符后，生成资源授权响应通过所述收发模块601返回至所述开放服务端。
可选的，所述收发模块601还用于，接收所述开放服务端发送的令牌获取请求，所述令牌获取请求中包含访问用户的用户信息；所述处理模块602还用于，为所述令牌获取请求确定令牌标识；所述令牌标识包括令牌失效时间、从所述盐值记录中确定的盐值编号；所述处理模块602还用于，基于所述用户信息、所述盐值编号对应的盐值及所述令牌标识生成令牌凭证；所述收发模块601还用于，将携带有访问令牌的令牌生成响应发送至所述开放服务端；所述访问令牌包括所述令牌标识及所述令牌凭证。
可选的，所述处理模块602具体用于，基于所述用户信息、所述盐值编号对应的盐值、所述扩展字段中的字段值及所述令牌标识生成令牌凭证；所述处理模块602具体用于，根据所述用户信息、所述盐值、所述盐值编号、所述令牌失效时间和所述扩展字段中的字段值生成比较校验值。
可选的，所述令牌校验值是根据令牌凭证生成的，包括：
所述令牌校验值是所述令牌凭证；或所述令牌校验值是通过对所述令牌 凭证和各请求参数进行签名得到的；其中，所述资源获取请求中还包含各请求参数。
可选的，所述处理模块602还用于，将所述访问令牌存储至令牌数据库；所述处理模块602还用于，未能从所述令牌数据库获取所述令牌标识对应的访问令牌。
可选的，所述处理模块602还用于，从所述令牌数据库获取所述令牌标识对应的访问令牌；确定所述资源获取请求中的访问令牌与从所述令牌数据库获取的访问令牌是否相符，从而确定是否生成资源授权响应返回至所述开放服务端。
可选的，所述处理模块602还用于，采用灰度发布机制配置所述盐值记录，所述灰度发布机制用于在任一鉴权服务端未配置完所述盐值记录时，将所述盐值记录中的盐值设置为用于令牌验证阶段，在各鉴权服务端均配置完所述盐值记录时，将所述盐值记录中的盐值设置为用于令牌生成阶段和令牌验证阶段。
可选的，所述收发模块601还用于，接收令牌有效时间变更配置；所述令牌有效时间变更配置中指示的令牌有效时间的优先级高于访问令牌中的令牌失效时间。所述处理模块602还用于，基于所述令牌有效时间变更配置，将令牌标识中失效状态的令牌失效时间确定为有效，或基于所述令牌有效时间变更配置，将令牌标识中有效状态的令牌失效时间确定为失效。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (10)

  1. 一种访问验证方法，其特征在于，所述的方法包括：
    鉴权服务端接收开放服务端发送的令牌获取请求，所述令牌获取请求中包含访问用户的第一用户信息；
    所述鉴权服务端为所述令牌获取请求确定第一令牌标识；所述第一令牌标识包括第一令牌失效时间、从盐值记录中确定的第一盐值编号；
    所述鉴权服务端基于所述第一用户信息、所述第一盐值编号对应的第一盐值及所述第一令牌标识生成第一令牌凭证；
    所述鉴权服务端将携带有第一访问令牌的令牌生成响应通过所述开发服务端发送至资源请求终端或资源请求服务端；所述第一访问令牌包括所述第一令牌标识及所述第一令牌凭证；
    所述鉴权服务端接收所述访问用户针对所述开放服务端发送的资源获取请求，以从所述资源获取请求中提取出包含的第二访问令牌和访问用户的第二用户信息；其中，所述第二访问令牌包括令牌校验值和第二令牌标识；所述令牌校验值是根据第二令牌凭证生成的；
    所述鉴权服务端根据所述第二令牌标识中的第二令牌失效时间确定所述第二访问令牌有效后，从所述盐值记录中获取所述第二令牌标识中的第二盐值编号对应的第二盐值；所述盐值记录存储在所述鉴权服务端内存中；
    所述鉴权服务端根据所述第二用户信息、所述第二盐值、所述第二盐值编号和所述第二令牌失效时间生成比较校验值；
    所述鉴权服务端在确定所述令牌校验值与所述比较校验值相符后，生成资源授权响应返回至所述开放服务端。
  2. 如权利要求1中所述的方法，其特征在于，所述第一令牌标识中还包括第一扩展字段，所述第二令牌标识中还包括第二扩展字段；所述鉴权服务端基于所述第一用户信息、所述第一盐值编号对应的第一盐值及所述第一令牌标识生成第一令牌凭证，包括：
    所述鉴权服务端基于所述第一用户信息、所述第一盐值编号对应的第一盐值、所述第一扩展字段中的字段值及所述第一令牌标识生成所述第一令牌凭证；
    所述鉴权服务端根据所述第二用户信息、所述第二盐值、所述第二盐值编号和所述第二令牌失效时间生成比较校验值，包括：
    所述鉴权服务端根据所述第二用户信息、所述第二盐值、所述第二盐值编号、所述第二令牌失效时间和所述第二扩展字段中的字段值生成所述比较校验值。
  3. 如权利要求1中所述的方法，其特征在于，所述令牌校验值是根据第二令牌凭证生成的，包括：
    所述令牌校验值是所述第二令牌凭证；或
    所述令牌校验值是通过对所述第二令牌凭证和各请求参数进行签名得到的；其中，所述资源获取请求中还包含各请求参数。
  4. 如权利要求1中所述的方法，其特征在于，生成第一令牌凭证之后，还包括：
    所述鉴权服务端将所述第一访问令牌存储至令牌数据库；
    从盐值记录中获取所述第二令牌标识中的第二盐值编号对应的第二盐值之前，还包括：
    所述鉴权服务端未能从所述令牌数据库获取所述第二令牌标识对应的第三访问令牌。
  5. 如权利要求4中所述的方法，其特征在于，还包括：
    所述鉴权服务端从所述令牌数据库获取所述第二令牌标识对应的第三访问令牌；
    所述鉴权服务端确定所述资源获取请求中的所述第二访问令牌与从所述令牌数据库获取的所述第三访问令牌是否相符，从而确定是否生成资源授权响应返回至所述开放服务端。
  6. 如权利要求1-5中任一所述的方法，其特征在于，还包括：
    所述鉴权服务端采用灰度发布机制配置所述盐值记录，所述灰度发布机制用于在任一鉴权服务端未配置完所述盐值记录时，将所述盐值记录中的盐值设置为用于令牌验证阶段，在各鉴权服务端均配置完所述盐值记录时，将所述盐值记录中的盐值设置为用于令牌生成阶段和令牌验证阶段。
  7. 如权利要求1-5中任一项所述的方法，其特征在于，还包括：
    所述鉴权服务端接收令牌有效时间变更配置；所述令牌有效时间变更配置中指示的令牌有效时间的优先级高于访问令牌中的令牌失效时间的优先级；
    所述鉴权服务端基于所述令牌有效时间变更配置，将令牌标识中失效状态的令牌失效时间确定为有效，或基于所述令牌有效时间变更配置，将令牌标识中有效状态的令牌失效时间确定为失效。
  8. 一种访问验证装置，其特征在于，所述的装置包括：
    收发模块，用于接收开放服务端发送的令牌获取请求，所述令牌获取请求中包含访问用户的第一用户信息；
    处理模块，用于为所述令牌获取请求确定第一令牌标识；所述第一令牌标识包括第一令牌失效时间、从盐值记录中确定的第一盐值编号；
    所述处理模块还用于，基于所述第一用户信息、所述第一盐值编号对应的第一盐值及所述第一令牌标识生成第一令牌凭证；
    所述收发模块还用于，将携带有第一访问令牌的令牌生成响应通过所述开发服务端发送至资源请求终端或资源请求服务端；所述第一访问令牌包括所述第一令牌标识及所述第一令牌凭证；
    所述收发模块还用于，接收所述访问用户针对所述开放服务端发送的资源获取请求，以从所述资源获取请求中提取出包含的第二访问令牌和访问用户的第二用户信息；其中，所述第二访问令牌包括令牌校验值和第二令牌标识；所述令牌校验值是根据第二令牌凭证生成的；
    所述处理模块还用于，根据所述第二令牌标识中的第二令牌失效时间确定所述第二访问令牌有效后，从所述盐值记录中获取所述第二令牌标识中的 第二盐值编号对应的第二盐值；所述盐值记录存储在鉴权服务端内存中；
    所述处理模块还用于，根据所述第二用户信息、所述第二盐值、所述第二盐值编号和所述第二令牌失效时间生成比较校验值；
    所述处理模块还用于，在确定所述令牌校验值与所述比较校验值相符后，生成资源授权响应通过所述收发模块返回至所述开放服务端。
  9. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有程序，当所述程序在计算机上运行时，使得计算机实现执行权利要求1至7中任一项所述的方法。
  10. 一种计算机设备，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于调用所述存储器中存储的计算机程序，按照获得的程序执行如权利要求1至7任一权利要求所述的方法。
PCT/CN2022/129954 2021-11-26 2022-11-04 一种访问验证方法及装置 WO2023093500A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111419243.5A CN114117551B (zh) 2021-11-26 2021-11-26 一种访问验证方法及装置
CN202111419243.5 2021-11-26

Publications (1)

Publication Number Publication Date
WO2023093500A1 true WO2023093500A1 (zh) 2023-06-01

Family

ID=80369687

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/129954 WO2023093500A1 (zh) 2021-11-26 2022-11-04 一种访问验证方法及装置

Country Status (2)

Country Link
CN (1) CN114117551B (zh)
WO (1) WO2023093500A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114117551B (zh) * 2021-11-26 2022-12-27 深圳前海微众银行股份有限公司 一种访问验证方法及装置
CN116980233B (zh) * 2023-09-21 2024-01-30 宝略科技(浙江)有限公司 离散型数据高频访问时的授权校验方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190372993A1 (en) * 2018-06-05 2019-12-05 The Toronto-Dominion Bank Methods and systems for controlling access to a protected resource
CN111294337A (zh) * 2020-01-15 2020-06-16 平安科技（深圳）有限公司 一种基于令牌的鉴权方法及装置
CN111431844A (zh) * 2019-04-23 2020-07-17 杭州海康威视数字技术股份有限公司 一种权限认证方法及装置
CN111639327A (zh) * 2020-05-29 2020-09-08 深圳前海微众银行股份有限公司 一种开放平台的认证方法及装置
CN113595743A (zh) * 2021-08-04 2021-11-02 中国银行股份有限公司 一种授权令牌处理方法及装置
CN114117551A (zh) * 2021-11-26 2022-03-01 深圳前海微众银行股份有限公司 一种访问验证方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109902499A (zh) * 2019-03-13 2019-06-18 广州市网星信息技术有限公司 一种资源授权和访问方法、装置、系统、设备和存储介质
CN112995098B (zh) * 2019-12-14 2022-09-23 深圳市优必选科技股份有限公司 鉴权的方法、电子设备及存储介质
CN111756753B (zh) * 2020-06-28 2022-09-23 中国平安财产保险股份有限公司 一种权限验证方法及系统
CN112861089B (zh) * 2021-03-17 2024-02-20 北京数字医信科技有限公司 授权认证的方法、资源服务器、资源用户端、设备和介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190372993A1 (en) * 2018-06-05 2019-12-05 The Toronto-Dominion Bank Methods and systems for controlling access to a protected resource
CN111431844A (zh) * 2019-04-23 2020-07-17 杭州海康威视数字技术股份有限公司 一种权限认证方法及装置
CN111294337A (zh) * 2020-01-15 2020-06-16 平安科技（深圳）有限公司 一种基于令牌的鉴权方法及装置
CN111639327A (zh) * 2020-05-29 2020-09-08 深圳前海微众银行股份有限公司 一种开放平台的认证方法及装置
CN113595743A (zh) * 2021-08-04 2021-11-02 中国银行股份有限公司 一种授权令牌处理方法及装置
CN114117551A (zh) * 2021-11-26 2022-03-01 深圳前海微众银行股份有限公司 一种访问验证方法及装置

Also Published As

Publication number Publication date
CN114117551B (zh) 2022-12-27
CN114117551A (zh) 2022-03-01

Similar Documents

Publication Publication Date Title
US11606352B2 (en) Time-based one time password (TOTP) for network authentication
KR102440626B1 (ko) 디지털 인증서 관리 방법, 장치, 컴퓨터 기기 및 저장 매체
US9621355B1 (en) Securely authorizing client applications on devices to hosted services
US11438168B2 (en) Authentication token request with referred application instance public key
US11601426B2 (en) Device authentication method, service access control method, device, and non-transitory computer-readable recording medium
US10171241B2 (en) Step-up authentication for single sign-on
US9521144B2 (en) Authority delegate system, authorization server system, control method, and program
US20170244676A1 (en) Method and system for authentication
WO2023093500A1 (zh) 一种访问验证方法及装置
EP3454504B1 (en) Service provider certificate management
CN107483509A (zh) 一种身份验证方法、服务器及可读存储介质
US20230370265A1 (en) Method, Apparatus and Device for Constructing Token for Cloud Platform Resource Access Control
US11277404B2 (en) System and data processing method
CN109388937B (zh) 一种多因子身份认证的单点登录方法及登录系统
WO2019140790A1 (zh) 业务跟踪方法、装置、终端设备及存储介质
WO2022252992A1 (zh) 用户数据授权方法及用户数据授权系统
US11681513B2 (en) Controlled scope of authentication key for software update
CN112182009B (zh) 区块链的数据更新方法及装置、可读存储介质
KR20190114422A (ko) 블록체인 기반의 통합 로그인 방법, 단말 및 이를 이용한 서버
KR20190114424A (ko) 블록체인 기반의 통합 로그인 방법, 단말 및 이를 이용한 서버
KR102353808B1 (ko) 블록체인 기반의 통합 로그인 방법, 단말 및 이를 이용한 서버
KR20200062098A (ko) 블록체인 기반의 통합 로그인 방법, 단말 및 이를 이용한 서버
CN113420282B (zh) 一种跨站点的单点登录方法和装置
CN115250186B (zh) 网络连接认证方法、装置、计算机设备和存储介质
TWI694346B (zh) 多元身分認證憑據之系統與方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22897583

Country of ref document: EP

Kind code of ref document: A1