WO2023104117A1

WO2023104117A1 - Resource access method and system, electronic device, and computer-readable storage medium

Info

Publication number: WO2023104117A1
Application number: PCT/CN2022/137334
Authority: WO
Inventors: 刘京龙
Original assignee: 中兴通讯股份有限公司
Priority date: 2021-12-09
Filing date: 2022-12-07
Publication date: 2023-06-15
Also published as: CN116305020A

Abstract

Embodiments of the present application relate to the technical field of communications, and disclose a resource access method and system, an electronic device and a computer-readable storage medium. The resource access method comprises: receiving a login request of a user, the login request carrying the identity information of the user; authenticating the identity information of the user and, after the authentication is passed, storing the authentication information of the user and an identification value corresponding to the authentication information in a preset storage space, and storing the identification value in a client; receiving an identification value carried in a resource access request sent by a front-end server, wherein the carried identification value is carried in the resource access request when the client sends a resource access request to the front-end server; authenticating the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space, and permitting the resource to be accessed if it is determined that authentication is passed. Therefore, the processing burden of the server can be reduced, the flexibility is improved, and the method does not require a large amount of storage space to be consumed.

Description

Resource access method, system, electronic device and computer readable storage medium

technical field

The embodiments of the present application relate to the technical field of communications, and in particular, to a resource access method, system, electronic device, and computer-readable storage medium.

Background technique

Static resources are an important part of website resources, if access control is not performed on them, a large number of resources will be stolen and abused. The current static resource anti-theft technology is mainly divided into two categories: one is through the temporary uniform resource locator address (Uniform Resource Locator, url). The temporary url generated by the method will become invalid after it expires and needs to be regenerated. When a large number of users visit at the same time, the server needs to distribute a large number of temporary urls, which increases the burden on the server and affects the performance of the server. The other is to add risky source addresses to the blacklist in advance. Every time a user initiates a resource access request, it is judged whether the source address of the resource access request is in the preset blacklist. This method requires pre-setting the blacklist. For configuration, the flexibility is poor, and when there are many users, a large amount of storage space needs to be consumed.

It can be seen that the current static resource anti-theft technology tends to increase the processing load of the server, has poor flexibility, and consumes a large amount of storage space.

Contents of the invention

Embodiments of the present application propose a resource access method, system, electronic device, and computer-readable storage medium, so that resource theft can be prevented while reducing server processing load, improving flexibility, and eliminating the need to consume a large amount of storage space.

An embodiment of the present application provides a method for accessing resources, which is applied to an authentication server, including: receiving a user's login request; wherein, the login request carries the user's identity information; verifying the user's identity information, and then After the verification is passed, store the user's authentication information and the identification value corresponding to the authentication information in the preset storage space, and store the identification value in the client; receive the resource access request sent by the front-end server The identification value carried in; wherein, the carried identification value is carried in the resource access request when the client sends the resource access request to the front-end server; according to the carried identification value and the stored The identification value corresponding to the authentication information stored in the space authenticates the resource access request, and allows resource access when it is determined that the authentication is passed.

The embodiment of the present application also provides a resource access method, which is applied to the client, including: sending a login request to the authentication server, so that the authentication server can verify the identity information of the user carried in the login request , after the verification is passed, store the user's authentication information and the identification value corresponding to the authentication information into a preset storage space, and store the identification value in the client; carrying the stored identification value in the resource access request when sending the resource access request, so that the front-end server can send the identification value carried in the resource access request to the authentication server; wherein, the authentication The server is configured to perform authentication on the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space, and when it is determined that the authentication passes, allow Access resources.

The embodiment of the present application also provides a resource access method applied to a front-end server, including: receiving a resource access request carrying an identification value sent by a client; wherein, the identification value carried in the resource access request Store the user's identity information to the client after passing the verification, the user's identity information is carried in the login request received by the authentication server, and the authentication server verifies the user's identity information After passing the verification, store the user's authentication information and the identification value corresponding to the authentication information in the preset storage space; send the identification value carried in the resource access request to the authentication server , for the authentication server to authenticate the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space, and determine that the authentication has passed In the case, access to the resource is allowed.

The embodiment of the present application also provides a resource access system, including: a client, an authentication server, and a front-end server; the client is configured to send a login request to the authentication server; wherein, the login request carries the user the identity information of the user; the authentication server is configured to verify the identity information of the user, and store the authentication information of the user and the identification value corresponding to the authentication information in the preset storage space, and store the identification value in the client; the client is configured to carry the stored identification value in the resource access request when sending the resource access request to the front-end server; the The front-end server is configured to send the identification value carried in the resource access request to the authentication server; The identification value corresponding to the authentication information is used to authenticate the resource access request, and when it is determined that the authentication is passed, access to the resource is allowed.

The embodiment of the present application also provides an electronic device, including: at least one processor; and a memory connected in communication with the at least one processor; wherein, the memory stores information that can be executed by the at least one processor. Instructions; when the electronic device is an authentication server, the instructions are executed by the at least one processor, so that the at least one processor can execute a resource access method applied to the authentication server; in the When the electronic device is a client, the instructions are executed by the at least one processor, so that the at least one processor can execute a resource access method applied to the client; when the electronic device is a front-end server, The instructions are executed by the at least one processor, so that the at least one processor can execute the resource access method applied to the front-end server.

The embodiment of the present application also provides a computer-readable storage medium storing a computer program, and implementing the above resource access method when the computer program is executed by a processor.

The resource access method provided by the embodiment of the present application verifies the user's identity information carried in the received login request, and stores the user's authentication information and the identification value corresponding to the authentication information in the preset storage space, and store the identification value to the client; receive the identification value carried in the resource access request sent by the front-end server; the carried identification value is carried in the resource access request when the client sends the resource access request to the front-end server; According to the identification value carried and the identification value corresponding to the authentication information stored in the storage space, the resource access request is authenticated, and when it is determined that the authentication is passed, access to the resource is allowed. That is to say, in the embodiment of this application, login verification and resource anti-theft are combined to realize multiplexing of authentication information, without additional temporary url distribution operations and other interactions performed by the authentication server or front-end server, reducing the burden on the server. Moreover, in the embodiment of the present application, after the user's identity information has passed the verification, it indicates that the user is a legitimate user, which is equivalent to using the authentication information of the legitimate user to authenticate the resource access request, and there is no need to preset a blacklist. Maintain strong association, realize user-level resource access control, improve system flexibility and do not require additional storage space.

Description of drawings

FIG. 1 is a flowchart of a resource access method applied to an authentication server mentioned in the embodiment of the present application;

FIG. 2 is an interactive schematic diagram of the resource access method mentioned in the embodiment of the present application;

Fig. 3 is a flow chart of the resource access method applied to the client mentioned in the embodiment of the present application;

Fig. 4 is a flow chart of the resource access method applied to the front-end server mentioned in the embodiment of the present application;

Fig. 5 is a schematic diagram of the resource access system mentioned in the embodiment of the present application;

Fig. 6 is a schematic structural diagram of the electronic device mentioned in the embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. However, those of ordinary skill in the art can understand that, in each embodiment of the present application, many technical details are provided for readers to better understand the embodiments of the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in the embodiments of the present application can be realized. The division of the following embodiments is for the convenience of description, and should not constitute any limitation to the specific implementation of the embodiments of the present application, and the embodiments can be combined and referred to each other on the premise of no contradiction.

In one embodiment of the present application, a resource access method is provided, which is applied to an authentication server. The authentication server can be understood as a background server corresponding to the foreground server. This embodiment can be applied to the problem of resource misappropriation in the field of network resource security, such as the scene of anti-theft of static resources, where the static resources can be pictures, fonts, and the like. The implementation details of the resource access method of this embodiment are described in detail below, and the following content is only implementation details provided for easy understanding, and is not necessary for implementing this solution.

The flowchart of the resource access method in this embodiment can be shown in Figure 1, including:

Step 101: receiving a login request from a user;

Among them, the login request carries the identity information of the user;

Step 102: Verifying the identity information of the user, storing the authentication information of the user and the identification value corresponding to the authentication information in a preset storage space after the verification is passed, and storing the identification value to the client;

Step 103: receiving the identification value carried in the resource access request sent by the front-end server;

Wherein, the carried identification value is carried in the resource access request when the client sends the resource access request to the front-end server;

Step 104: Authenticate the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space, and allow access to the resource when it is determined that the authentication passes.

In the embodiment of the present application, login verification is combined with resource anti-theft to realize multiplexing of authentication information, and no additional temporary url distribution operation and other interactions are required by the authentication server or front-end server, reducing the burden on the server. Moreover, in the embodiment of the present application, after the user's identity information has passed the verification, it indicates that the user is a legitimate user, which is equivalent to using the authentication information of the legitimate user to authenticate the resource access request, and there is no need to preset a blacklist. Maintain strong association, realize user-level resource access control, improve system flexibility and do not require additional storage space.

In step 101, the user's identity information carried in the login request may include: a user name and a user password. The user can use the user name and user password to log in to the authentication server. For example, the user can enter the user name and user password through the login interface of the client to initiate a login request.

In an example, a user can log in using a user name and a user password through a global wide area network (World Wide Web, web) page, so that a login request carrying the user name and user password can reach the authentication server.

In an example, the browser in the client can directly send a login request to the authentication server, or the browser in the client can send a login request to the authentication server through the front-end server, that is, the browser sends a login request to the front-end server , the front-end server forwards the login request to the authentication server.

In step 102, the authentication server can verify the user's identity information according to the user name and user password carried in the user's identity information, and after the verification is passed, the user's authentication information and the identification value corresponding to the authentication information Store in the preset storage space, and store the identification value to the client. Among them, the preset storage space can be a storage tool with storage function, such as Remote Dictionary Server (Redis), Redis is a high-performance key-value database, which is convenient for efficient storage and reading of data It is beneficial to improve the efficiency and reliability of resource access. However, in the specific implementation, the storage tool is not limited to Redis. The user's authentication information may include: the user's authority information for different websites and different applications, and the identification value corresponding to the authentication information can be understood as a small file text cookie uniquely used to identify the user's authentication information. The authentication information of different users corresponds to different identification values, and the identification value corresponds to the authentication information one by one. The authentication information can be understood as a value, and the identification value can be understood as a key. Both the value and the key are stored in Redis. The authentication server will also store the identification value to the client. For example, the authentication server can directly send the identification value to the client for storage by the client; or, the authentication server can send the identification value to the front-end server, and the front-end server Then send the identification value to the client, so that the client stores the identification value.

Wherein, the front-end server can be a server capable of resource access and request forwarding, such as any one of the following: Nginx, open source web server (Apache HTTP Server, apache), Internet Information Server (Internet Information Server, IIS) server . Nginx is a high-performance Hypertext Transfer Protocol (Hyper Text Transfer Protocol, HTTP) and reverse proxy web server. The tomcat server is a free and open source web application server, which is a lightweight application server.

In an example, storing the identification value in the client after the verification of the user's identity information is passed may be: storing the identification value in a browsing tool on the client, such as storing in a browser.

In step 103, when the client determines that it needs to initiate a resource access request to the front-end server, it may carry the stored identification value in the resource access request and send it to the front-end server. When the front-end server receives the resource access request, it obtains the identification value carried in the resource access request, and sends the carried identification value to the authentication server, so that the authentication server can receive the identification value and respond to the resource access request. Authenticate.

In step 104, the authentication server authenticates the resource access request according to the identification value carried in the resource access request and the identification value corresponding to the authentication information stored in the storage space, and may send the authentication result to the front-end server , for the front-end server to respond to the authentication result. When the front-end server determines that the authentication result is passed, the resource is allowed to be accessed. For example, the resource requested by the resource access request can be sent to the client, and the requested resource is displayed on the client interface.

Wherein, the authentication server can query and read the same identification value as the identification value carried in the access request among the identification values stored in the storage space, and record the queried identification value as the target identification value. The authentication server queries the authentication information corresponding to the target identification value in the storage space, and the queried authentication information is recorded as the target authentication information. The authentication server can obtain the authentication result of the access request according to the target authentication information. For example, the resource access request can carry the information of the website to be visited. If the target authentication information includes the permission information of the website to be visited by the user, and the permission information is to allow access, then the authentication result of the resource access request is authentication pass. If the target authentication information does not include the authority information of the website to be visited by the user, or although the target authentication information includes the authority information of the website to be visited by the user, but the authority information is not allowed to be used, the authentication of the resource access request The result is authentication failed.

After the authentication server authenticates the resource access request, it can send the authentication result whether the authentication passes or fails to the front-end server, so that the front-end server can respond to the authentication result. Wherein, when it is determined that the authentication result is that the authentication is passed, the response is to allow access to the resource, and when it is determined that the authentication result is that the authentication is not passed, the response may be to not allow access to the resource. That is, access to resources is allowed only through authentication, so that resource theft can be prevented.

The current static resource anti-theft technology, that is, the way of temporary URLs and the way of adding risky source addresses to the blacklist in advance can only achieve website-level access control, and cannot perform finer-grained control based on user permissions. In this embodiment, a finer-grained user-level resource access control is provided, and access requests are authenticated by using authentication information of legitimate users, without additional interaction logic, which is simple and easy to implement.

In one embodiment, when it is determined that the authentication fails, the page of the client is controlled to jump to a login page, so as to instruct the user to log in again. That is to say, when it is determined that the authentication result is that the authentication fails, the response of the front-end server to the authentication result may be to control the current page of the client to jump to the login page, so as to instruct the user to log in again. For example, if the authentication fails, you can jump to the login page and prompt the user to re-enter the user name and password to log in again. It is convenient for users to log in again to access resources smoothly when the authentication fails due to entering the wrong user name or user password.

In one embodiment, the authentication information and the identification value corresponding to the authentication information are set with a valid period, and the authentication information and the identification value corresponding to the authentication information stored in the storage space When the storage period is longer than the validity period, the authentication information stored in the storage space and the identification value corresponding to the authentication information become invalid; the storage of the identification value stored in the client If the duration is longer than the validity period, the identification value stored in the client is invalid. Among them, the validity period can be set according to actual needs. For example, in the case of high security requirements for authentication, the validity period can be set relatively short; The deadline can be set relatively long. That is to say, the authentication information and identification value stored in the storage space and the identification value stored in the client are all set with an expiration date, which will automatically become invalid after the expiration date, which is conducive to improving the security of authentication to a certain extent.

In an example, the authentication information stored in the storage space and the identification value corresponding to the authentication information become invalid, which may be: after the authentication information and the identification value corresponding to the authentication information expire, the storage space automatically deletes the authentication information and the identification value corresponding to the authentication information. The identification value corresponding to the authentication information. The invalidation of the identification value stored in the client may be: after the identification value stored in the client expires, the client automatically deletes the stored identification value. If the identification value is stored in the browser in the client, the browser may automatically delete the stored identification value after the identification value expires.

In an embodiment, the above valid period can be refreshed by using the keep-alive mechanism of the user login. For example, the front-end server can periodically call the keep-alive interface, and periodically refresh the effective duration through the keep-alive interface. The keep-alive mechanism can be understood as: after the user logs in, the front-end server or client monitors the user's operation behavior, and when it is determined that the user's operation behavior is detected, the validity period will be updated once, that is, every time a user's operation behavior is detected, the validity period will be changed. The starting point of is updated to the time point when the user's operation behavior is detected. In this embodiment, by integrating login authentication and resource anti-theft, the validity period of resource access can be kept highly consistent with the validity period of user sessions, and the validity period of authentication information can be refreshed by using the keep-alive mechanism of user login, without requiring the authentication server to perform additional operations. cleanup and keepalive operations.

In one embodiment, web static resources are split into resources required for login and resources required for accessing services. The resources required for login do not need to be authenticated, and the resources required for accessing services need to be authenticated. In this embodiment, after the access request is received, access to the static resources of a specific project is allowed only after the authentication is passed. Refer to Figure 2 for an interactive diagram of resource access methods, including:

1. User login. For example, a user logs in using a user name and a user password through a browser in the client, and the login request reaches the authentication server.

2. Verify and store authentication information. The authentication server verifies the identity information of the user, and stores the authentication information and the cookie corresponding to the authentication information into Redis after the verification is passed.

3. Pass the test and return the cookie. After the authentication server passes the verification of the user's identity information, it returns the cookie to the browser, and the browser stores the cookie locally.

4. Resource access request. When a user needs to access or download a static resource, the browser sends the stored cookie to the front-end server in the resource access request. For example, the cookie can be carried in the request header of the resource access request.

5. Carry cookie verification. The front-end server obtains the carried cookie from the resource access request, and sends the cookie to the authentication server for authentication.

6. Obtain authentication information and verify it. After receiving the cookie, the authentication server obtains the authentication information corresponding to the cookie from Redis according to the received cookie, so as to judge whether the current user authority meets the access requirements, and obtain the authentication result.

7. Return the authentication result. The authentication server sends the authentication result to the front-end server.

8. If the authentication is passed, the resource will be obtained; if the authentication fails, the login page will be redirected. That is, the front-end server receives the authentication result and makes a response. If the authentication passes, the access is allowed, and the resources accessed by the resource access request are obtained and sent to the browser for display by the browser. If the authentication fails, jump to the login page and prompt the user to log in.

In this embodiment, the embodiment of this application combines login verification with resource anti-theft to realize the multiplexing of authentication information, and does not require authentication servers or front-end servers to perform additional temporary url distribution operations and other interactions, reducing the number of servers burden. Moreover, in the embodiment of the present application, after the user's identity information has passed the verification, it indicates that the user is a legitimate user, which is equivalent to using the authentication information of the legitimate user to authenticate the access request. There is no need to preset a blacklist, and the user keeps Strong association, user-level resource access control, improved system flexibility and no additional storage space. By integrating login verification with resource anti-theft, the validity period of resource access can be kept highly consistent with the validity period of user sessions, and the validity period of resource request authentication information can be refreshed by using the user login keep-alive mechanism, without additional cleaning and preservation by the authentication server. live operation. At the same time, this embodiment can not only realize the access control to the picture resource, but also can realize the access control of many types of static resources except the picture resource, and has a wide application range.

In one embodiment of the present application, a resource access method is also provided, which is applied to the client, referring to FIG. 3 , including:

Step 301: Send a login request to the authentication server, so that the authentication server can verify the user's identity information carried in the login request, and after the verification is passed, the user's authentication information and the identification value corresponding to the authentication information Store in the preset storage space, and store the identification value to the client;

Step 302: Carry the stored identification value in the resource access request when sending the resource access request to the front-end server, so that the front-end server can send the identification value carried in the resource access request to the authentication server;

Wherein, the authentication server is set to authenticate the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space, and allow access to the resource when the authentication is determined to pass.

It is not difficult to find that this embodiment is an embodiment corresponding to the above-mentioned embodiment of the resource access method applied to the authentication server, and this embodiment can be implemented in cooperation with the above-mentioned embodiment of the resource access method applied to the authentication server. The relevant technical details and technical effects mentioned in the above embodiment of the resource access method applied to the authentication server are still valid in this embodiment, and will not be repeated here to reduce repetition. Correspondingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiment of the resource access method applied to the authentication server.

In one embodiment of the present application, a resource access method is also provided, which is applied to the front-end server, referring to FIG. 4 , including:

Step 401: Receive the resource access request carrying the identification value sent by the client; wherein, the identification value carried in the resource access request is stored in the client after the authentication server passes the verification of the user's identity information, and the user's identity information is In the login request received by the authentication server, the authentication server will also store the user's authentication information and the identification value corresponding to the authentication information into the preset storage space after passing the verification of the user's identity information;

Step 402: Send the identification value carried in the resource access request to the authentication server, so that the authentication server can authenticate the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space , and when it is determined that the authentication is passed, access to the resource is allowed.

It is not difficult to find that this embodiment is an embodiment corresponding to the above-mentioned embodiment of the resource access method applied to the authentication server and the client, and this embodiment can be compared with the above-mentioned resource access method applied to the authentication server and the client. The embodiments of the method are implemented in cooperation with each other. The relevant technical details and technical effects mentioned in the above embodiments of the resource access method applied to the authentication server and the client are still valid in this embodiment, and will not be repeated here to reduce repetition. Correspondingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiments of the resource access method applied to the authentication server and the client.

It should be noted that the above examples in the embodiments of the present application are illustrations for the convenience of understanding, and do not limit the technical solutions of the embodiments of the present application.

The step division of the above various methods is only for the sake of clarity of description. During implementation, it can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent. ; Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but not changing the core design of the algorithm and process are all within the scope of protection of this patent.

The embodiment of the present application also provides a resource access system, as shown in FIG. 5 , including: a client 501, an authentication server 502, and a front-end server 503;

The client 501 is configured to send a login request to the authentication server 502; wherein the login request carries the identity information of the user;

The authentication server 502 is configured to verify the identity information of the user, and store the user's authentication information and the identification value corresponding to the authentication information into a preset storage space after the verification is passed, and store the identification value in the client 501;

The client 501 is configured to carry the stored identification value in the resource access request when sending the resource access request to the front-end server 503;

The front-end server 503 is configured to send the identification value carried in the resource access request to the authentication server 502;

The authentication server 502 is configured to perform authentication on the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space, and allow access to the resource when it is determined that the authentication is passed.

It is not difficult to find that this embodiment is a system embodiment corresponding to the above embodiments of resource access methods, and this embodiment can be implemented in cooperation with the above embodiments of resource access methods. The relevant technical details and technical effects mentioned in the embodiments of the resource access methods above are still valid in this embodiment, and will not be repeated here to reduce repetition. Correspondingly, the relevant technical details mentioned in this embodiment can also be applied to the embodiments of the above resource access methods.

The embodiment of the present application also provides an electronic device, as shown in FIG. 6 , including: at least one processor 601; and a memory 602 communicatively connected to the at least one processor 601; wherein, the memory 602 stores information that can be instructions executed by the at least one processor 601;

In the case where the electronic device is an authentication server, the instructions are executed by at least one processor 601, so that the at least one processor 601 can execute a resource access method applied to the authentication server;

In the case where the electronic device is a client, the instructions are executed by at least one processor 601, so that the at least one processor 601 can execute a resource access method applied to the client;

In the case that the electronic device is a front-end server, the instructions are executed by at least one processor 601, so that the at least one processor 601 can execute the resource access method applied to the front-end server.

Wherein, the memory 602 and the processor 601 are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors 601 and various circuits of the memory 602 together. The bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein. The bus interface provides an interface between the bus and the transceivers. A transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium. The data processed by the processor 601 is transmitted on the wireless medium through the antenna, and further, the antenna also receives the data and transmits the data to the processor 601 .

Processor 601 is responsible for managing the bus and general processing, and may also provide various functions including timing, peripheral interface, voltage regulation, power management, and other control functions. And the memory 602 may be used to store data used by the processor 601 when performing operations.

The embodiment of the present application also provides a computer-readable storage medium storing a computer program. The above method embodiments are implemented when the computer program is executed by the processor.

That is, those skilled in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, the program is stored in a storage medium, and includes several instructions to make a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Those of ordinary skill in the art can understand that the above-mentioned implementation modes are specific examples for realizing the present application, and in practical applications, various changes can be made to it in form and details without departing from the principles of the present application examples. spirit and scope.

Claims

A resource access method applied to an authentication server, including:

Receive a login request from the user; wherein, the login request carries the identity information of the user;

Verifying the user's identity information, storing the user's authentication information and the identification value corresponding to the authentication information in a preset storage space after the verification is passed, and storing the identification value to the client;

Receiving the identification value carried in the resource access request sent by the front-end server; wherein, the carried identification value is carried in the resource access request when the client sends the resource access request to the front-end server;

Perform authentication on the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space, and allow access to the resource when it is determined that the authentication is passed.
The resource access method according to claim 1, wherein the authentication information and the identification value corresponding to the authentication information are set with an expiration date,

When the storage period of the authentication information and the identification value corresponding to the authentication information stored in the storage space is longer than the validity period, the authentication information and the identification value stored in the storage space The identification value corresponding to the authentication information becomes invalid;

If the storage period of the identification value stored in the client is longer than the validity period, the identification value stored in the client becomes invalid.
The resource access method according to claim 2, wherein the validity period is refreshed using a keep-alive mechanism of the user login.
The resource access method according to any one of claims 1 to 3, wherein the method further includes: when it is determined that the authentication fails, controlling the page of the client to jump to the login page to indicate the The user logs back in.
The resource access method according to any one of claims 1 to 3, wherein the storage space is a remote dictionary service.
A resource access method, applied to the client, including:

Send a login request to the authentication server, so that the authentication server can verify the identity information of the user carried in the login request, and combine the authentication information of the user with the authentication information after the verification is passed. The identification value corresponding to the information is stored in a preset storage space, and the identification value is stored in the client;

carrying the stored identification value in the resource access request when sending the resource access request to the front-end server, so that the front-end server can send the identification value carried in the resource access request to the authentication server;

Wherein, the authentication server is configured to authenticate the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space, and determine the authentication If passed, access to the resource is allowed.
A resource access method, applied to a front-end server, comprising:

Receiving a resource access request with an identification value sent by the client; wherein, the identification value carried in the resource access request is stored in the client after the authentication server passes the verification of the user's identity information, and the user's The identity information is carried in the login request received by the authentication server. After the authentication server passes the verification of the identity information of the user, it also combines the authentication information of the user with the authentication information The corresponding identification value is stored in the preset storage space;

Sending the identification value carried in the resource access request to the authentication server, so that the authentication server can use the identification value carried in the resource access request and the identification corresponding to the authentication information stored in the storage space value, authenticate the resource access request, and allow access to the resource when it is determined that the authentication is passed.
A resource access system, including: a client, an authentication server and a front-end server;

The client is configured to send a login request to the authentication server; wherein the login request carries user identity information;

The authentication server is configured to verify the user's identity information, and store the user's authentication information and the identification value corresponding to the authentication information into a preset storage space after the verification is passed , and store the identification value to the client;

The client is configured to carry the stored identification value in the resource access request when sending the resource access request to the front-end server;

The front-end server is configured to send the identification value carried in the resource access request to the authentication server;

The authentication server is configured to authenticate the resource access request according to the carried identification value and the identification value corresponding to the authentication information stored in the storage space, and determine that the authentication has passed In the case, access to the resource is allowed.
An electronic device comprising: at least one processor; and,

a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor;

When the electronic device is an authentication server, the instructions are executed by the at least one processor, so that the at least one processor can execute the resource access method according to any one of claims 1 to 5 ;

When the electronic device is a client, the instructions are executed by the at least one processor, so that the at least one processor can execute the resource access method as claimed in claim 6;

When the electronic device is a front-end server, the instructions are executed by the at least one processor, so that the at least one processor can execute the resource access method as claimed in claim 7 .
A computer-readable storage medium storing a computer program, wherein, when the computer program is executed by a processor, the resource access method according to any one of claims 1 to 5 is realized, or the resource access method according to claim 6 is realized method, or implement the resource access method described in claim 7.