CN116032616A - Identity verification method and related equipment - Google Patents

Abstract

The embodiment of the present application discloses an identity verification method and related equipment, which are used to improve the efficiency of identity verification. The method in this embodiment of the application includes: receiving the identity verification token sent by the client; the identity verification token is issued to the client by the issuing server; the identity verification token is issued by the issuing server based on a preset key Processing the generation of identity information of the client; the issuing server and the application server belong to the same mutual trust server cluster, wherein the preset key of each server in the same mutual trust server cluster is consistent; based on the preset key, determine the Whether the verified identity information included in the identity verification token and the identity information to be verified are consistent; if the identity information to be verified is consistent with the verified identity information, it is determined that the client has passed the identity verification, and the client is allowed to The terminal invokes the application server.

Description

Authentication methods and associated devices

technical field

The embodiment of the present application relates to the field of cloud services, and in particular to an identity verification method and related devices.

Background technique

In network communication, the protection of the local data of the client and the local data of the server is particularly important. Therefore, in today's network environment, whether a user accesses the network or logs in to an application, authentication is required.

Now when a user needs to access a certain cloud service, the client will send a call command and user information to the corresponding application server, and the application server will send an identity verification request including the client’s identity information to the remote server, where the remote server saves the access permission User information of all users of the application server. The remote server determines whether there is identity information consistent with the received identity information of the client locally, and if so, determines that the client passes the identity verification, and informs the application server that the client is allowed to call.

However, the identity verification based on the remote server will be very time-consuming due to network delay and other reasons. When the client frequently generates business needs and needs to access the application server, each access needs to be initiated by the corresponding application server to the remote server. Identity verification, and allowing client access only after the verification is passed, will consume a lot of time and will become a bottleneck for the improvement of corresponding business performance.

Contents of the invention

The embodiment of the present application provides an identity verification method and related equipment, which are used to improve the efficiency of identity verification.

The first aspect of the embodiment of the present application provides an identity verification method, which is applied to an application server, and the method includes:

Receive the identity verification token sent by the client; the identity verification token is issued to the client by the issuing server; the identity verification token is processed by the issuing server based on a preset key to the identity information of the client Generate; the distribution server and the application server belong to the same mutual trust server cluster, wherein the preset key of each server in the same mutual trust server cluster is consistent;

Based on the preset key, determine whether the verified identity information included in the identity verification token and the identity information to be verified are consistent;

If the identity information to be verified is consistent with the verified identity information, it is determined that the client has passed the identity verification, and the client is allowed to call the application server.

In a specific implementation manner, after allowing the client to call the application server, the method further includes:

In response to a service invocation request for other services, sending the identity verification token of the client to other servers deploying the other services, the other servers and the application server belong to the same mutual trust server cluster;

If the verification failure information sent by the other server is not received, access the other services deployed by the other server.

In a specific implementation manner, the preset key includes a preset private key and a preset public key; based on the preset key, determining the verified identity information included in the identity verification token and the pending Verify identity information is consistent, including:

Decrypt the verified identity information in the identity verification token based on the preset public key to obtain corresponding decrypted identity information; the verified identity information is the issuing server, and encrypt the Obtaining the summary of the client's identity information; the summary of the client's identity information is obtained by processing the client's identity information based on a preset summary algorithm by the issuing server;

processing the identity information to be verified in the identity verification token based on the preset digest algorithm to obtain a digest of the identity information to be verified;

If the digest of the identity information to be verified is consistent with the decrypted identity information, it is determined that the identity information to be verified is consistent with the verified identity information.

The second aspect of the embodiment of the present application provides an identity verification method applied to a client, and the method includes:

In response to a service invocation instruction for the target service, an identity verification token is sent to the application server deploying the target business; the identity verification token is issued to the client by the issuing server; the identity verification token is issued by the The distribution server processes the generation of the identity information of the client based on a preset key; the distribution server and the application server belong to the same mutual trust server cluster, wherein the preset key of each server in the same mutual trust server cluster is consistent;

If the verification failure information sent by the application server is not received, access the target service deployed by the application server.

In a specific implementation manner, before sending the identity verification token to the application server deploying the target service, the method further includes:

In response to a service call instruction for any service, send a service initialization request to the distribution server deploying the any service, so that the distribution server initiates an identity verification for the client to the remote server;

Receive and save the identity verification token sent by the issuing server, and access any service deployed by the issuing server based on the identity verification token; the identity verification token is issued by the issuing server in the Generated after the remote server determines that the client is authenticated.

In a specific implementation manner, the storing the identity verification token sent by the issuing server includes:

The authentication token is saved in the security context of the local thread of the client.

The third aspect of the embodiment of the present application provides an identity verification method, which is applied to the issuing server, and the method includes:

Responding to the service invocation request sent by the client, initiate identity verification for the client to the remote server;

If receiving the verification information sent by the remote server for the client, processing the identity information of the client based on a preset key to generate an identity verification token of the client;

Send the identity verification token to the client, so that the client sends a service call request to the application server deploying the target service according to the identity verification token, and make the application server send a service call request according to the identity verification token identity verification for the client locally, the application server and the issuing server belong to the same mutual trust server cluster, and the preset keys of each server in the same mutual trust server cluster are consistent.

In a specific implementation manner, the preset key includes a preset private key and a preset public key; processing the identity information of the client based on the preset key to generate an identity verification token of the client, include:

processing the identity information of the client based on a preset digest algorithm to obtain a digest of the client's identity information;

Encrypting the identity information digest of the client based on a preset private key to obtain encrypted identity information;

An identity verification token including the identity information of the client and the encrypted identity information is generated.

The fourth aspect of the embodiment of the present application provides an application server, including:

The receiving unit is configured to receive the identity verification token sent by the client; the identity verification token is issued to the client by the issuing server; the identity verification token is processed by the issuing server based on a preset key Generating the identity information of the client; the distribution server and the application server belong to the same mutual trust server cluster, wherein the preset key of each server in the same mutual trust server cluster is consistent;

A determination unit, configured to determine whether the verified identity information and the identity information to be verified included in the identity verification token are consistent based on the preset key;

The determining unit is further configured to, if the identity information to be verified is consistent with the verified identity information, determine that the client has passed the identity verification, and allow the client to call the application server.

In a specific implementation manner, after the client is allowed to call the application server, the application server further includes: a sending unit and an access unit;

The sending unit is configured to send the identity verification token of the client to other servers deploying the other services in response to service invocation requests for other services, and the other servers belong to the same mutual trust server cluster as the application server ;

The access unit is configured to access the other services deployed by the other servers if the verification failure information sent by the other servers is not received.

In a specific implementation manner, the preset key includes a preset private key and a preset public key; the determining unit is specifically configured to decrypt, based on the preset public key, the Verifying the identity information to obtain corresponding decrypted identity information; the verified identity information is obtained by encrypting the identity information digest of the client based on the preset private key by the issuing server; the identity information digest of the client is the The issuing server processes the acquisition of the client's identity information based on a preset digest algorithm;

processing the identity information to be verified in the identity verification token based on the preset digest algorithm to obtain a digest of the identity information to be verified;

If the digest of the identity information to be verified is consistent with the decrypted identity information, it is determined that the identity information to be verified is consistent with the verified identity information.

The fifth aspect of the embodiment of the present application provides a client, including:

a sending unit, configured to send an identity verification token to an application server deploying the target business in response to a service call instruction for the target business; the identity verification token is issued to the client by the issuing server; the identity verification The token is generated by the issuing server processing the identity information of the client based on a preset key; the issuing server and the application server belong to the same mutual trust server cluster, wherein the preset key of each server in the same mutual trust server cluster key match;

The access unit is configured to access the target service deployed by the application server if the verification failure information sent by the application server is not received.

In a specific implementation manner, before sending the identity verification token to the application server that deploys the target service, the sending unit is further configured to, in response to a service call instruction for any service, send the The issuing server of any service sends a service initialization request, so that the issuing server initiates identity verification for the client to the remote server;

The access unit is further configured to receive and save the identity verification token sent by the issuing server, and access any service deployed by the issuing server based on the identity verification token; the identity verification token is provided by The issuing server is generated after the remote server determines that the client has passed the authentication.

In a specific implementation manner, the access unit is specifically configured to save the identity verification token in the security context of the local thread of the client.

The sixth aspect of the embodiment of the present application provides a distribution server, including:

An initiating unit, configured to initiate identity verification for the client to a remote server in response to a service invocation request sent by the client;

The processing unit is configured to process the identity information of the client based on a preset key and generate an identity verification token of the client if the verification pass information for the client sent by the remote server is received;

a sending unit, configured to send the identity verification token to the client, so that the client sends a service invocation request to the application server deploying the target service according to the identity verification token, and makes the application server send a service call request according to the The identity verification token performs identity verification on the client locally, the application server and the issuing server belong to the same mutual trust server cluster, and the preset key of each server in the same mutual trust server cluster is consistent.

In a specific implementation manner, the preset key includes a preset private key and a preset public key; the processing unit is specifically configured to process the identity information of the client based on a preset digest algorithm to obtain the client Summary of the identity information of the terminal;

Encrypting the identity information digest of the client based on a preset private key to obtain encrypted identity information;

An identity verification token including the identity information of the client and the encrypted identity information is generated.

The seventh aspect of the embodiment of the present application provides a computer device, including:

Central processing unit, memory and input and output interfaces;

The memory is a temporary storage memory or a persistent storage memory;

The central processing unit is configured to communicate with the memory, and execute instructions in the memory to perform the method described in the first aspect, the second aspect or the third aspect.

The eighth aspect of the embodiment of the present application provides a computer program product containing instructions, and when the computer program product is run on a computer, it causes the computer to execute the method described in the first aspect, the second aspect or the third aspect.

The ninth aspect of the embodiment of the present application provides a computer storage medium, where instructions are stored in the computer storage medium, and when the instructions are executed on the computer, the computer executes the computer according to the first aspect, the second aspect or the third aspect. the method described.

It can be seen from the above technical solutions that the embodiment of the present application has the following advantages: by configuring the same preset key for each application server with the same user information that is allowed to access, a mutual trust server cluster is formed. As long as the client initiates a service request to any application server (i.e., the issuing server) of a mutual trust server cluster, the issuing server will send the client an application based on the preset key to process the client after the identity verification is passed. The authentication token obtained from the identity information of the client. After receiving the authentication token sent by any application server in a mutual trust server cluster (that is, the issuing server), the client can send a service call request to any application server in the mutual trust server cluster. The authentication token is sent so that the application server can perform authentication on the client locally according to the authentication token and the preset key without using a remote server to complete the authentication, which can greatly improve the authentication efficiency.

Description of drawings

FIG. 1 is a system architecture diagram of the identity verification method disclosed in the embodiment of the present application;

FIG. 2 is a schematic flow diagram of an identity verification method disclosed in an embodiment of the present application;

FIG. 3 is another schematic flowchart of the identity verification method disclosed in the embodiment of the present application;

FIG. 4 is a schematic structural diagram of an application server disclosed in an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a client disclosed in an embodiment of the present application;

FIG. 6 is a schematic structural diagram of the distribution server disclosed in the embodiment of the present application;

FIG. 7 is a schematic structural diagram of a computer device disclosed in an embodiment of the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the application with reference to the drawings in the embodiments of the application. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

The business logic of the EJB hosting application often has specific requirements for the identity of the visitor (or user and/or client), and the visitor needs to be authenticated every time the business method of the EJB with security requirements is invoked The current common way is to allow the identity information of the user to access to be stored in a remote separate LDAP server (that is, a remote server), and it needs to be connected to the remote LDAP server to verify during verification.

Because, every time the business method of EJB is invoked, it needs to rely on the remote server for verification. Factors such as network delay or the limitation of the processing capacity of the remote server will bring time loss and limit the performance improvement of EJB business.

In order to solve the above-mentioned problems in the prior art, embodiments of the present application provide an identity verification method and related equipment for improving identity verification efficiency.

In order to better illustrate the technical solutions of the embodiments of the present application, the technical concepts of the departments that will appear later will be explained in advance.

EJB (Enterprise JavaBeans) technology is the server-side component architecture of Java EE (Java Platform, Enterprise Edition). EJB technology supports rapid and simplified development of distributed, transactional, secure and portable applications based on Java technology.

Cluster: Multiple distributed computer nodes provide external services as a unified whole. This whole is called a cluster. The cluster can provide stronger service capabilities than a single node.

JNDI (Java Naming and Directory Interface) is an application programming interface that provides naming and directory functions for applications written in the Java programming language. It is defined to be independent of any specific directory service implementation.

The JNDI name context, or Context, consists of a series of "name-object" bindings, and provides methods for finding, creating, and deleting these bindings.

LDAP (Lightweight Directory Access Protocol) is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over Internet Protocol networks. For example, a directory service can provide any organized set of records, usually with a hierarchical structure, such as a corporate email directory, user information, and so on.

The application server is a kind of basic software located on the operating system, because it is located between the operating system and the application program of the business, so it is also called a kind of middleware. It is used to provide an execution environment for applications, as well as common underlying services such as security, transactions, and data that are independent of each application, so that developers can focus on the development of business logic.

Domain (domain) is a way to manage applications and processes in the application server. Multiple domains can be established in the installation of each application server. Each domain usually corresponds to a separate process, which can be understood as an instance of the application server. It has the complete functions of the application server, and some applications can be deployed on it to provide external services.

Referring to FIG. 1 , an embodiment of the present application provides an identity verification system, which includes: a client 101 , an issuing server 102 , a remote server 103 and an application server 104 . Wherein, the issuing server 102 and the application server 104 belong to the same mutual trust server cluster, that is to say, the preset key of the issuing server 102 is consistent with the preset key of the application server 104 . Before the client 101 initiates a service invocation request to any application server 104 in the mutual trust server cluster shown in the figure for the first time, it first initiates a service initialization request to the issuing server 102 . After receiving the service initialization request, the distribution server 102 will initiate an identity verification request for the client 101 to the remote server 103 . The remote server 103 includes the identity information of each user who is allowed to access the aforementioned mutual trust server cluster. If the remote server 103 inquires and finds that the identity information of the client 101 is allowed to access the aforementioned mutual trust server cluster, it will send a verification pass message to the distribution server 102 , to inform the issuing server 102 that the client 101 is allowed to access related services. After the issuing server 102 receives the verification passing information, it will process the identity information of the client 101 based on the preset key, generate an identity verification token, and send the generated identity verification token to the client 101 . When the client 101 subsequently sends a service invocation request to any application server 104 in the mutual trust server cluster, it will send the previously obtained identity verification token to the application server 104 together. The application server 104 can perform authentication on the client 101 based on the authentication token. If the verification fails, send verification failure information to the client 101; if the verification passes, the client 101 is allowed to access related services.

It should be noted that the aforementioned mutual trust server cluster may also include any other servers except the distribution server 102 and the application server 104, as long as the identity information of the users allowed to be accessed by each server in the mutual trust server cluster is consistent. In addition, in practical applications, the distribution server 102 and the application server 104 can be the same or different servers in the aforementioned mutual trust server cluster; the only difference is that the first server in the aforementioned mutual trust server cluster accessed by the client 101 can only be the distribution server 102 , any non-first server in the aforementioned mutual trust server cluster accessed by the client 101 can be the application server 104; the purpose of distinguishing the distribution server 102 and the application server 104 is to better illustrate the identity verification process of the embodiment of the present application .

Wherein, the client 101 may be, but not limited to, various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, and the like. The server (including the distribution server 102, the remote server 103 and the application server 104) can be implemented by an independent server or a server cluster composed of multiple servers.

On the basis of the aforementioned identity verification system, please refer to FIG. 2. The embodiment of the present application provides an identity verification method, which can be executed by the aforementioned client 101, issuing server 102, remote server 103 and/or application server 104. In this embodiment The method includes the following steps:

201. The client sends an identity verification token to an application server deploying the target service in response to a service invocation instruction for the target service.

When the user needs to access the target service, a service call instruction for the target service will be initiated through the client. Then, send the identity verification token to the application server deploying the target business, and the application server can verify whether the client has the right to access the target business based on the identity verification token, wherein the application server deploying the target business can be the any server.

It should be noted that the identity verification token is sent to the client by the issuing server belonging to the same mutual trust server cluster as the application server, and the identity information of the client is processed by the issuing server based on the preset key (the identity information here is obtained through remote The identity information of the identity verification of the server) is generated. Wherein, the preset keys of each server (including the application server and/or distribution server) in the same mutual trust server cluster are the same.

It can be understood that, in practical applications, configuring the same preset key for each server in the same mutual trust server cluster can be achieved by including but not limited to the following methods: 1) configuring the same preset key for each server in the same mutual trust server cluster Identity password, each server can generate the same preset key based on the same identity password; 2) directly configure the same preset key for each server in the same mutual trust server cluster. In addition, for method 1, after further configuring the same identity password for each server in the same mutual trust server cluster, each server can encrypt the identity password with any encryption method and save it locally, and only store the identity password when a preset key needs to be generated. decrypt. In this way, even if the two servers have the same identity password, the encrypted ciphertext is completely different, and the outside world cannot judge whether the two servers belong to the same mutual trust server cluster based on the encrypted identity password.

202. The application server determines whether the verified identity information and the identity information to be verified included in the identity verification token are consistent based on the preset key.

Because the application server and the distribution server belong to the same mutual trust server cluster, the preset key in the application server is consistent with the preset key of the distribution server. At the same time, the authentication token is generated by the issuing server processing the client's identity information based on the preset key. Therefore, by processing the identity verification token with a preset key, it can be determined whether the verified identity information included in the identity verification token is consistent with the identity information to be verified. It should be noted that the verified identity information recorded in the authentication token is encrypted, so it cannot be tampered with; while the identity information to be verified recorded in the authentication token is the identity information of the client recorded in plain text. Identity information includes, but is not limited to: user information (such as user name and user ID) and/or client IP, etc.

In practical applications, the identity information to be verified is usually the original text of the client’s identity information, and the verified identity information can be the original text of the client’s identity information encrypted based on a preset key, or the original text of the client’s identity information encrypted based on a preset key. A digest of the client's identity information. For example, if the identity information of the client is A, the identity information to be verified in the corresponding identity verification token can be A, and the verified identity information in the corresponding identity verification token can be encrypted based on the preset key A or the digest of A encrypted based on the preset key (the digest of A refers to the data obtained after processing A based on the preset digest algorithm).

203. If the identity information to be verified is consistent with the verified identity information, the application server determines that the client passes the identity verification, and allows the client to call the application server.

The verified identity information obtained in step 202 is the identity information that has passed the identity verification of the remote server, that is to say, the client corresponding to the verified identity information is allowed to access the target service. Therefore, if the identity information to be verified is consistent with the verified identity information, it means that the identity verification token is generated by any mutual trust server cluster described by the application server, that is, the client holding the identity verification token in step 201 It is allowed to access the application server where the target service is deployed and the target service deployed by the application server.

204. If the client does not receive the verification failure information sent by the application server, access the target service deployed by the application server.

If the application server finds that the identity information to be verified is inconsistent with the verified identity information, the application server will send a verification failure message to the client to inform the client that it cannot continue to access the target business deployed on the application server. In practical applications, the client can keep accessing the target business deployed on the application server before receiving the verification failure information; or if the client does not receive the verification failure information within a certain period of time, the verification can be considered successful , and continue to access the target business deployed on the application server.

In the embodiment of the present application, a mutual trust server cluster is formed by configuring the same preset key for each application server whose access user information is consistent. As long as the client initiates a service request to any application server (i.e., the issuing server) of a mutual trust server cluster, the issuing server will send the client an application based on the preset key to process the client after the identity verification is passed. The authentication token obtained from the identity information of the client. After receiving the authentication token sent by any application server in a mutual trust server cluster (that is, the issuing server), the client can send a service call request to any application server in the mutual trust server cluster. The authentication token is sent so that the application server can perform authentication on the client locally according to the aforementioned content without using a remote server to complete the authentication, which can greatly improve the efficiency of authentication. That is to say, the servers in the same server cluster can mutually recognize the authentication token issued by the other party, so that the identity authentication can be quickly completed locally, avoiding calling the authentication method of the remote server, thereby improving performance.

In some specific implementations, the preset key usually includes a preset public key and a preset private key, and the aforementioned step 202 can be specifically implemented in the following manner: decrypting the verified identity information in the identity verification token based on the preset public key, Obtain the corresponding decrypted identity information; the verified identity information is the issuing server, which is obtained by encrypting the client's identity information summary based on the preset private key; the client's identity information summary is the issuing server, which is obtained by processing the client's identity information based on the preset summary algorithm; The preset digest algorithm processes the identity information to be verified in the authentication token to obtain a summary of the identity information to be verified; if the summary of the identity information to be verified is consistent with the decrypted identity information, it is determined that the identity information to be verified is consistent with the verified identity information.

Specifically, a preset digest algorithm is used to process the identity information to be verified in the identity verification token to obtain a digest of the identity information to be verified. And, the verified identity information in the identity verification token is decrypted by using the preset public key to obtain corresponding decrypted identity information. Finally, by comparing the digest of the identity information to be verified and the consistency of the decrypted identity information, the consistency of the identity information to be verified and the verified identity information can be determined. In addition, if the verified identity information in the authentication token is obtained by encrypting the client's identity information based on the preset private key, the verified identity information can be decrypted by the preset public key to obtain the client's identity information, and compare the The consistency of the identity information and the identity information of the client determines the consistency of the identity information to be verified and the verified identity information.

Please refer to Figure 3. On the basis of the foregoing embodiments, before the client sends a service call request to the application server, the client also needs to send a request for the mutual trust to any application server in the corresponding mutual trust server cluster, that is, the distribution server. The first service call request of any server in the server cluster to generate an identity verification token, this embodiment of the application also includes the following steps:

301. In response to a service invocation instruction for any service, the client sends a service initialization request to the distribution server deploying any service.

The authentication token can be obtained through the first business call request initiated by any service in the mutual trust server cluster where the application server is located. Specifically, the server that receives the first service invocation request is the distribution server, and the service deployed by the distribution server is any one of the aforementioned services. Because the server that accepts the service invocation request sent by the client is uncertain, the service invocation instruction for any service initiated by the client may be initiated for any server in the mutual trust server cluster.

It should be noted that when the client first receives a user-initiated service invocation instruction for any server in a certain mutual trust server cluster (the instruction is initiated by the user to the client), the client will first send a call to any The service issuing server sends a service initialization request to verify whether the client has the right to access the server. Only after confirming that the client has the right to access any service will the client initiate a service for any service deployed by the sending server Invoke the request to access either service.

302. In response to the service initialization request sent by the client, the distribution server initiates identity verification for the client to the remote server.

When the client sends a service initialization request to any server in a mutual trust server cluster, there is no local authentication token that has been encrypted by any server in the mutual trust server cluster. Therefore, when sending a service initialization request for the first time, the issuing server Authentication needs to be done with the help of a remote server.

303. If the client passes the identity verification, the remote server sends verification passing information to the distribution server.

If the identity information of the client is allowed to access any of the aforementioned services deployed by the distribution server, the remote server sends a verification pass message to the distribution server to inform the distribution server of the identity verification result of the client.

304. If receiving the verification passing information for the client from the remote server, the issuing server processes the identity information of the client based on the preset key, and generates an identity verification token of the client.

If the verification information sent by the remote server is received for the client, it means that the client has passed the identity verification. Then, the issuing server can perform processing on the authenticated identity information of the client through the preset key, so as to generate an authentication token of the client.

In some specific implementations, this step can be implemented in the following ways: process the identity information of the client based on a preset digest algorithm to obtain a digest of the client's identity information; encrypt the digest of the client's identity information based on a preset private key to obtain verified identity information ; Generate an authentication token that includes the client's identity information, as well as the authenticated identity information.

Specifically, first, the identity information of the client is processed based on a preset digest algorithm to obtain a corresponding digest of the identity information. Then, based on the preset private key and the preset encryption algorithm, encryption processing is performed on the aforementioned corresponding identity information abstract to obtain encrypted identity information (that is, the verified identity information described in the aforementioned embodiments). Finally, the client's identity information and encrypted identity information can be combined as an authentication token. Among them, the encrypted identity information can be used to determine whether the issuing server and the application server belong to the same mutual trust server cluster (if they do not belong to the same mutual trust server cluster, the application server cannot use the preset public key to decrypt the aforementioned encrypted identity information); the identity information of the client That is, the identity information to be verified in the foregoing embodiments, because the identity information of the client exists in the identity verification token in plain text, and its content cannot be guaranteed not to be tampered with, so it is called the identity information to be verified.

In addition, the identity verification token can also be generated in the following manner: First, perform encryption processing on the identity information of the client based on the preset private key and the preset encryption algorithm to obtain the encrypted identity information (that is, the authenticated identity as described in the preceding embodiments information). That is to say, the identity information of the client is directly encrypted to obtain the encrypted identity information. Finally, the client's identity information and encrypted identity information can be combined as an authentication token. The embodiment of the present application does not specifically limit the way of generating the identity verification token.

It should be noted that, according to the different ways of generating the identity verification token, different methods should be adaptively used to verify the identity information to be verified and the consistency of the verified identity method.

305. The issuing server sends the identity verification token to the client.

306. The client receives and saves the identity verification token sent by the issuing server.

Specifically, the client can save the authentication token in any local location of the client. However, in order to facilitate the call of the authentication token, you can choose to save the authentication token in the security context field of the local thread. Because the security context field is saved in ThreadLocal, that is, in the same thread, it is very convenient to use and does not need to be passed explicitly, and it can be directly obtained anywhere you want to use it.

In the embodiment of this application, various implementation modes of identity verification tokens are provided, which improves the feasibility of the solution.

On the basis of the foregoing embodiments, after the application server receives a service invocation request for the target service it deploys, the application server can also initiate an invocation request for other services deployed by other servers in the same mutual trust server cluster according to the needs of the business logic. A business call request, instead of the client, sends the client's authentication token to other servers for deployment, so that other servers can perform identity verification locally.

Various embodiments of the identity verification method of the present application have been described above, and the identity verification method of the embodiment of the present application will be described below in a specific scenario.

When the client sends a service initialization request, when Context ctx=new InitialContext(env) generates the JNDI name context, it will put the user name and password in env and pass it to the issuing server. After the issuing server passes the verification, it will send the client Return an AccessToken (that is, an authentication token). After the client gets the authentication token, it saves it in the security context of the local thread. In the future, within the scope of this security context, the EJB object can be used to continuously call business methods. Each call no longer passes identity information to the application server, but can secretly pass the authentication token, and the application server gets this The authentication token needs to be verified locally. After the verification is passed, the access is allowed to continue;

Because the application server and the issuing server belong to the same mutual trust server cluster, and any servers in the same mutual trust server cluster will mutually recognize the authentication tokens issued by each other. In addition to the scenario used in EJB clusters, in addition to establishing mutual trust server clusters among EJB cluster members, there is another scenario, such as a Web domain that receives the identity information entered by the user through the login page, and after passing the verification in a specific way, also The authentication token will be generated and saved in the security context of the local thread. At this time, if the Web domain directly calls the EJB in another EJB domain, as long as the Web domain and the EJB domain trust each other, the call can also be successful. It should be noted that there is no essential difference between the two domains (that is, the EJB domain and the Web domain), but usually the deployment of EJB applications is called the EJB domain, and the deployment of Web applications is called the Web domain. In fact, EJB and Web can also be deployed in the same domain. There is no mandatory requirement for the domain, and separate deployment is also due to management needs, such as clearer division of responsibilities, or different domains can form clusters of different sizes.

Please refer to Figure 4, the embodiment of the present application provides an application server, including:

The receiving unit 401 is configured to receive the identity verification token sent by the client; the identity verification token is issued to the client by the issuing server; the identity verification token is generated by the issuing server based on the identity information of the client by processing the preset key; the issuing server It belongs to the same mutual trust server cluster as the application server, and the preset key of each server in the same mutual trust server cluster is the same;

A determining unit 402, configured to determine whether the verified identity information included in the identity verification token and the identity information to be verified are consistent based on a preset key;

The determining unit 402 is further configured to determine that the client has passed the authentication and allow the client to call the application server if the identity information to be verified is consistent with the verified identity information.

In a specific implementation manner, after the client is allowed to call the application server, the application server further includes: a sending unit and an access unit;

The sending unit is configured to send the authentication token of the client to other servers deploying other services in response to service call requests for other services, and the other servers and the application server belong to the same mutual trust server cluster;

The access unit is configured to access other services deployed by other servers if no verification failure information sent by other servers is received.

In a specific implementation manner, the preset key includes a preset private key and a preset public key; the determining unit 402 is specifically configured to decrypt the verified identity information in the identity verification token based on the preset public key, and obtain the corresponding The identity information is decrypted; the verified identity information is the issuing server, which is obtained by encrypting the client’s identity information summary based on the preset private key; the client’s identity information summary is the issuing server, which is obtained by processing the client’s identity information based on the preset summary algorithm;

Process the identity information to be verified in the identity verification token based on a preset digest algorithm to obtain a digest of the identity information to be verified;

If the digest of the identity information to be verified is consistent with the decrypted identity information, it is determined that the identity information to be verified is consistent with the verified identity information.

Please refer to Figure 5, the embodiment of this application provides a client, including:

The sending unit 501 is configured to send an identity verification token to the application server deploying the target business in response to a service call instruction for the target business; the identity verification token is issued by the issuing server to the client; the identity verification token is issued by the issuing server based on The preset key handles the generation of the identity information of the client; the issuing server and the application server belong to the same mutual trust server cluster, and the preset key of each server in the same mutual trust server cluster is the same;

The access unit 502 is configured to access the target service deployed by the application server if no verification failure information sent by the application server is received.

In a specific implementation manner, before sending the identity verification token to the application server deploying the target service, the sending unit 501 is further configured to, in response to a service invocation instruction for any service, send Service initialization request, so that the issuing server initiates identity verification for the client to the remote server;

The access unit 502 is also used to receive and store the identity verification token sent by the issuing server, and access any service deployed by the issuing server based on the identity verification token; Generated after verification.

In a specific implementation manner, the access unit 502 is specifically configured to save the identity verification token in the security context of the local thread of the client.

Please refer to Figure 6, the embodiment of the present application provides a distribution server, including:

Initiating unit 601, configured to initiate identity verification for the client to the remote server in response to the service invocation request sent by the client;

The processing unit 602 is configured to process the identity information of the client based on the preset key and generate the identity verification token of the client if the verification pass information sent by the remote server is received for the client;

The sending unit 603 is configured to send the identity verification token to the client, so that the client sends a service invocation request to the application server deploying the target service according to the identity verification token, and makes the application server locally send the client a request based on the identity verification token The terminal performs identity verification, and the application server and the distribution server belong to the same mutual trust server cluster, and the preset keys of each server in the same mutual trust server cluster are the same.

In a specific implementation manner, the preset key includes a preset private key and a preset public key; the processing unit 602 is specifically configured to process the identity information of the client based on a preset digest algorithm, and obtain a digest of the client's identity information;

Encrypt the identity information summary of the client based on the preset private key to obtain encrypted identity information;

Generate an authentication token that includes the client's identity information, as well as encrypted identity information.

7 is a schematic structural diagram of a computer device provided by an embodiment of the present application. The computer device 700 may include one or more central processing units (central processing units, CPU) 701 and a memory 705, and one or one above applications or data.

Wherein, the storage 705 may be a volatile storage or a persistent storage. The program stored in the memory 705 may include one or more modules, and each module may include a series of instructions to operate on the computer device. Furthermore, the central processing unit 701 can be configured to communicate with the memory 705 , and execute a series of instruction operations in the memory 705 on the computer device 700 .

The computer device 700 can also include one or more power supplies 702, one or more wired or wireless network interfaces 703, one or more input and output interfaces 704, and/or, one or more operating systems, such as Windows Server™, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

The central processing unit 701 may execute the operations performed by the computer device in the foregoing embodiments shown in FIGS. 1 to 6 , and the details are not repeated here. Wherein, the computer device may be a client, an issuing server, an application server and/or a remote server.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disk or optical disc and other media that can store program codes.

The embodiment of the present application also provides a computer program product containing instructions, which, when the computer program product runs on a computer, causes the computer to execute the above-mentioned identity verification method.

Claims (10)

1. An identity verification method, characterized in that it is applied to an application server, the method comprising: Receive the identity verification token sent by the client; the identity verification token is issued to the client by the issuing server; the identity verification token is processed by the issuing server based on a preset key to the identity information of the client Generate; the distribution server and the application server belong to the same mutual trust server cluster, wherein the preset key of each server in the same mutual trust server cluster is consistent; Based on the preset key, determine whether the verified identity information included in the identity verification token and the identity information to be verified are consistent; If the identity information to be verified is consistent with the verified identity information, it is determined that the client has passed the identity verification, and the client is allowed to call the application server. 2. The method according to claim 1, wherein after allowing the client to call the application server, the method further comprises: In response to a service invocation request for other services, sending the identity verification token of the client to other servers deploying the other services, the other servers and the application server belong to the same mutual trust server cluster; If the verification failure information sent by the other server is not received, access the other services deployed by the other server. 3. The method according to claim 1, wherein the preset key includes a preset private key and a preset public key; and determining the identity verification token based on the preset key includes Whether the verified identity information and the identity information to be verified are consistent, including: Decrypt the verified identity information in the identity verification token based on the preset public key to obtain corresponding decrypted identity information; the verified identity information is the issuing server, and encrypt the described identity information based on the preset private key Obtaining the summary of the client's identity information; the summary of the client's identity information is obtained by processing the client's identity information based on a preset summary algorithm by the issuing server; processing the identity information to be verified in the identity verification token based on the preset digest algorithm to obtain a digest of the identity information to be verified; If the digest of the identity information to be verified is consistent with the decrypted identity information, it is determined that the identity information to be verified is consistent with the verified identity information. 4. An identity verification method, characterized in that it is applied to a client, and the method comprises: In response to a service invocation instruction for the target service, an identity verification token is sent to the application server deploying the target business; the identity verification token is issued to the client by the issuing server; the identity verification token is issued by the The distribution server processes the generation of the identity information of the client based on a preset key; the distribution server and the application server belong to the same mutual trust server cluster, wherein the preset key of each server in the same mutual trust server cluster is consistent; If the verification failure information sent by the application server is not received, access the target service deployed by the application server. 5. The method according to claim 4, wherein before sending the identity verification token to the application server deploying the target service, the method further comprises: In response to a service call instruction for any service, send a service initialization request to the distribution server deploying the any service, so that the distribution server initiates an identity verification for the client to the remote server; Receive and save the identity verification token sent by the issuing server, and access any service deployed by the issuing server based on the identity verification token; the identity verification token is issued by the issuing server in the Generated after the remote server determines that the client is authenticated. 6. The method according to claim 5, wherein the storing the authentication token sent by the issuing server comprises: The authentication token is saved in the security context of the local thread of the client. 7. An identity verification method, characterized in that it is applied to a distribution server, and the method comprises: Responding to the service invocation request sent by the client, initiate identity verification for the client to the remote server; If receiving the verification information sent by the remote server for the client, processing the identity information of the client based on a preset key to generate an identity verification token of the client; Send the identity verification token to the client, so that the client sends a service call request to the application server deploying the target service according to the identity verification token, and make the application server send a service call request according to the identity verification token identity verification for the client locally, the application server and the issuing server belong to the same mutual trust server cluster, and the preset keys of each server in the same mutual trust server cluster are consistent. 8. The method according to claim 7, wherein the preset key includes a preset private key and a preset public key; processing the identity information of the client based on the preset key to generate the The client's authentication token, including: processing the identity information of the client based on a preset digest algorithm to obtain a digest of the client's identity information; Encrypting the identity information digest of the client based on a preset private key to obtain encrypted identity information; An identity verification token including the identity information of the client and the encrypted identity information is generated. 9. A computer device, comprising: Central processing unit, memory and input and output interfaces; The memory is a temporary storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory, and execute instructions in the memory to perform the method according to any one of claims 1-3, 4-6 or 7-8. 10. A computer storage medium, characterized in that instructions are stored in the computer storage medium, and when the instructions are executed on a computer, the computer is executed as claimed in claims 1 to 3, 4 to 6 or 7 to 8. any one of the methods described.

Images